Network Measurements, Modeling and Simulations. Kun-chan Lan Department of Computer Science and Information Engineering [email protected] Some Admin stuff. Paper review 2 paper reviews instead one as we originally planned since now the number of enrollment is reduced to 7
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Why do you come to this class? What do you want to get out of this course?
All of these should be in your project report!
How fair is TCP over GPRS?
tcpdump [ -adeflnNOpqStvx ] [ -ccount ]
[-Ffile ] [ -iinterface ] [ -rfile ] [ -ssnaplen ]
[-Ttype ] [ -wfile ] [expression ]
Must run as root or have sudo permission
-iListen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback)
-nDon't convert addresses (i.e., host addresses, port numbers, etc.) to names
-pDon't put the interface into promiscuous mode.
-q Quick (quiet?) output. Print less protocol information so output lines are shorter.
-r Read packets from file (which was created with the -w option). Standard input is used if file is ``-''.
-wWrite the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''.
-rRead packets from file (which was created with the -w option). Standard input is used if file is ``-''.
-SPrint absolute, rather than relative, TCP sequence numbers
-s snarf snaplen bytes of data from each packet rather than the default of 68. 68 bytes is adequate for IP, ICMP, TCP and UDP but may truncate protocol information from name server and NFS packets. Packets truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level at which the truncation has occurred.
Taking larger snapshots both increases the amount of time it takes to process packets and, effectively, decreases the amount of packet buffering. This may cause packets to be lost.
- Limit snaplen to the smallest number that will capture the protocol information you're interested in.
-tDon't print a timestamp on each dump line.
-ttPrint an unformatted timestamp on each dump line.
-v(Slightly more) verbose output. For example, the time to live and type of service information in an IP packet is printed.
-vvEven more verbose output. For example, additional fields are printed from NFS reply packets.
-xPrint each packet in hex.
<type> <dir> <proto>
E.g., `tcp dst port ftp or ftp-data or domain' == `tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
True if the IP address matches net a netmask len bits wide. May be qualified with src or dst.
True if the packet has a length less than or equal to length. This is equivalent to: len <= length.
short for: ether proto pwhere p is one of the above protocols.
short for: ip proto p
AS100: 188.8.131.52/16 100
AS200: 184.108.40.206/16 200 100
AS300: 220.127.116.11/16 300 200 100
9 5Use BGP to choose traceroute
closer to destination
18.104.22.168/24 8 11 42 5
2 are on the same router
and the resulting ICMP packets
have the same source address Z,
then we know X and Y are on
the same router
within the POP
the neighboring domains
s: data packet size
ste: ICMP packet size
bi: available bandwidth
c: light speed
fi: process packet
Utilize RTT variation
1Life is not perfect
(A:10, B:1) is a different location from (A:1, B:5)
BSSID or SSID
(Basic Service Set Identifier)
beaconBasic service set
(Extended Service Set Identifier)Extended service set
symbol for ‘1’ 101100111000
received symbol 101100111001
symbol for ‘0’ 010011000111
received symbol 101100111001
the received symbol is ‘closer’ to 1 than to 0
signal quality == percentage of ‘correct’ bits
== reflect the corruption between AP and client
but not necessarily equal to SNR
Consider a tcpdump record
1092727442.276251 IP 192.168.0.120:22 > 192.168.0.137:9320
How precise is it?
Answer: at most 1 us, but perhaps much less
A typical scenario