Internet Infrastructure Measurement: Challenges and Tools

1. Internet Infrastructure Measurement: Challenges and Tools Mustafa Zali Internet Measurement Tuesday, 26 Aban 1388

2. Introduction • Review the physical properties of Internet • Physical Properties • Devices (routers, NAT boxes, firewalls, switches), Links (wired, wireless) • Topology Properties • Various levels – Autonomous Systems, Points of Presence, Routers, Interfaces • Traffic Properties • Delays (Transmission, Propagation, Queuing, Processing etc.), Losses, Throughput, Jitter

3. Outline • Properties • Challenges • Tools

4. Properties • Review the important properties of Internet in bottom-up approach: • Component Devices • Topology: How devices interconnected • Interaction of traffic and infrastructure • Our focus in on properties affected by physical infrastructure

5. Physical Devices Properties • Internet: End Systems, Core • Core: Switch, Router, Link • The infrastructure that concerns us here is core of internet.

6. Link • Viewed at the IP layer propagation of data from one node to another is via links. • The details of links is hidden from IP layer (ch 2). • Link properties • Propagation delay • Capacity • Packet delay • Packet loss • jitter

7. Router • Routers move packets from one link to another. • Drop tail • Active Queue Management

8. Router Routing Engine Forwarding table updates Routing Protocol Packet Forwarding Table Forwarding Engine

9. Router Buffer-Interface Interface Switching Fabric Interface Buffer-Interface

10. Wireless • The primary goal of wireless connection is to link users to wired infrastructure • Wireless technology: distance, data rate, reliability, potential interference, number of current users. • Security problem: very open nature of wireless

11. Wireless- Technologies • Narrowband • Wideband: allows signal to be detected easily by receiver. • Infrared: using high frequency range.

12. Wireless- Standards • 802.x: 802.11a, 802.11b, 802.11g • 802.11b: WiFi (Wireless fidelity) • Bluetooth: shorter distance, less power consumption, cheaper • WiMAX: 802.16

13. Wireless • Measurements • Signal strength • Amount of power consumed • Data bite rate • Degree of coverage • Session related information (duration, set-up time) • Other traditional measurements

14. Topology properties • Four level • Autonomous systems: Independently operated and managed network • BGP protocol for routing between them. • Point of presence: Consists of one or more routers in a single location. • Router: Router graph • Vertices are router and edges are links between them • Interface: Interface Graph • Vertices are router intreface and edges are links one-hop connection

15. Interaction of Traffic and Network • Network constrains traffic: • Minimum possible delay • Maximum possible throughput

16. Packet Delay • Routing delay • Packet processing delay • Queuing delay • Additional delay • Transmission delay • Propagation delay

17. Packet Loss • In element n: • Aggregate loss: • Along pass is aggregate of hops:

18. Throughput • Throughput • Throughput on path

19. Packet Jitter • Variability of packet inter arrival times • Low jitter: more predictable, more reliable

20. Challenges • Poor Observability: Observability is not built into the design of Internet protocols and components. • Reasons for this: • Core Simplicity • Hidden Layers • Hidden Pieces • Administrative Barriers

21. Core Simplicity • Stateless nature: Stupid network • Routers is very simple. • Explosive growth of Internet • As network elements do not track packets individually, interaction of traffic with the network is hard to observe

22. Hidden Layers • Below IP level, packet transmission implemented in many ways. • These details are hidden from IP level. • Detailed measurement can not capture these details.

23. Hidden Pieces - Middleboxes • End-to-end argument. • Firewalls – provide security • Traffic Shapers – assist in traffic management • Proxies – improve performance by terminating TCP inside network. (Cache proxy) • NAT boxes – utilize IP address space efficiently • Each of these impedes visibility of network components. • firewalls may block active probing requests • NATs hide away the no. of hosts and the structure of the network on the other side

24. Administrative Barriers • Owing to the competition-sensitive nature of the data required (topology, traffic etc.), ISPs actively seek to hide these details from outside discovery • Information that they do provide are often simplified. • E.g.: Instead of publishing router-level topologies, ISPs often publish PoP-level topologies

25. Tools Classification • Active Measurement • Passive Measurement • Fused/Combined Measurement • Bandwidth Measurement

26. Active Measurement Tools • Methods that involve adding traffic to the network for the purposes of measurement • Ping: Sends ICMP ECHO_REQUEST and captures ECHO_REPLY • Useful for measuring RTTs • Only sender needs to be under experiment control • Zing: Sends at random, exponential time

