J. Apisdorf, K. Claffy, K. Thompson, and R. Wilder. Oc3mon: Flexible, affordable, high performance statistics collection. In Proceedings of LISA X, pages 97--112, Chicago, IL, September 1996.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....and the associated problem of data display. Monitoring solutions tend to have two variants: instantaneous and long term. Research in monitoring has progressed along a number of axes. First, there has been work in monitoring specific sources from file and directory state [RL91] to OC3 links [AkcTW96] Simultaneously, generic monitoring infrastructure [HM92, AP97] has been developed. Finally, as the amount of data available has increased, some work on data display has been done [Oet98] The categorization here was by the type of thing being monitored (host, network system) Perhaps a better ....

....indices can be added to maintain the efficiency of the queries. Using data structured into tables and made available remotely over the network is a significant departure from previous systems. They generally use a custom module for data storage and only a few provide any remote access to the data[AkcTW96, Dol96, Fin97, HA93, HM92, SB93, SL93, SA95, SW91, Sim91, Wal95] Although building an integrated module can increase efficiency for a single consumer of the data, some of that improvement is lost with multiple consumers. Furthermore, the flexibility of the system is reduced because adding new ....

Joel Apisdorf, k claffy, Kevin Thompson, and Rick Wilder. OC3MON: Flexible, Affordable, High Performance Statistics Collection. In Proceedings of the Tenth Systems Administration Conference (LISA '96), Chicago, Illinois, pages 97--112, 1996. http://www.nlanr.net/NA/Oc3mon/. 99

....despite its high copy overheads and inability to keep pace with high arrival rates its packet filtering capacity and familiarity are attractive to many projects. More recently monitoring designs aimed towards keeping pace with today s network bandwidths include the ambi tious OCxMon architecture [2] based upon off the shelf components, and the AT T Labs PacketScope [1] probe based upon a dedicated 500 MHz Alpha workstation. The interaction between TCP and HTTP and the TCP behaviour of Web Servers is studied using active techniques with TBIT [16] and the in the WAWM project [3] using a ....

J. Apisdorf, K. claffy, K. Thompson, and R. Wilder. Oc3mon: flexible, affordable, high performance statistics collection.

....server log becomes a less attractive solution. The alternatives require effort as well as cooperation with the Web server or network owner. The Web Server software could be altered to provide a special log at the time the HTTP reply header is available. A passive monitoring system such as OC3MON [3] or FLAME [2] could be instrumented to provide a live stream of IP addresses (as well as transfer sizes if snooping into the HTTP reply is allowed) for considering as measurement targets. Except for Web connections, it may be possible and interesting to probe paths of other applications, such as ....

J. Apisdorf, k claffy, K. Thompson, and R. Wilder. OC3MON: Flexible, Affordable, High Performance Statistics Collection. In Proceedings of the 1996.

....system. Finally, BPF performance degrades rapidly as the number of concurrent applications increases [5] There have been several studies on optimizing the packet filter [8] efficient network interface access [20] as well as system architectures designed specifically for network monitoring [6, 17, 15, 4]. Most network monitoring applications, however, do not need elaborate packet filters (and therefore cannot take advantage of the aforementioned optimizations) to demultiplex packet streams into different processes; instead, a single process receives all the packets and does its own packet ....

J. Apisdorf, k claffy, K. Thompson, and R. Wilder. OC3MON: Flexible, Affordable, High Performance Statistics Collection. In Proceedings of the

....We used a 330 Mhz machine running FreeBSD. The FORE Systems PCA 200EPC ATM NIC has been used for network monitoring and trac generation by MCI on the vBNS (very high performance Backbone Network Service [28] 29] In fact the CORAL group [5] 6] 16] 18] speci cally the OC3MON project [19] have made the drivers for this NIC freely available, and they form the basis for our work. Speci cally, the existing DOS transmit driver and the FreeBSD receive driver (the basis of our trac measurement infrastructure [30] served as templates for a new FreeBSD transmit driver, a task seriously ....

J. Apisdorf, K. Clay, K. Thompson, and R. Wilder, \OC3MON: Flexible, aordable, high performance statistics collection, " in INET'97 Conference, June 1997.

....SMTP, and NNTP and we use the empirical distributions in [5] to characterize the underlying protocols for these applications. We implement these application speci c trac generator under ns and deploy some measures to maintain the proportion of these tracs according to the empirical distribution [4] in the simulation. Another important issue with trac generation is selfsimilarity in wide area and Ethernet trac[5] Generation of aggregate trac which is self similar in nature is of utmost importance in simulation scenarios as Poisson models grossly underestimate the queuing delays and over ow ....

