Docstoc

measurement

Document Sample
measurement Powered By Docstoc
					Roadmap

 So far, basics of wireless networks
   Physical   layer characteristics
    • What happens at source, receiver, in air
   MAC
    • MAC for 802.11 WLAN
    • MAC for sensor networks
   Routing
    • For ad-hoc networks
    • Optimization-based approach
    • For DTNs
                                                 1
Roadmap

 Advanced topics in wireless networks
   Measurement
   Management
   Security  issues
   Fault tolerance issues (or mobility
    issues?)




                                          2
Network Measurement

 motivation
 measurement strategies
   active
   passive
   sampling




                           3
Motivation
 service providers, service users
   monitoring
   anomaly detection
   debugging
   traffic engineering
   pricing, peering, service level agreements

 researchers, designers, software developers
    architecture design
    application design




                                                 4
Active measurements
 active probe tools send stimulus (packets)
  into network; measure response
     network, transport, application layer probes
 can measure many things
   delay/loss
   topology/routing behavior
   bandwidth/throughput

 earliest tools use Internet Control
  Message Protocol (ICMP)


                                                     5
ping
 uses ICMP Echo capability

   C:\WINDOWS\Desktop>ping www.soi.wide.ad.jp
   Reply from 203.178.137.88: bytes=32 time=253ms TTL=240
   Reply from 203.178.137.88: bytes=32 time=231ms TTL=240
   Reply from 203.178.137.88: bytes=32 time=225ms TTL=240
   Reply from 203.178.137.88: bytes=32 time=214ms TTL=240
 Ping statistics for 203.178.137.88:
    packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    approximate round trip times in milliseconds:
    Minimum = 214ms, Maximum = 253ms, Average =
     230ms
                                                       6
traceroute
 diagnostic tool in widespread use by users
  and providers
 finds outward path to given host, round
  trip times along path




                                               7
Example: traceroute
 for n=1,2,…,nmax
  send pkt with TTL = n
  pkt dies at nth router
  router returns ICMP pkt with router
    address
   traceroute to mafalda.inria.fr (128.93.52.46), 30 hops max, 38 byte packets
    1 cs-gw (128.119.240.254) 0.924 ms 0.842 ms 0.847 ms
    2 lgrc-rt-106-8.gw.umass.edu (128.119.3.154) 1.089 ms 0.633 ms 0.499 ms
    3 border4-rt-gi-7-1.gw.umass.edu (128.119.2.194) 0.914 ms 0.589 ms 0.647 ms



   12   inria-g3-1.cssi.renater.fr (193.51.180.174) 85.851 ms 85.930 ms 85.677 m
   13   royal-inria.cssi.renater.fr (193.51.182.73) 86.818 ms 86.395 ms 86.326 m
   14   193.48.202.2 (193.48.202.2) 87.635 ms 86.293 ms 86.495 ms
   15   rocq-gw-bb.inria.fr (192.93.1.100) 89.157 ms 88.419 ms 87.811 ms           8
traceroute example




                     9
Passive measurements
Capture packet data as it passes by
     packet capture applications on hosts use packet
      capture filters (tcpdump)
       • requires access to the wire
       • promiscuous mode network ports to see other traffic
     flow-level, packet-level data on routers
       • SNMP MIBs
       • Cisco NetFlow
     hardware-based solutions
       • Endace, Inc.’s DAG cards – OC12/48/192



                                                               10
Example from tcpdump
04:47:00.410393 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: S 1616942532:1616942532(0) win 512 (ttl 64,
id 47959)
04:47:03.409692 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: S 1616942532:1616942532(0) win
32120 (ttl 64, id 47963)
04:47:03.489652 newbury.bu.edu.http > sunlight.cs.du.edu.4882: S
3389387880:3389387880(0) ack 1616942533 win 31744 (ttl 52, id 27319)
04:47:03.489652 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: . ack 1 win 32120 (DF) (ttl 64, id 47964)
04:47:03.489652 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: P 1:67(66) ack 1 win 32120 (DF) (ttl 64, id
47965) 04:47:03.579607 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . ack 67 win 31744 (DF) (ttl 52, id
27469)
04:47:04.249539 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . 1:1461(1460) ack 67 win 31744 (DF) (ttl 52, id
28879) 04:47:04.249539 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . 1461:2921(1460) ack 67 win 31744
(DF) (ttl 52, id 28880)
04:47:04.259534 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: . ack 2921 win 32120 (DF) (ttl 64, id 47968)
04:47:04.349489 newbury.bu.edu.http > sunlight.cs.du.edu.4882: P 2921:4097(1176) ack 67 win 31744 (DF) (ttl
52, id 29032)
04:47:04.349489 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . 4097:5557(1460) ack 67 win 31744 (ttl 52, id
29033)




                                                                                                            11
Passive IP flow measurement
 IP Flow defined as “unidirectional series of
  packets between source/dest IP/port pair
  over period of time”
     Identified by (IP protcol, src address, src port,
      dst address, dst port)
 exported by applications such as Cisco’s
  NetFlow




                                                          12
Netflow: example

 addin




                                    13
                   courtesy, D. Plonka
Challenges
 flow observations are memory/processor
  intensive

 how to do flow observations at high speeds


 use sampling
   Packet-level sampling
   Flow-level sampling




                                               14
Wireless network measurement
 We’ll look at three papers
     Wireless LAN (WLAN) measurement
       • at Dartmouth college
     Multihop wireless network measurement
       • RoofNet
   Sensor    network measurement
       • Medium-size sensor networks




                                              15
WLAN measurement
 What do you want to know?
     Take UConn wireless LAN as an example:
       • 500 APs, covering 26 buildings




 What and how to measure?




