网络测量与行为学 网络测量与行为学概述. 程光 东南大学计算机科学与工程学院 CERNET 华东 ( 北 ) 地区网络中心江苏省计算机网络技术重点实验室

Transcription

1 网络测量与行为学 网络测量与行为学概述 程光 东南大学计算机科学与工程学院 CERNET 华东 ( 北 ) 地区网络中心江苏省计算机网络技术重点实验室

2 主讲教师简介 计算机工程系, 教授, 安徽黄山人 研究方向 : 网络测量 行为学和网络安全 目前主要研究项目 2009CB 基于自治治理模型的网络管理与安全研究 负责人, 国家 973 BK 下一代网络热点异常自适应抽样测量方法研究 负责人, 江苏省自然基金 高速网络活跃节点检测及其流量分类方法研究, 负责人, 国家自然基金项目 2008BAH37B04 可信任互联网 - 新一代可信任互联网安全和网络服务, 国家科技支撑计划, 子项目负责人 联系方式 gcheng@njnet.edu.cn

3 课程介绍 目标在增强学生在网络方向的研究能力, 开拓学生在网络研究领域的视野, 同时学生能够学习一些网络测量工具 流量仿真建模工具等 通过阅读该领域的论文, 学生学会如何定义一个研究问题 选择一个具体的研究方法, 并完成和网络行为相关的研究课题 主要参考书 互联网流测量, 程光, 东南大学出版社,

4 主要讲授内容 第一部分 : 网络测量与行为学概述, 讲授网络测量与行为学的发展状况和研究内容 第二部分 : 网络测量方法, 讲授抽样测量方法 流数和超点测量方法 重尾流测量 网络流量应用识别 流量匿名化算法 带宽测量方法 拓扑和时延测量方法 第三部分 : 行为分析方法, 讲授行为测度 自相似理论 网络流量测量建模 第四部分 : 行为学相关工具, 讲授相关的测量工具 NS-2 网络仿真器

5 网络测量 行为学主要会议 ACM Internet Measurement Conference (IMC) ACM SIGMETRICS/Performance Passive and Active Measurement ocnference: PAM Sigcomm Infocom

6 阅读文献方法 Context and Problem Statement: What problems are the authors trying to solve? Are they important problems? Why or why not? New Idea: What new architecture, algorithm, mechanism, methodology, or perspective are the authors proposing? How is the new idea different from all other ideas to solve the same problem?

7 阅读文献方法 ( 续 ) What to Evaluate? What, according to the authors, need to be evaluated to confirm the worthiness of their new idea? Runtime? Throughput? Cache miss ratio? Utilization? How to Evaluate? How did the authors go about conducting the evaluation? Did they prove theorems? Did they run simulations? Did they build a system? Did they collect traces from existing systems?

8 阅读文献方法 ( 续 ) Was the Evaluation Correct and Adequate? How was their data collection done? Do you agree with their analysis of the data? Do you agree with their conclusions about the data? Do you have new interpretation of their data? Can you suggest new ways to evaluate their idea? Limitations, Drawbacks, Extensions: Can you think of other aspects of their idea that need to be evaluated? Can you think of extensions or modifications to their idea to improve it? How would you evaluate your improvement? Can you apply their idea or method of evaluation to your own project?

9 What do we care about when we design networks? End to end behavior Reachability Performance in terms of delay, losses, throughput Security Stability/fault resilience of the end to end path System wide behavior Load distribution within a domain Stability/Robustness/Survivability Manageability Evolvability

10 Measurement Purpose Understand the traffic characteristics of existing networks Develop models of traffic for future networks Useful for simulations, planning studies

11 Requirements Network measurement requires hardware or software measurement facilities that attach directly to network Allows us to observe all packet traffic on the network, or to filter it to collect only the traffic of interest Assumes broadcast-based network technology, superuser permission

12 What are we measuring? What is the Internet? Large scale distributed networked computer system What does the Internet look like? Properties of interest Traffic (demand) Infrastructure Applications Performance

13 Traffic Link/network/transport layer? Packet/Byte/Flow Level? Per Flow vs. Per Aggregate? Distributions by applications FTP, HTTP, Peer2peer Fan out: flow level measurements from specific network? source/destination address? AS? Temporal variability (time of day?) Spatial variability Important prefixes? Popular servers? Traffic anomalies How to detect them? How to define normal/ abnormal?