J. Apisdorf, K. Clay, K. Thompson, and R. Wilder, \Oc3mon: Flexible, aordable, high performance statistics collection", Proceedings of INET'97, June 1997.

....e orts to 155 Mbps ATM trac, also on inexpensive hardware. In this system the on line estimation is identical to that described here, only the lower layers have changed. The details of the ATM trac monitor are fully described in [9] The lower layers of the system are based around the OC3MON [20] which has been used successfully to monitor the vBNS (very high performance Backbone Network Service [21] as part of the CORAL project [22] 23] 24] 25] VI. Long term measurements One of the major advantages of on line measurement is that measurements can be made over long periods. This ....

J. Apisdorf, K. Clay, K. Thompson, and R. Wilder, \OC3MON: Flexible, aordable, high performance statistics collection," in INET'97 Conference, June 1997.

.... (CAIDA) 45] manages a variety of measurement and data collection efforts but the project most closely related to ours is called Coral Reef [92] This project is focused on building a passive network measurement and analysis tool suite to be used with high speed packet filters such as the OCxMONs [10]. The emphasis of this project is the generation of a suite of measurement and analysis tools and not on a specific research objective. AT T Research has been making detailed measurements in AT T Worldnet for a number of years. Beginning with the development of their PacketScope passive ....

J. Apisdorf, K. Claffy, K. Thompson, and R. Wilder. OC3MON: flexible, affordable, high performance statistics collection. In Proceedings of the USENIX Tenth System Administration Conference (LISA X), Chicago, IL, September 1996.

....equipment if it is to be almost ubiquitous. If this can be achieved then these results can be used in real time applications such as Call Admission Control (CAC) rate adaptation, or congestion control. The NLANR, in co ordination with MCI, as part of the CORAL project [3] 4] 5] 6] [7], has developed a suite of OCXmon(itors) which allow non invasive measurement of optical links (OC3 155 Mbs, OC12 622 Mps) carrying ATM trac. We have adapted their work to allow the measurement of the fractal characteristics of trac in real time, as the data is collected. The core of our ....

.... around a PC architecture, using a COTS ATM Network Interface Card (NIC) The FORE Systems PCA 200EPC ATM NIC has been used for network monitoring by MCI on the vBNS (very high performance Backbone Network Service [19] In fact the CORAL group [3] 4] 5] 6] speci cally the OC3MON project [7], has made the drivers for this NIC freely available. Hence this was an ideal starting point (we have recently learnt there is at least one other project based at the University of Waikato in New Zealand which has developed similar hardware [20] We therefore based our monitor around the OC3MON, ....

J. Apisdorf, K. Clay, K. Thompson, and R. Wilder, \OC3MON: Flexible, aordable, high performance statistics collection," in INET'97 Conference, June 1997.

....all network traffic between the campus and the public Internet (traffic between the campus and Internet 2 sites was routed over a separate OC 3 link) We placed the monitor on the OC 3 link to the public Internet. The specific monitor used was the OC3mon developed initially at MCI for vBNS [1] and now distributed by CAIDA (CoralReef) 34] This monitor was passively inserted in the link using a fiber splitter to divert some light from the optical signal. The signal is input to the receive port of an ATM interface card in an Intel architecture PC equipped with large, high performance ....

J. Apisdorf, K Claffy, K. Thompson, and R. Wilder. OC3mon: Flexible, Affordable, High-Performance Statistics Collection, Proceedings of INET '97, June 1997. (http://www.isoc.org/isoc/whatis /conferences/inet/97/proceedings/F1/F1_2.HTM)

....providers to support functions such as tra#c engineering [10] SNMP [27] and NetFlow [7] impose an a priori specification of the granularity of the tra#c data in the form of standardized objects. This was also the main trigger for the development of passive measurement systems such as OC3MON [3]. These systems passively listen on a network link and dump packet headers to disk. Trace files can then be downloaded for o# line analysis. The flexibility lies in that these systems capture the full stream of data for later processing. There are, however, certain constraints with this ....

....The first generation of a measurement tools such as tcpdump(8) were based on the Berkeley Packet Filter [18] bpf(4) provides operating system functionality for tra#c monitoring. Users employ filters specified in a Filter Language that execute on a filter machine. inside the kernel. oc3mon [3] is a dedicated host based monitor for 155Mbit s OC3 ATM links. The host records the captured headers into files for post processing. No real time functionality for packet processing is considered in the original design. ntop(8) 8] is an end system network monitoring tool that shares a subset of ....

Joel Apisdorf, k cla#y, Kevin Thompson, and Rick Wilder. OC3MON: Flexible, A#ordable, High Performance Statistics Collection. In Proceedings of the 1996 LISA X Conference, 1996.