27. Traceroute • Useful for determining path from a source to a destination • Uses the TTL (Time To Live) field in the IP header in a clever but distorted way • A large scale measurement system called skitter uses traceroute to discover network topology (Chapter 10)

28. IP protocol version number 32 bits total datagram length (bytes) header length (bytes) type of service head. len ver length for fragmentation/ reassembly fragment offset “type” of data flgs 16-bit identifier max number remaining hops (decremented at each router) time to live upper layer Internet checksum 32 bit source IP address 32 bit destination IP address upper layer protocol to deliver payload to E.g. timestamp, record route taken, specify list of routers to visit. Options (if any) data (variable length, typically a TCP or UDP segment) IP Header and the TTL field

29. Traceroute Problem • Suppose the path between A and D is to be determined using traceroute X Y D A B C

30. Traceroute Process X Y D A B: “time exceeded” Dest = D TTL = 1 B C

31. Traceroute Process X Y D A C: “time exceeded” Dest = D TTL = 2 B C

32. Traceroute Process X Y D A D: “echo reply” Dest = D TTL = 3 B C

33. Traceroute issues • Path Asymmetry (Destination -> Source need not retrace Source -> Destination) • Unstable Paths and False Edges • Aliases • Measurement Load

34. Unstable Paths and False Edges Inferred path: A -> B -> Y Y: “time exceeded” Dest = D TTL = 2 X Y D A B: “time exceeded” Dest = D TTL = 1 B C

35. Aliases • IP addresses are for interfaces and not routers • Routers typically have many interfaces, each with its own IP address • IP addresses of all the router interfaces are aliases • Traceroute results require resolution of aliases if they are to be used for topology building

36. Aliases • Alias resolution: • Send packet to both interface. • Close IP ID field and same TTL field. • Record Route Option. (The address of interface that is packet sent.) • Guess: difference in last bits.

37. Measurement Load • Traceroute inserts considerable load on network links if attempting a large-scale topology discovery • Optimizations reduce this load considerably • Track interfaces visited already • Assumption: Routers are stable and only one path exists. • If single source is used, instead of going from source to destination, a better approach is to retrace from destination to source. • If multiple sources and multiple destinations are used, sharing information among these would bring down load considerably (A->B->C->D, X->B)

38. System Support • Injecting and capturing packets, has several security problems. • Efficient packet injection and accurate measurement of arrival and departure times are best done at kernel level • Using scriptroute, unprivileged users can inject and capture packets • Periscope’s API helps define new probing structures and inference techniques for extracting results from arrival patterns of responses • Unrestricted access to the network interface raises security concerns

39. Passive Measurement • Methods that capture traffic generated by other users and applications to build the topology

40. BGP • A BGP routing table is the set of paths. • Each path is the sequence of ASes. • Each AS advertises the routes that it knows. • Routeviews repository is useful for passive internet analysis and monitoring.

42. BGP– Advantages and Disadvantages • Large set of AS-AS, router-router connections can be learned by simply processing captured tables • However, especially using BGP views, there could be potential loss of cross-connections between ASes which are along the path • Secondly, route aggregation and filtering tends to hide some connections • Also, multiple connections between ASes will be shown as a single connection in the graph

43. OSPF • Capture link state announcements within routing domain. • Announcements • Topology changes • External routes change availability

44. Fused Measurement • Combine both active and passive measurements. • Active: large amount of traffic. • One way is to using passive measurement • Another way is to augment passively obtained BGP topologies with additional inter AS connections.

45. Bandwidth Measurement • Bandwidth – amount of data the network can transmit per unit time • Bandwidth measure requirements • Streaming media applications • Server selection • Estimating the bandwidth for TCP flow control • Verification of service level agreement

46. Bandwidth Measurement • Bandwidth measurement is a active process • Bottleneck: link with minimum bandwidth • Three kinds of bandwidth: • capacity: max throughput a link can sustain, • available bandwidth: capacity – used bandwidth and • bulk transfer capacity: rate that a new single long-lived TCP connection would obtain over a path

47. Bandwidth Measurement • Tight link: Link with minimum available bandwidth • Narrow link : Link with minimum capacity

48. Bandwidth Measurement Methods • These focus on observing how packet delay (queuing and transmission) is affected by link properties Four types: • Packet-pair Methods • Size-delay Methods • Self-induced Congestion • Bulk Transfer Capacity Measurement

49. Packet-Pair Methods • Methods to measure capacity and available bandwidth • Involve sending probe packets with known inter-packet gaps and measuring the same gap downstream • where C is the capacity, L is the length of probe packets, max delta is the maximum inter-packet gap measured downstream

50. Packet-Pair Methods- Capacity