14 Infrastructure All aspects of the physical structure of the network Network topology Connectivity graph: how are basic entities connected? Infer AS hierarchy/relationships? Characteristics of the Infrastructure Links (optical, electrical, wireless): signal strength, bit/block/packet error rate, collision detection Routers: CPU load, buffer length, etc. Switches: buffering, switching speed, collision detection, contention resolution

15 Infrastructure ( 续 ) Control plane: Intra & Inter Domain Routing Link failure characteristics Routes/paths taken IGP/BGP convergence Peering policies

16 Applications Key characteristics/behavior of applications worth measuring Applications Web Video Streaming P2P Network Games Online social network sites Properties User workload models (join/leave) Application demands (bandwidth, etc) Performance characteristics

17 Performance Network operational characteristics or performance Throughput Available bandwidth; bottleneck bandwidth Latency Jitter Losses

18 Measurement Tools Can be classified into hardware and software measurement tools Hardware: specialized equipment Examples: HP 4972 LAN Analyzer, DataGeneral Network Sniffer, others... Software: special software tools Examples: tcpdump, xtr, SNMP, others... Nmap, wireshark

19 Measurement Tools (Cont d) Measurement tools can also be classified as intrusive or nonintrusive Intrusive: the monitoring tool generates traffic of its own during data collection Non-intrusive: the monitoring tool is passive, observing and recording traffic info, while generating none of its own

20 Measurement Tools (Cont d) Measurement tools can also be classified as real-time or non-real-time Real-time: collects traffic data as it happens, and may even be able to display traffic info as it happens Non-real-time: collected traffic data may only be a subset (sample) of the total traffic, and is analyzed off-line (later)

21 Potential Uses of Tools Protocol debugging Network debugging and troubleshooting Changing network configuration Designing, testing new protocols Designing, testing new applications Detecting network weirdness: broadcast storms, routing loops, etc.

22 Potential Uses of Tools (Cont d) Performance evaluation of protocols and applications How protocol/application is being used How well it works How to design it better

23 Potential Uses of Tools (Cont d) Workload characterization What traffic is generated Packet size distribution Packet arrival process Burstiness Important in the design of networks, applications, interconnection devices, congestion control algorithms, etc.

24 Potential Uses of Tools (Cont d) Workload modeling Construct synthetic workload models that concisely capture the salient characteristics of actual network traffic Use as representative, reproducible, flexible, controllable workload models for simulations, capacity planning studies, etc.

25 Measurement Environments Local Area Networks (LAN s) e.g., Ethernet LANs Wide Area Networks (WAN s) e.g., the Internet

26 Summary of Measurement Results The following represents synopsis of the Top 10 Observations from network measurement and monitoring research in the last 10 years Not an exhaustive list, but hits most of the highlights

27 What are the Challenges Large volume of measurement data Challenges in storing and processing data Privacy issues Difficulty in getting accurate of timestamps Offset, skew, resolution Sticky statistical properties Heavy tails Non stationary Insufficient/incomplete information for accurate inferences

28 Observation #1 The traffic model that we use is extremely important in the performance evaluation of routing, flow control, and congestion control strategies Have to consider application-dependent, protocol-dependent, and networkdependent characteristics The more realistic, the better (GIGO)

29 Observation #2 Characterizing aggregate network traffic is difficult Lots of (diverse) applications Just a snapshot: traffic mix, protocols, applications, network configuration, technology, and users change with time

30 Observation #3 Packet arrival process is not Poisson Packets travel in trains Packets travel in tandems Packets get clumped together (ack compression) Interarrival times are not exponential Interarrival times are not independent

31 Observation #4 Packet traffic is bursty Average utilization may be very low Peak utilization can be very high Depends on what interval you use!! Traffic may be self-similar: bursts exist across a wide range of time scales Defining burstiness (precisely) is difficult

32 Observation #5 Traffic is non-uniformly distributed amongst the hosts on the network Example: 10% of the hosts account for 90% of the traffic (or 20-80) Why? Clients versus servers, geographic reasons, popular ftp sites, web sites, etc.

33 Observation #6 Network traffic exhibits locality effects Pattern is far from random Temporal locality Spatial locality Persistence and concentration True at host level, at gateway level, at application level

34 Observation #7 Well over 80% of the byte and packet traffic on most networks is TCP/IP By far the most prevalent Often as high as 95-99% Most studies focus only on TCP/IP for this reason (as they should!)