....for accurate time was either poor or nonexistent. What was missing was information on relative time of packet inter arrivals at a single link and packet arrivals at one point in the network relative to another point in the network. A feature of the first generation of passive Internet monitors [OC3MON] was the use of off the shelf network interface cards with no support for accurate, high resolution packet timestamping. As a result, timestamp precision and accuracy were poor and frequent timestamp wraps would create ambiguities. In general, those errors cannot be fixed by post processing. 2 17 ....

....all cells except the first in each packet. The trace records contain the first 40 bytes of the IP packet. This is sufficient to capture all the information present in IP ICMP, IP TCP and IP UDP headers in the case where no protocol options are present. This approach is identical to other monitors [OC3MON]. We are not interested in or permitted to collect user data. For UDP packets the first 12 bytes of the user payload is also present in the trace record. Those must be appropriately sanitised in a post processing stage (see security and privacy considerations below) For data capture on ....

Joel Apisdorf, K Claffy, Kevin Thompson, Rick Wilder: OC3MON: flexible, affordable, high performance statistics collection, NLANR MOAT and MCI/vBNS, 13 Sept 1996. http://www.nlanr.net/NA/Oc3mon/.

.... give an accurate picture of network conditions [45] Passive measurement systems do not suffer from these limitations, but measurements can only be analyzed off line [19] The drawback in this case is that there exist applications that require real time analysis, while 1 See, e.g. 34] and [5], respectively. 1 for a number of other applications, the ability to trade off storage and communication for computation results in increased efficiency. Customizing the function of a passive monitor for a particular application is a possibility; however, it requires significant effort. To our ....

....reduction by processing may be more efficient, especially if the processing task is limited; we present an example module that illustrates the power of this approach. Finally, in most passive monitoring systems policy as well as functionality is hard coded into the system. For instance, OC3MON [5] only captures packet headers (IP and TCP) but some applications may require access to the payload. 2.2 Implementation challenges of programmable packet monitoring Previous work in this context has demonstrated the benefits but also revealed limitations of programmable packet monitoring. In ....

[Article contains additional citation context not shown here]

Joel Apisdorf, k claffy, Kevin Thompson, and Rick Wilder. OC3MON: Flexible, Affordable, High Performance Statistics Collection. In Proceedings of the 1996 LISA X Conference, 1996.

....as o#ered by SNMP etc. is insu#cient for the purposes of Internet research. Furthermore, most of the time researchers and developers cannot predict what kind of traces they might need in the future. This was also the main trigger for the development of passive measurement systems such as OC3MON [2]. These systems passively listen on a network link and dump packet headers on disk. These files can then be downloaded for o# line analysis. The flexibility lies in that these systems get the full stream of data that could be useful for later processing. There are, however, problems with the ....

....in a Filter Language. In practice, a lightweight virtual machine is used for flexibility. Of course, the capabilities of the system are limited: only forward branches are allowed and there is no communication with the environment; this is the task of the application that uses bpf(4) oc3mon [2] is a dedicated host based monitor for 155Mbit s OC3 ATM links. Only the first ATM cell out of each IP packet is transmitted from the ATM interface to the host system. The host records the captured headers into files for post processing. No realtime functionality for packet processing is ....

Joel Apisdorf, k cla#y, Kevin Thompson, and Rick Wilder. OC3MON: Flexible, A#ordable, High Performance Statistics Collection. In Proceedings of the 1996 LISA X Conference, 1996.

....all network traffic between the campus and the public Internet (traffic between the campus and Internet 2 sites was routed over a separate OC 3 link) We placed the monitor on the OC 3 link to the public Internet. The specific monitor used was the OC3mon developed initially at MCI for vBNS [1] and now distributed by CAIDA (CoralReef) 37] This monitor was passively inserted in the link using a fiber splitter to divert some light from the optical signal. The signal is input to the receive port of an ATM interface card hosted in an Intel architecture PC equipped with large, ....

J. Apisdorf, K Claffy, K. Thompson, and R. Wilder. OC3mon: Flexible, Affordable, High-Performance Statistics Collection, Proceedings of INET '97, June 1997. (http://www.isoc.org/isoc/whatis/conferences/inet/97/proceedings/F1/F1_2.HTM)

....general research in networking to help better understand Internet. It is worth mentioning that in the very high speed networks, the collection of data itself is an issue because of the processing burden on the router. The collection mechanism used by NLANR is called OC3MON, and is described in [14]. NLANR uses, in parallel, other mechanisms, like active measurements (probing) and SNMP information to verify the accuracy of the collected information. The traces used in this thesis can be retrieved from NLANR s website [15] Perl scripts are also provided on the website which can be used to ....

