Traffic Monitoring on CJK-Network

1. Traffic Monitoring on CJK-Network 16th CJK NGN-WG 2009.7.22-24 TTC Nobuyuki NAKAMURA (Oki Electric Industry Co., Ltd.) nakamura758@oki.com

2. Overview Given the situation of interconnectivity among various NGN networks,MPM will become a very important node for traffic observation.We have been investigating the possibility of analyzing network quality by observing traffic at MPM. We will perform monitoring at MPM with the following traffic paths using our monitoring method(see appendix ), which is suitable for analyzing video/audio streaming. ・Traffic Path 1:China/Korea - Japan RTP traffic ・Traffic Path 2:Japan – China/Korea - Japan RTP loopback traffic China Korea MPM MPM RTCP-XR RTCP-XR Network TAP MPM Our algorithm is utilizing stream mining, which is useful in Traffic Monitoring in NGN. Japan Storage Collect RTCP Network load Correlation Analysis

3. Traffic Path 1: RTP traffic between China/Korea and Japan SIP Phone SIP Server ・We will set up one of terminals in China/Korea NW, and another terminal and SIP server in Japan NW. ・We will analyze the behavior between collected packets on MPM and network load, and feed backthis analysis to the Traffic Path 2 experiment with loopback at China/Korea MPM. Multi Media session MPM MPM Network load Japan Network TAP Collect packets Storage

4. Outline of experiments & researches Detection of the network anomaly throughtraffic analysis at MPM with the following steps. #1 Create Network anomaly by intentionally generating instability to wireless link #2 Collect packets capturing data at MPM (Japan) These packets might contain not only our experiment traffic but also various traffic in CJK testbed. #3 Extract the packets that relates to network anomaly through our analysis. #4 Detect network anomaly point i.e. instability of wireless link in Japan In #3 and #4, we will utilize our analysis method (see appendix) so that we can confirm whether our method is useful or not. Various CJK traffic China MPM MPM Japan #1 create Instable wireless link Our session Network TAP #2 Collect packets #3#4 detect Instability Storage

5. Traffic Path 2: Japan-China/Korea-Japan traffic monitoring Purpose Verification of effective network load or anomaly for Traffic Path 1 experiment by testing various network load or anomaly Step#1-#4 will also be performed in this path. Next plan Evaluate on the Japan-China-Korea-Japan triangle path. SIP Phone SIP Server Multi Media session MPM MPM network load China/Korea Network TAP Japan Collect packets Return point of traffic routes Storage

6. Current progress Equipment of Japan NW Setup SIP-server and SIP-Phone terminal. Setup and check the VPN connection to Japan NW from experiment room. Traffic monitoring at Japan MPM is operating continuously. Traffic Path1: China/Korea – Japan traffic path Check the connectivity from a terminal at China NW to another terminal and SIP server at Japan NW. (July 21) (see next page) Step #1 and #2 (July 21) Traffic Path 2: Japan – China/Korea – Japan traffic path Setup return point of traffic routes at Korea MPM.(Done) Collecting packets.(Done) Step#3 and #4 are executing now. We will use this experimental system to experiment about various network anomaly by the improvisation, according to the result of step #3 or #4.

7. Monitoring Results asof July 21, 2009 Multi Media session Network load MPM MPM Japan Captured data Network TAP Collect packets Storage We made a experiment on July 21 at CATR site. We captured and collected data in Japan site. Ｃｈｉｎａ Captured Data taken in Japan site

8. Captured Data taken from MPM in CATR site on July 21st. Data was also taken from MPM in CATR as follows. Some variationwas observed by looking at RTCP-XR parameters such as packet loss and delay. We’ll analyze these data by using our analysis methods, and show the result of analysis on next CJK meeting. VoIP Metrics (BT=7) SSRC of source = 1931663208 Loss rate = 0 (0.0%) Discard rate = 0 (0.0%) Burst density = 0 (0.0%) Gap density = 0 (0.0%) Burst duration = 0 (ms) Gap duration = 5040 (ms) Round trip delay = 0 (ms) End system delay = 0 Signal level = 0 Noise level = 0 RERL = 0 Gmin = 16 R factor = 93 Ext. R factor = 0 MOS-LQ = 40 MOS-CQ = 44 RX config = 0 JB nominal = 0 JB maximum = 0 JB abs max = 0 Statistics Summary (BT=6) SSRC of source = 1931663208 Begin seq = 2 end seq = 252 Lost packets = 0 Dup packets = 0 Min jitter = 0 (0 ms) Max jitter = 80 (10 ms) Mean jitter = 16 (2 ms) Dev jitter = 16 (2 ms) Min ttl or hl = 127 Max ttl or hl = 127 Mean ttl or hl = 127 Dev ttl or hl = 0

9. Schedule Although traffic Path2 will be a main experiment, hopefully we would continue traffic monitoring using Traffic Path 1 Through collaboration with CATR and ETRI i.e path from Japan to Korea as well. Continue if needed Continue if needed Traffic Path1(July 21st China – Japan ) Traffic Path 2 (Japan – China/Korea – Japan ) Step #3(Extraction) Step #4(Analysis)

10. Appendix References (for pp.4) we will perform analysis by utilizing our algorithm as follows. Ikada and Hamaguchi, “Improved Approximate Frequency Counts Algorithm based on “Lossy Counting””, IEICE Technical Report Vol.107, No.524, pp.43-47, 2008. Ikada, Nakamura and Hamaguchi, “Network Traffic Prediction for Network Quality Anomaly Detection by RTP Communication Monitoring”, IEICE Technical Report Vol.109, No.79, pp.67-72, 2009. Nakamura, Ikada, “Detection Method for Network Quality Degradation by using Network Characteristics”, IEICE Technical Report Vol.108 No.458, pp.167-172, 2009. Thank you for your attention. This work is partly supported by the National institute of Information and Communications Technology (NICT).