35 Observation #8 Most conversations are short Example: 90% of bulk data transfers send less than 10 kilobytes of data Example: 50% of interactive connections last less than 90 seconds Distributions may be heavy tailed (i.e., extreme values may skew the mean and/or the distribution)

36 Observation #9 Traffic is bidirectional Data usually flows both ways Not JUST acks in the reverse direction Usually asymmetric bandwidth though Pretty much what you would expect from the TCP/IP traffic for most applications

37 Observation #10 Packet size distribution is bimodal Lots of small packets for interactive traffic and acknowledgements Lots of large packets for bulk data file transfer type applications Very few in between sizes

38 Why is Traffic Measurement Important? Billing the customer Measure usage on links to/from customers Applying billing model to generate a bill Traffic engineering and capacity planning Measure the traffic matrix (i.e., offered load) Tune routing protocol or add new capacity Denial-of-service attack detection Identify anomalies in the traffic Configure routers to block the offending traffic Analyze application-level issues Evaluate benefits of deploying a Web caching proxy Quantify fraction of traffic that is P2P file sharing

39 Applications of Measurements Traffic Engineering: Tune routing protocol parameters to control traffic flow through the network. Network Troubleshooting: Locate and diagnose network performance (or reachability) problems Anomaly Detection Feasibility Study of New Ideas: Measurement can help evaluate the performance of new applications and pinpoint enhancement possibilities

40 Collecting Traffic Data: SNMP Simple Network Management Protocol Standard Management Information Base (MIB) Protocol for querying the MIBs Advantage: ubiquitous Supported on all networking equipment Multiple products for polling and analyzing data Disadvantages: dumb Coarse granularity of the measurement data E.g., number of byte/packet per interface per 5 minutes Cannot express complex queries on the data Unreliable delivery of the data using UDP

41 Collecting Traffic Data: Packet Monitoring Packet monitoring Passively collecting IP packets on a link Recording IP, TCP/UDP, or application-layer traces Advantages: details Fine-grain timing information E.g., can analyze the burstiness of the traffic Fine-grain packet contents Addresses, port numbers, TCP flags, URLs, etc. Disadvantages: overhead Hard to keep up with high-speed links Often requires a separate monitoring device

42 Collecting Traffic Data: Flow Statistics Flow monitoring (e.g., Cisco Netflow) Statistics about groups of related packets (e.g., same IP/TCP headers and close in time) Recording header information, counts, and time Advantages: detail with less overhead Almost as good as packet monitoring, except no fine-grain timing information or packet contents Often implemented directly on the interface card Disadvantages: trade-off detail and overhead Less detail than packet monitoring Less ubiquitous than SNMP statistics

43 Using the Traffic Data in Network Operations SNMP byte/packet counts: everywhere Tracking link utilizations and detecting anomalies Generating bills for traffic on customer links Inference of the offered load (i.e., traffic matrix) Packet monitoring: selected locations Analyzing the small time-scale behavior of traffic Troubleshooting specific problems on demand Flow monitoring: selective, e.g,. network edge Tracking the application mix Direct computation of the traffic matrix Input to denial-of-service attack detection

44 Flow Measurement: Outline Definition Passively collecting statistics about groups of packets Group packets based on headers and spacing in time Essentially a way to aggregate packet measurement data Scope Medium-grain information about user behavior Passively monitoring the link or the interface/router Helpful in characterizing, detecting, diagnosing, and fixing Outline Definition of an IP flow (sequence of related packets) Flow measurement data and its applications Mechanics of collecting flow-level measurements Reducing the overheads of flow-level measurement

45 IP Flows flow 1 flow 2 flow 3 flow 4 Set of packets that belong together Source/destination IP addresses and port numbers Same protocol, ToS bits, Same input/output interfaces at a router (if known) Packets that are close together in time Maximum spacing between packets (e.g., 15 sec, 30 sec) Example: flows 2 and 4 are different flows due to time

46 Flow Abstraction A flow is not exactly the same as a session Sequence of related packets may be multiple flows (due to the close together in time requirement) Sequence of related packets may not follow the same links (due to changes in IP routing) A session is difficult to measure from inside the network Motivation for this abstraction As close to a session as possible from inside the network Flow switching paradigm from IP-over-ATM technology Router optimization for forwarding/access-control decisions (cache the result after the first packet in a flow) might as well throw in a few counters

47 Recording Traffic Statistics (e.g., Netflow) Packet header information (same for every packet) Source and destination IP addresses Source and destination TCP/UDP port numbers Other IP & TCP/UDP header fields (protocol, ToS bits, etc.) Aggregate traffic information (summary of the traffic) Start and finish time of the flow (time of first & last packet) Total number of bytes and number of packets in the flow TCP flags (e.g., logical OR over the sequence of packets) SYN ACK ACK FIN 4 packets 1436 bytes SYN, ACK, & FIN start finish