Joel Apisdorf, K. clay (NLANR), Kevin Thompson and Rick Wilder, \OC3MON: exible, aordable, high performance statistics collection" [Online]. Available: http://www.nlanr.net/NA/Oc3mon, Aug 1996. 53

....Structure of on line simulator empirical distributions in [7] to characterize the underlying protocols for these applications. We implement these application speci c trac generator under ns and deploy some measures to maintain the proportion of these tracs according to the empirical distribution [6] in the simulation. Another important issue with trac generation is selfsimilarity in wide area and Ethernet trac[7] Generation of aggregate trac which is self similar in nature is of utmost importance in simulation scenarios as Poisson models grossly underestimate the queuing delays and over ow ....

J. Apisdorf, K. Clay, K. Thompson, and R. Wilder, \Oc3mon: Flexible, aordable, high performance statistics collection", Proceedings of INET'97, June 1997.

....cell and packet capture to the production of high level HTML reports in near real time. Network and system administrators can use the CoralReef suite to monitor and interpret a wide range of observed network behavior. CoralReef evolved from OCXmon monitors, developed jointly by MCI and NLANR [3][4]. The OCXmon monitors ran on MS DOS, could only monitor ATM links, and provided only basic cell capture (in device dependent format) and limited ow summary capability. CoralReef runs on UNIX, and supports device independent access to network data from OCXmon hardware, native OS network ....

J. Apisdorf, k clay, K. Thompson, and R. Wilder, \OC3MON: Flexible, aordable, high-performance statistics collection," in INET'97 Proceedings, June 1997, http://www.isoc.org/isoc/ whatis/conferences/inet/97/proceedings/F1/F1\_%2.HTM.

....of cell and packet capture to the production of high level HTML reports in near real time. Network and system administrators can use the CoralReef suite to monitor and interpret a wide range of observed network behavior. CoralReef evolved from OCXmon monitors, developed jointly by MCI and NLANR [3][4] The OCXmon monitors ran on MS DOS, could only monitor ATM links, and provided only basic cell capture (in device dependent format) and limited ow summary capability. CoralReef runs on UNIX, and supports device independent access to network data from OCXmon hardware, native OS network ....

J. Apisdorf, k clay, Kevin Thompson, and Rick Wilder, \OC3MON: Flexible, aordable, high performance statistics collection, " in In Proceedings of the 1996.

....17 C C Programs Perl Programs CRL.pm Unpack.pm libcoral Coral Drivers Trace Files libpcap Flows Analysis Tables flows Raw Traffic Stack Flows Stack Flow Interval Handler Fig. 1. Software components of CoralReef monitoring ATM trac from the same specialized hardware used by OC3MON [5]. For its research, CAIDA needed to monitor high volumes of ATM trac simultaneously across multiple interfaces, each of which carried multiple streams of trac (ATM virtual channels) OC3MON hardware and related components served these needs while few other tools did, but CAIDA research demanded ....

....allows CoralReef applications to analyze trac o ine, and on hosts other than that from which the data were collected. CoralReef les contain version information that allows the software to read data from les written by any past version of itself. It can also read les written by NLANR [16] or MCI [5] OC3MON software and dagtools [3] software. CoralReef can identify NLANR and MCI les automatically by the format of their header, but must be explicitly told that a given le is in dagtools format. A.3 Libpcap While CoralReef was originally designed to analyze traf c from ATM devices, it was ....

J. Apisdorf, k clay, K. Thompson, and R. Wilder, \OC3MON: Flexible, aordable, high-performance statistics collection," in INET'97 Proceedings, June 1997, http://www.isoc.org/isoc/ whatis/conferences/inet/97/proceedings/F1/F1 2.HTM.

No context found.

J. Apisdorf, K. Claffy, K. Thompson, and R. Wilder. Oc3mon: Flexible, affordable, high performance statistics collection. In Proceedings of LISA X, pages 97--112, Chicago, IL, September 1996.

No context found.

Joel Apisdorf, k clay, Kevin Thompson, and Rick Wilder. OC3MON: Flexible, Aordable, High Performance Statistics Collection. In Proceedings of the 1996 LISA X Conference, 1996.

No context found.

J. Apisdorf, K. Cla#y, K. Thompson, and R. Wilder. OC3MON: Flexible, a#ordable, high-performance statistics collection. In Proceedings of INET, June 1997.

No context found.

J. Apisdorf, k claffy, K. Thompson, and R. Wilder. OC3MON: Flexible, affordable, high performance statistics collection. In Proceedings of the 1996.

No context found.

J. Apisdorf, K. Claffy, K. Thompson, and R. Wilder. OC3MON: Flexible, affordable, high-performance statistics collection. In Proc. of INET'97, 1997. Available at http://www. nlanr. net/I,/0c3mon/.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC