Internet Measurements

1. Internet Measurements CPE 401/601

2. Web of interconnected networks Grows with no central authority Autonomous Systems optimize local communication efficiency The building blocks are engineered and studied in depth Global entity has not been characterized Most real world complex-networks have non-trivial properties. Global properties can not be inferred from local ones Engineered with large technical diversity Range from local campuses to transcontinental backbone providers Internet

3. Internet Measurements • Need for Internet measurements arises due to commercial, social, and technical issues • Realistic simulation environment for developed products, • Improve network management • Robustness with respect to failures/attacks • Comprehend spreading of worms/viruses • Know social trends in Internet use • Scientific discovery • Scale-free (power-law), Small-world, Rich-club, Dissasortativity,…

4. Where Can Measurements Be Made? IXP

5. Role of Internet Directories and Databases • Address registries • Domain Name System (DNS) • Internet Address and Routing Registries • Internet Assigned Numbers Authority (IANA) • Internet Routing Registry • Clearinghouse for AS number mapping • Regional Internet Registries (RIR)

6. Role of Internet Directories and Databases

7. Challenges to measurement “Poor Observability” • Reasons for this: • Core simplicity • Layered architecture • Hidden pieces • Administrative barriers

8. Internet Measurements are anything but straightforward… • Internet Measurement is key to designing the next generation communication network • Fundamental design principles of the current internet make it harder for measuring various aspects of it • Preliminary research has resulted in a set of basic tools and methods to measure aspects like topology, traffic etc. • Accuracy of such methods is still an open question • There is still a lot of ground to cover in this direction and this is where researchers like you come into the equation!

9. Measurement Types

10. Topology Measurements

11. Properties to Measure • Topology Properties • Autonomous System (AS) • Point of Presence (PoP) • Router • Interface

12. Longitudinal comparison Sources: 1971 - "Casting the Net", page 64; 1980 - http://mappa.mundi.net/maps/maps_001/ http://personalpages.manchester.ac.uk/staff/m.dodge/cybergeography/atlas/historical.html

13. Internet Topology CAIDA 2006

14. Internet Topology Measurement CAIDA 2006

15. Internet Topology Measurement CAIDA 2006

16. IPv4 address space (2010) Ant Census Data researchers have been collecting data about the Internet address space  • ~ 3.5 B IPs • ~ 250 M replies browse historical

17. Active Measurement Tools • Methods that involve adding traffic to the network for the purposes of measurement Ping: Sends ICMP ECHO_REQUEST and captures ECHO_REPLY • Useful for measuring RTTs • Only sender needs to be under experiment control One-Way Active Measurement Protocol (OWAMP): A daemon running on the target which listens for and records probe packets sent by the sender • Useful for measuring one-way delay • Requires both sender and receiver to be under experiment control • Requires synchronized clocks or a method to remove clock offset

18. Probing • Direct probing • Indirect probing IPD Vantage Point IPD TTL=64 B C D A IPB IPC Vantage Point B C D IPD TTL=1 IPD TTL=2 A

19. Traceroute • Useful for determining path from a source to a destination • Uses the TTL (Time To Live) field in the IP header in a clever but distorted way • Large scale measurement systems use traceroute to discover network topology

20. Traceroute • Probe packets are carefully constructed to elicit intended response from a probe destination • traceroute probes all nodes on a path towards a given destination • TTL-scoped probes obtain ICMP error messages from routers on the path • ICMP messages includes the IP address of intermediate routers as its source • Merging end-to-end path traces yields the network map IPB IPA IPC IPD Vantage Point Destination TTL=1 TTL=4 TTL=2 TTL=3 A B C D S

21. Traceroute Problem • Suppose the path between A and D is to be determined using traceroute X Y D A B C

22. Traceroute Process X Y D A B: “time exceeded” Dest = D TTL = 1 B C

23. Traceroute Process X Y D A C: “time exceeded” Dest = D TTL = 2 B C

24. Traceroute Process X Y D A D: “echo reply” Dest = D TTL = 3 B C

25. Internet Topology Measurement Internet2 backbone S s.3 s.2 s.2 n.1 n.3 n.3 N c.2 w.2 w.1 u.1 c.1 W C c.3 w.3 w.3 u.2 U c.4 k.1 k.2 K u.3 l.1 k.3 Trace to NY a.1 a.2 l.2 L A l.3 l.3 a.3 a.3 h.2 Trace to Seattle H h.3 h.1 h.4 h.4 h.4 d

26. Internet Topology Measurement s.1 f e S s.3 n.2 s.2 n.1 n.3 N c.2 w.2 w.1 c.1 u.1 W C c.3 w.3 u.2 U c.4 k.1 k.2 K u.3 l.1 k.3 a.1 a.2 l.2 L A l.3 a.3 • Traces • d - H - L - S - e • d - H - A - W - N - f • e - S - L - H - d • e - S - U - K - C - N - f • f - N - C - K- H - d • f - N - C - K - U - S - e h.2 H h.3 h.1 h.4 d

27. Challenges • Infrastructural Issues • Sampling • Vantage Points and Destination List • Probing Overhead • Inter- and Intra-monitor Redundancy • Responsiveness of Routers • ICMP, UDP, TCP • Load Balancing Routers • Per destination, per flow, per packet