48 Recording Routing Info (e.g., Netflow) Input and output interfaces Input interface is where the packets entered the router Output interface is the next hop in the forwarding table Source and destination IP prefix (mask length) Longest prefix match on the src and dest IP addresses Source and destination autonomous system numbers Origin AS for src/dest prefix in the BGP routing table forwarding table Processor BGP table Line card Line card Line card Switching Fabric Line card Line card Line card

49 Measuring Traffic as it Flows By source dest input output source prefix source AS intermediate AS dest prefix dest AS Source and destination: IP header Source and dest prefix: forwarding table or BGP table Source and destination AS: BGP table

50 Packet vs. Flow Measurement Basic statistics (available from both techniques) Traffic mix by IP addresses, port numbers, and protocol Average packet size Traffic over time Both: traffic volumes on a medium-to-large time scale Packet: burstiness of the traffic on a small time scale Statistics per TCP connection Both: number of packets & bytes transferred over the link Packet: frequency of lost or out-of-order packets, and the number of application-level bytes delivered Per-packet info (available only from packet traces) TCP seq/ack #s, receiver window, per-packet flags, Probability distribution of packet sizes Application-level header and body (full packet contents)

51 Collecting Flow Measurements Route CPU that generates flow records may degrade forwarding performance CPU Router A Line card that generates flow records Router A more efficient to support measurement in each line card Packet monitor that generates flow records Router A Router B third party Monitor

52 Router Collecting Flow Measurement Advantage No need for separate measurement device(s) Monitor traffic over all links in/out of router (parallelism) Ease of providing routing information for each flow Disadvantage Requirement for support in the router product(s) Danger of competing with other 1 st -order router features Possible degradation of the throughput of the router Difficulty of online analysis/aggregation of data on router Practical application View from multiple vantage points (e.g., all edge links)

53 Packet Monitor Collecting Flow Records Advantages No performance impact on packet forwarding No dependence on support by router vendor Possibility of customizing the thinning of the data Disadvantages Overhead/cost of tapping a link & reconstructing packets Cost of buying, deploying, and managing extra equipment No access to routing info (input/output link, IP prefix, etc.) Practical application Selective monitoring of a small number of links Deployment in front of particular services or sites Packet monitor vendors support flow-level output

54 Mechanics: Flow Cache Maintain a cache of active flows Storage of byte/packet counts, timestamps, etc. Compute a key per incoming packet Concatenation of source, destination, port #s, etc. Index into the flow cache based on the key Creation or updating of an entry in the flow cache key #bytes, #packets, start, finish header key packet key #bytes, #packets, start, finish

55 Mechanics: Evicting Cache Entries Flow timeout Remove flows that have not received a packet recently Periodic sequencing through the cache to time out flows New packet triggers the creation of a new flow Cache replacement Remove flow(s) when the flow cache is full Evict existing flow(s) upon creating a new cache entry Apply eviction policy (LRU, random flow, etc.) Long-lived flows Remove flow(s) that persist for a long time (e.g., 30 min) otherwise flow statistics don t become available and the byte and packet counters might overflow

56 Sampling: Packet Sampling Packet sampling before flow creation (Sampled Netflow) 1-out-of-m sampling of individual packets (e.g., m=100) Create of flow records over the sampled packets Reducing overhead Avoid per-packet overhead on (m-1)/m packets Avoid creating records for a large number of small flows Increasing overhead (in some cases) May split some long transfers into multiple flow records due to larger time gaps between successive packets not sampled time timeout two flows

57 Flow measurement Advantages and Disadvantages Flow measurement Medium-grain view of traffic on one or more links Advantages Lower measurement volume than full packet traces Available on high-end line cards (Cisco Netflow) Control over overhead via aggregation and sampling Disadvantages Computation and memory requirements for the flow cache Loss of fine-grain timing and per-packet information Not uniformly supported by router vendors

58 Useful Links Academic conferences dedicated to Internet Measurements ACM Internet Measurement Conference (IMC) ACM SIGMETRICS Performance Analysis Passive and Active Measurement Workshop (PAM) IETF Working groups IPPM: IP Performance Metrics RMON: Remote Monitoring

59 Important Projects Internet Routing Registry (IRR) and Routing Assets Database (RADb) ARIN, RIPE, APNIC, LACNIC, AfrNIC CAIDA the Cooperative Association for Internet Data Analysis (aff. U. C. San Diego) IPMON NLANR Moat - Measurement and Network Analysis Group (aff. U. C. San Diego) NIMI National Internet Measurement Infrastructure SLAC Tutorial on Internet Monitoring & PingER IEPM Internet End to end Performance Monitoring

60 总结 如何阅读文献 为什么测量 测量数据