Fraleigh, C., Diot, C., Lyles, B., Moon, S., Owezarski, P., Papagiannaki, D., Tobagi, F.: Design and deployment of a passive monitoring infrastructure. Lecture Notes in Computer Science 2170 (2001)  Home/Search   Document Details and Download   Summary   Related Articles   Check

....the headers of all packets arriving on a link and time stamping the packet, that is, measuring the arrival time, a j . The result of measuring over an interval of time is a packet trace. Packet trace collection today enjoys a very high degree of accuracy and effectiveness for traffic study [28], 29] Trace Group Number Link ###### AIX2(90sec) 23 622mbps 13.06 COS1(90sec) 90 156mbps 10.83 COS2(90sec) 90 156mbps 10.81 NZIX(5min) 100 100 mbps 10.75 NZIX7(5min) 100 100 mbps 9.60 NZIX5(5min) 100 100 mbps 8.66 NZIX6(5min) 100 100 mbps 7.85 NZIX2(5min) 100 100 mbps 7.32 NZIX4(5min) 100 100 ....

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and Deployment of a Passive Monitoring Infrastructure," in Proceedings Passive and Active Measurement, Amsterdam, 2001, Ripe NCC.

....Within each group, flows arrive as a Poisson process with rate #.Wevary# to study both uncongested and congested scenarios. We use the ns 2 built in routines to generate web sessions consisting of a single object each. This is what we Notice that in accordance with the usual practice [8] [12], 13] packets are said to belong to the same flow if they have the same source and destination IP address, and source and destination port number. A flow is on if its packets arrive more frequently than a timeout of some seconds. This timeout is usually set to something less than 60 seconds. ....

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Proceedings of the Workshop on Passive and Active Measurements, PAM, April 2001.

....link speeds in terms of packets per second. We combine this with the Bloom filter efficiency factor of 0.2 from above to compute a rule of thumb: This may in fact be a significant under estimate. Recent studies have found the mean packet size has grown to over 400 bytes in many instances [8] [27]. The corresponding decrease in packet arrival rate eases the load on SPIE s digest tables. SPIE requires roughly 0.5 of the total link capacity in digest table storage. For a typical low end router with four OC 3 links, this results in roughly 23MB of storage. On the very high end, a core ....

Chuck Fraleigh, Christophe Diot, Bryan Lyles, Sue Moon, Philippe Owezarski, Dina Papagiannaki, and Fouad Tobagi, "Design and deployment of a passive monitoring infrastructure," in RIPE Workshop on Passive and Active Measurements, Apr. 2001.

....of the processed TCP connections. We also apply the estimation methodology on a number of NLANR traces and examine the variability of the measured RTT distributions in both short and long timescales. 1. INTRODUCTION Passive monitors are increasingly used by network operators and researchers [6, 8]. This technology, which originated with Jacobson s tcpdump in the late eighties [9] allows recording of all network traffic that flows through a link. With passive monitors we can observe the entire workload of a link, as opposed to active measurement tools that Prepared through collaborative ....

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In Proceedings of Passive and Active Measurements (PAM) Workshop, 2001.

....demanding task on modern network infrastructures. As argued in [9] the scalability of the stateless IP networks has been bought at the expense of observability, which has in turn led to the recent study of several ways of monitoring networks in order to support control and management functions [10, 12]. Most routers o#er builtin monitoring functionality, accessible using mechanisms such as SNMP [27] or NetFlow [7] However, the domain of network monitoring has exposed fundamental weaknesses of these static functionality, protocol based, parametric designs. User needs vary and are uncertain at ....

....a possible attack. As new attacks are being invented it is easy to develop and deploy mechanisms to counter them. 2. 2 Tra#c Analysis While primarily a tool for Internet research, tra#c analysis is also becoming important for service providers to support functions such as tra#c engineering [10]. SNMP [27] and NetFlow [7] impose an a priori specification of the granularity of the tra#c data in the form of standardized objects. This was also the main trigger for the development of passive measurement systems such as OC3MON [3] These systems passively listen on a network link and dump ....

Chuck Fraleigh, Christophe Diot, Bryan Lyles, Sue Moon, Philippe Owezarski, Dina Papagiannaki, and Fouad Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In PAM 2001 Workshop, April 2001.

.... systems such as pings have restricted capabilities by their very nature as they both interfere with and also do not always give an accurate picture of network conditions [45] Passive measurement systems do not suffer from these limitations, but measurements can only be analyzed off line [19]. The drawback in this case is that there exist applications that require real time analysis, while 1 See, e.g. 34] and [5] respectively. 1 for a number of other applications, the ability to trade off storage and communication for computation results in increased efficiency. Customizing the ....