                                               16
My wish-list
 Understanding users
    how many users?
    what applications do they use?
    usage pattern for an application?
    how long do they stay connected?
    are they mobile?
    are they happy w/ the service?

 Understanding the network
    Utilization of the APs?
    Load distribution of the APs?
    Data in and out at APs?

 …

                                         17
From wish-list to measurement
study
 Refine your wish-list
   describe more formally
   Expand on it (any other things interesting?)
      • Main purpose of the network
      • Striking feature of this network
 Relate it to measurement equipment &
  techniques




                                                   18
The Changing Usage of a Mature
Campus-wide Wireless Network

 Tristan Henderson, David Kotz, Ilya Abyzov
             Dartmouth College




                                              19
Campus-wide usage study

 Extensive data collection at
  Dartmouth college over 17 weeks
   November   2003 – February 2004
   190 buildings on 200 acres
   5500 students / 1200 faculty
     • 3200 – 3300 undergraduate students
     • required to own a computer (97% laptops)




                                                  20
Extensive data set collections
  4 sources of data consisting of over
     32 million syslog messages (1 sec resolution)
         • Client authentication, association, roaming
       16 million SNMP polls (5 min interval)
         • In/out bytes/pkts/errors, clients associated, client
           MAC & IP addresses
       4.6 TB of packets sniffed
         • 18 sniffers in 14 buildings, covering 121 APs
         • capture traffic at switch (using tcpdump)
       5.16 GB Call detail records (CDRs) for VoIP
         • Time & duration of calls
         • Phone numbers
         • IP addresses of callers, callees



                                                                  21
Data decomposition and analysis
 Main goals:
      Understand user's behavior
      Quantify change from 2001 (initial deployment)
       to 2004 (current deployment)




                                                        22
Definitions
 Card/user: identified by MAC addr.
 Session: starts w/ associate event, ends w/
  disassociate or deauthenticate event
 Active card: card that is involved in a
  session, during given time or at given place
 Active AP: w/ at least one card associated
 Roam: associate/reassociate within 30
  seconds after previous event
 Inbound/outbound: to/from the card

                                                 23
Defining mobility
 Roaming does not imply mobility
     Static cards can also change APs (due to signal
      strength change, etc.)
 Session diameter: maximum distance
  between any two APs visited in session
 Mobile card: session diameter > 50 m
     Indoor AP range: 39.6 m




                                                        24
  Client usage trends from 2001 to
  2004
 Behaviors that remain the same
     Usage is still diurnal
     Same proportion of heavy users
     Same busiest buildings
 Behaviors that have changed
     # of cards increased linearly
     Roaming increased
     AP utilization increased



                                       25
AP utilization trends
     Fall/Winter 2003/4            Fall 2001




                    Avg = 76.4%                Avg = 66.4%




            Approx 2.5x increase




                                                             26
Traffic trends from 2001 to
2004
 Traffic behavior changes
      Overall traffic increased by approximately 3x
      Applications changed
      Destination reversal (now more on-campus
       traffic)
 Traffic behavior constants
    Residences generate the most traffic




                                                       27
Application changes
 Reported proportions
    www decreased from 62.9% to 28.6%
    P2P increased from 5.2% to 19.3%
    filesystems increased from 5.3% to 21.5%
    streaming increased from 0.9% to 4.6%

        Fall/Winter 2003/4         Fall 2001




                                                28
Specific applications: VoIP
trends
 VoIP usage behaviors
     Usage is diurnal
     Number of devices stable during captured period
     Users made short calls
     Wireless users made few calls




                                       median call: 42 sec
                                       median wireless: 31 sec




                                                                 29
Specific applications: P2P trends
 Files were downloaded and uploaded
    DirectConnect enforces sharing

 Traffic was predominantly internal (72.7%)
    Might be due to traffic shaper

 Few users responsible for most traffic
    10 cards saw over 50% of recorded traffic




                                                 30
 Specific applications: streaming
 trends
 Most streaming was inbound
     Outbound itunes traffic represent music sharing
 Most traffic was within campus (79.6%)
     Streaming for teaching purposes produces large
      files




                       Near traffic: to/from dartmout.edu   31
Mobility
 Home location
   AP at which a user spends most of its time (i.e.,
    more than 50%)
   Consider APs within 50m as the same AP


                          50% of users spent 98.7% of time at home
                          especially in residential, academic, and
                          administration buildings




                                                              32
Prevalence
 Prevalence: amount of time that a user
  spends with a given AP (as a fraction)
                        Prevalence distribution
 Prevalence matrix




                                                  33
Persistence
 amount of time that a user stay associated w/ an AP
  before moving to another AP
 considering 50m session diameter




50% of users spent nearly
10 min at single AP



                                                        34
Summary
 Usage characterization
   Number of wireless cards; utilization of APs
   Specific applications
       • VoIP, P2P, streaming media
     Mobility
       • Prevalence, persistence
 Work is on-going
     Dartmouth currently
       • upgrading to 802.11a/b/g
       • migrating cable TV to IP-based
     Analyze the effects of worms on WLAN
                                                   35

				
DOCUMENT INFO