28. Traceroute issues • Path Asymmetry • Destination -> Source need not retrace Source -> Destination • Unstable Paths and False Edges • Aliases • Measurement Load

29. Unstable Paths and False Edges Inferred path: A -> B -> Y Y: “time exceeded” Dest = D TTL = 2 X Y D A B: “time exceeded” Dest = D TTL = 1 B C

30. Topology Sampling: Issues • Sampling to discover networks • Infer characteristics of the topology • Different studies considered • Effect of sample size [Barford 01] • Sampling bias [Lakhina 03] • Path accuracy [Augustin 06] • Sampling approach [Gunes 07] • Utilized protocol [Gunes 08] • ICMP echo request • TCP syn • UDP port unreachable • ~ 10% of routers are unresponsive

31. Measurement Load • Traceroute inserts considerable load on network links if attempting a large-scale topology discovery • Optimizations reduce this load considerably • If single source is used, instead of going from source to destination, a better approach is to retrace from destination to source • If multiple sources and multiple destinations are used, sharing information among these would bring down load considerably

32. Intra-monitor redundancy Destination 2 Destination 1 Destination 3 Monitor 1

33. Inter-monitor redundancy Destination 1 Monitor 2 Monitor 1 Monitor 3

34. y y S S L 1 2 H H x x Unresponsive Routers • Unresponsive routers do not respond to traceroute probes and appear as  in traceroute output • Same router may appear as  in multiple traces. y y: S – L – H – x y: S –  – H – x S L H x: H – L – S – y x: H –  – S – y x

35. Unresponsive Router Resolution f Internet2 backbone e S N C W U K L A H • Traces • d -  - L - S - e • d -  - A - W -  - f • e - S - L -  - d • e - S - U -  - C -  - f • f -  - C -  -  - d • f -  - C -  - U - S - e d

36. IP Alias Resolution .33 .5 • Each interface of a router has an IP address. • A router may respond with different IP addresses to different queries. • Alias Resolution is the process of grouping the interface IP addresses of each router into a single node. • Inaccuracies in alias resolution may result in a network map that • includes artificial links/nodes • misses existing links .18 Denver .7 .13

37. IP Alias Resolution s.1 f e S s.3 n.2 s.2 n.1 N n.3 c.2 u.1 w.1 w.2 c.1 W C c.3 u.2 w.3 U k.1 c.4 k.2 K u.3 k.3 l.1 a.1 l.2 a.2 L A l.3 a.3 h.2 • Traces • d - h.4 - l.3 - s.2 - e • d - h.4 - a.3 - w.3 - n.3 - f • e - s.1 - l.1 - h.1 - d • e - s.1 - u.1 - k.1 - c.1 - n.1 - f • f - n.2 - c.2 - k.2 - h.2 - d • f - n.2 - c.2 - k.2 - u.2 - s.3 - e H h.3 h.1 h.4 d

38. Subnet Resolution • Alias resolution • IP addresses that belong to the same router • Subnet resolution • IP addresses that are connected over the same medium IP2 IP3 IP1 IP4 IP6 IP5 IP1 IP1 IP2 IP3 IP2 IP3

39. Geolocation • Given the network address of a target host, what is the host’s geographic location? • The answer to this is useful for a wide variety of social, economic and engineering purposes • The actual location of network infrastructure sheds light on how it relates to population, social organization and economic activity

40. Geolocation methods • Name Based Geolocation • Extracting location details from ISPs domain names • Location Databases • Delay Based Geolocation • Best Landmark • Constraint-based

41. Landmark based geolocation • In best landmark approach, minRTT between each of the identified landmarks is measured and stored. • Then the same metric is calculated between the node in question and each of the landmarks. • The landmark with the best matching values of minRTT is the closest to the node

42. Constraint based geolocation • The distances of target location from sufficient number of fixed points are calculated and using multilateration • Used in GPS • However, Internet delay is affected by many factors

43. Passive Measurements • Methods that capture traffic generated by other users and applications • Routeview repository collects BGP views (routing tables) from a large set of ASes • Similarly, OSPF LSAs can be captured and processed to generate router graphs within an AS

44. Passive Measurement: Advantages and Disadvantages • Large set of AS-AS, router-router connections can be learned by simply processing captured tables • However, especially using BGP views, there could be potential loss of cross-connections between ASes which are along the path • Secondly, route aggregation and filtering tends to hide some connections • Also, multiple connections between ASes will be shown as a single connection in the graph

45. AS level Internet topology • An autonomous system (AS) is a network or a collection of networks that are all managed and supervised by a single entity or organization.  AS 2 AS 1 AS 4 AS 3 • Interconnection of Autonomous Systems (Internet Service Providers, Universities, Companies) • Distinct regions of administrative control

46. AS level Internet topology • Connection between ASes • AS needs to know how to reach the rest of the Internet • BGP (Border Gateway Protocol) • provides reachability across the whole Internet • exchange routing information between ASes • iBGP, eBGP • eBGP: Border router • a direct link to another border router in another AS AS 2 AS 1

47. AS rank Data: http://as-rank.caida.org/

49. Historical