....recorded. The module also has the option of blocking traffic from the attacking as well as the attacked site. The ALTQ QoS API is used for this purpose. 4. 3 Traffic Analysis While originally a tool for research, traffic analysis is now needed for management functions such as traffic engineering [19]. As discussed in Section 2, efficient extraction of the needed information is not always possible through SNMP or NetFlow interfaces, and the use of passive measurement systems can be unnecessarily costly. We have built a simple analysis module to demonstrate the simplicity of providing this ....

Chuck Fraleigh, Christophe Diot, Bryan Lyles, Sue Moon, Philippe Owezarski, Dina Papagiannaki, and Fouad Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In PAM 2001 Workshop, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure, " in Proceedings of Passive and Active Measurement Workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, K. Papagiannaki, and F. Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In Passive and Active Measurement Workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, K. Papagiannaki, and F. Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In Passive and Active Measurement Workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure, " in Proceedings of Passive and Active Measurement Workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, K. Papagiannaki, and F. Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In Passive and Active Measurement Workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owerzarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Passive and active measurements workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, K. Papagiannaki, and F. Tobagi, "Design and Deployment of a Passive Monitoring Infrastructure," in Passive and Active Measurement Workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, K. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure, " in Passive and Active Measurement Workshop, Amsterdam, Apr. 2001.

....packet traces. Each trace is a sequence of packet records that contain the first 40 bytes of each packet, which are just the IP and UDP TCP headers, as well as a submicrosecond timestamp which indicates the time at which the A detailed description of the monitoring infrastructure is provided in [16]. packet was observed. The source and destination IP addresses are not anonymized, since they are needed in routing related analysis. Each monitoring entity is a dual processor Linux server (Dell PowerEdge 6000 series) with 1 GB main memory, a large disk array (100 to 330 GB) and a POS network ....

....by an embedded clock on the DAG card that is synchronized to an external GPS signal. GPS is a satellite based system that provides global time information with an accuracy of 20 nanoseconds. Hardware errors as well as other system related issues bring the maximum error on timestamps to 5 #s [16][17] This synchronization ability allows us to measure one way network delay between two monitored links. A total of 60 monitoring entities are installed at 4 different POPs, chosen on the basis of geographic diversity and connectivity. They monitor the traffic on OC 3, OC 12, and OC 48 links ....

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure," in Proc. of Passive and Active Measurement Workshop, Amsterdam, The Netherlands, April 2001.

....of the queueing behavior of any single output link is unrealistic in an operational network. We have designed a measurement system to address the first two of the above difficulties, and deployed it in a commercial tier 1 IP backbone network to collect packet traces with accurate timestamps [6]. By splitting the optical signals, and tapping a part of them, the measurement systems are capable of capturing and timestamping every packet traversing the link (see details in Section II) Then, by comparing the differences in timestamps at the input and output links, we obtain the single hop ....

....data presented in this paper. These monitoring systems have been deployed on various links in a Point of Presence (POP) of the Sprint E#Solutions IP backbone. We have collected hour and day long packet traces, and analyzed them off line. Details of the measurement infrastructure can be found in [6]. A. Measurement Environment Clock Synchronization Each DAG card features a dedicated clock on board. This clock runs at a rate of 16MHz which provides a granularity of 59.6 ns between clock ticks. Packets are not timestamped immediately when they arrive at the DAG card. They first pass ....

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure, " in Proceedings of Passive and Active Measurement Workshop, Amsterdam, April 2001.

....monitoring involves tapping the link on which data needs to be collected, and recording to disk either complete packets, or just packet headers and timestamps indicating their arrival time. In this paper we consider how a currently deployed OC3 and OC 48 monitoring system deployed at Sprint [1] can be scaled to monitor OC 192 links. We will use the OC 48 system as a starting point for our discussion. In short, an optical splitter copies all of the data on the link, which is received by a packet capture card [2] on a PC. Timestamps recorded by the capture card are synchronized to a GPS ....

....board and then sent to the PC main memory over the PC s PCI bus. We believe this system to be representative of most passive monitoring systems. Collecting packet traces at higher link speeds is difficult for several reasons: # PCI bus throughput is already challenged at OC 48 (as explained in [1], the PCI bus is crossed twice for any data transfer: once from the capture board to the main memory, and a second time from the main memory to the hard disk) A new bus technology needs to be used at 10 Gbps. # We currently collect several terabytes of data per day in a POP at OC 48 speed. At ....

[Article contains additional citation context not shown here]

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, F. Tobagi, Design and Deployment of a Passive Monitoring Infrastructure, Passive and Active Measurement Workshop, Amsterdam, April 2001.

