Monitoring and Measurement by xiaohuicaicai


									Measurement and Monitoring

        Nick Feamster
        Georgia Tech
Measurement and Monitoring
 • Measurement: “Inventory” of network state
   – Traffic loads on links
   – End-to-end packet loss rates, throughput, etc.

 • Monitoring: Use of measurement to detect
   events of (operational) interest
   – Link failures
   – Stolen routes (“hijacks”)
Problem Areas
 • Traffic Engineering
 • (Distributed) Network Troubleshooting
 • Anomaly Detection

         Good work in pieces of each puzzle.
                  Lots of heuristics.
         Nothing that unifies these pieces yet.
Traffic Engineering
 • Problem: Tune routing protocol parameters
   to control traffic flow through the network.

                          Internal routing (IGP): routes to
                          nodes within the network (“AS”)
                          BGP: routes to external destinations
Traffic Engineering
  • Goal: Efficient, offline analysis
  • Lots of measured inputs

                  OSPF Link       Static configuration
                   Weight               analysis
                   Topology       configuration
                                                         Traffic matrix
 Routes to
                      Routing Model                      Offered
destinations           for Network                        traffic

                            Traffic Flow
TE-Motivated Algorithmic Problem
 • How to identify large traffic bundles?
    – Today’s mode: By address block (actually, groups of
      prefixes, by AS path regular expressions)
    – Clunky!

 • Wanted: traffic bundle identification
    – “To move 10 Mbps from the Sprint peering point in
      New York to the AT&T peering point in Boston, do X.”
    – X may depend on timescales of traffic engineering
      issue (flash crowd, persistent congestion, etc.)
What to do once we’ve measured?
 • IGP link weights and BGP parameters both:
    – Change the traffic volumes on internal links
    – Change traffic volumes on links between ASes

 • Questions
    – How to explore the parameter search space?
    – How to decide when to tweak IGP or BGP?

 • Probable Answer: Intractable
    – Design for optimization: Could the routing protocol “knobs” be
      designed so that joint optimization is easier?
Network Troubleshooting
 • Goal: Locate and diagnose network performance (or
   reachability) problems

 • Status: Lots of (somewhat imperfect) tools
    –   Ping: “reachability”
    –   Traceroute: “IP-layer path to destination”
    –   Iperf: throughput
    –   Pathchar: per-hop capacity estimation

 • None of these is prescriptive. They often don’t answer
   questions that would lead to a solution.
    – “Why is the traffic not getting there?” (link failure, firewall
      configuration, etc.)
    – “Which network caused this event?”
Why Troubleshooting is Hard
  Plethora of causes
 • Misconfigured filters
 • Link failures (between ASes or within an AS)
 • Middlebox problem (NAT, firewall, etc.)
 • Application-level failures (server crash)
 • Service failure (DNS failure)

 Key (currently hard) questions
 • Is the problem local or global?
 • If global, where is it?
         Perhaps asking neighboring networks can help
Distributed Network Troubleshooting
        How can views of the network from other vantage points
             assist in locating and diagnosing problems?

 “Yes, and my
  path is…”



                        “Can you see
         Georgia Tech
Some Measurement Problems
 • Could protocols be augmented/altered to make them
   more amenable to passive measurement?
    – What are the accuracy bounds for passive measurement
      algorithms (e.g., sampled NetFlow)

 • How many views are needed to locate a problem?
    – Perhaps this depends on the problem…things like
      filtering/reachability might be easier than congestion
    – The answer may also change depending on the topology and
      failure model (i.e., what if some nodes can’t talk to each other?
Measurement and Monitoring
 • Measurement: “Inventory” of network state
   – Traffic loads on links
   – End-to-end packet loss rates, throughput, etc.

 • Monitoring: Use of measurement to detect
   events of (operational) interest
   – Link failures
   – Route hijacks
Anomaly Detection
 • State of the art: Threshold-based schemes
   – Counting the number of BGP updates
   – Counting the number of failed TCP connections
   – Measuring the size of a traffic shift

 • Problem: Many events of interest are small
   – Route hijacks: one BGP update (small amount of traffic)
   – Polymorphic worms: e.g., 2-byte common substring
Detecting Small Events
 • What techniques can tease out (low-energy) signal from
    – Route hijacks: Could exploting correlations across data streams
      expose deviations? Need distributed algorithms for tracking
      patterns in real time…
    – Worm containment: Algorithms for fast (line rate) detection of
      small common substrings?

 • What changes might (1) raise the bar for these attacks or
   (2) facilitate distributed anomaly detection?
    – e.g., having a better notion of identity than an IP address
Real Problem
 • State of the art distributed debugging protocols…

To top