....for collecting and processing data from backbones. To address this deficiency, we study traffic traces collected at a Point of Presence (POP) in a commercial Tier 1 IP backbone network. A passive monitoring system is used to collect packet level traces on a number of access links within the POP [1]. The data is then analyzed offline in order to understand the dynamics of traffic entering the backbone at this POP. We describe a methodology for extracting information about routing and traffic flow within the backbone. This methodology forms the basis for building components of POPto POP ....

....discusses related work, and Section VIII discusses some of the implications of our results and identifies directions for future work. II. MEASUREMENT INFRASTRUCTURE The data used for this study was gathered from an operational IP backbone using the passive monitoring infrastructure described in [1]. The backbone topology consists of a set of nodes known as Points of Presence (POPs) connected together by high bandwidth backbone links. Each POP also locally connects customers through access links, ranging from large corporate networks to regional ISPs and webservers. Peering at a POP is ....

[Article contains additional citation context not shown here]

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagianaki, and F. Tobagi, "Design and Deployment of a Passive Monitoring Infrastructure," Passive and Active Measurement Workshop, Amsterdam, Netherlands, April 2001.

....Finally, Section 5 summarizes the findings of the paper and points out potential extensions. 2. Traffic Measurement and Traffic Matrix Generation The generation of traffic matrices for our study is based on measurements taken within Sprint s IP backbone. The Sprint IP backbone monitoring project [6] provided us with packetlevel traces from a single POP (called the monitored POP ) Optical splitters and IPMON systems [6] are used on each of the monitored links to capture the first 44 bytes of every IP packet traversing the link. These 44 byte headers include address and size information for ....

....Matrix Generation The generation of traffic matrices for our study is based on measurements taken within Sprint s IP backbone. The Sprint IP backbone monitoring project [6] provided us with packetlevel traces from a single POP (called the monitored POP ) Optical splitters and IPMON systems [6] are used on each of the monitored links to capture the first 44 bytes of every IP packet traversing the link. These 44 byte headers include address and size information for each packet. In addition, each IP packet is time stamped using a globally synchronized clock (GPS based) From this ....

[Article contains additional citation context not shown here]

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Passive and Active Measurement Workshop, Amsterdam, April 2001.

....customer links, PoPs generally have links to public and private peering points for connection to other carriers networks. Our approach is to collect per packet header information from multiple links at multiple PoPs simultaneously, and timestamp each packet record using GPS synchronized clocks[3]. Packet traces are then shipped back to Sprint Labs for off line analysis. A passive optical splitter on an OC 3, OC 12 or OC 48 link is connected to a monitoring system: a high end Linux PC equipped with a University of Waikato DAG3 or DAG4 card [2] The DAG card captures the first 44 bytes of ....

C. Fraleigh, C. Diot, B. Lyles, S. Moon, D. Papgiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Proceedings of the Workshop on Passive and Active Measurements, Amsterdam, Netherlands, April 2001.

No context found.

Fraleigh, C., Diot, C., Lyles, B., Moon, S., Owezarski, P., Papagiannaki, D., Tobagi, F.: Design and deployment of a passive monitoring infrastructure. Lecture Notes in Computer Science 2170 (2001)

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. B. Moon, P. Owezarski, D. Papagiannaki, and F. A. Tobagi. Design and deployment of a passive monitoring infrastructure. In Proceedings of the Thyrrhenian International Workshop on Digital Communications, pages 556--575. Springer-Verlag, 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and Deployment of a Passive Monitoring Infrastructure", In Proceedings of Passive and Active Measurements(PAM), April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Evolutionary Trends of the Internet, Thyrrhenian International Workshop on Digital Communications, IWDC 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, K. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure," in Proc. of Passive and active measurement workshop, 2001.

No context found.

C. Fraleigh, C. Diot, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi, "Design and deployment of a passive monitoring infrastructure," in Proc. Passive and Active Measurement Workshop, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. Lecture Notes in Computer Science, 2170:556--568, 2001. also at PAM2001. (p 32)

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. Lecture Notes in Computer Science, vol 2170:page 556, 2001.

No context found.

Chuck Fraleigh, Christophe Diot, Bryan Lyles, Sue Moon, Philippe Owezarski, Dina Papagiannaki, and Fouad Tobagi. Design and Deployment of a Passive Monitoring Infrastructure. In PAM 2001 Workshop, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owerzarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Passive and active measurements workshop, Amsterdam, April 2001.

No context found.

C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owerzarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. In Passive and active measurements workshop, Amsterdam, April 2001.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC