State of the Art Report on Techniques for Visualizing Network Traffic

Transcription

1 State of the Art Report on Techniques for Visualizing Network Traffic Experimental Investigation of Visualization in Network Monitoring Software By Fabian Bendix Thomas Rongitsch Supervised By DI Wolfgang Meyer Technical University of Vienna

2 Index Index Visualization Techniques and Goals Visualizing Networks Problems Visualizing Networks Motivation Available Tools AdRem Netcrunch Distinct Network Monitor Etherpeek What s up Gold FrameVis Concept and Design Colour and Size TreeView Top-Subnet and Top-Host View Advantages and Disadvantages Visualizing Networks possible Solutions Summary Appendix Tables of figures Links References

3 The main goal of this paper is to give an overview over the available techniques and tools of network monitoring with respect to information visualization. In the internship about FrameVis the authors have discovered that there are a lot of useful tools for network monitoring, but only a little number of these tools represent the actual status of a computer network in a graphical way. In the first section we will discuss the main techniques and goals of visualization in the field of networking. The following section introduces the tools we have found on the web. In most cases the implementations lack of details or actual methods in information visualization. But there are useful concepts for graphical representations. In the next section we will describe the project we did for an internship at the Institute of Computer Graphics and Algorithm at the Technical University of Vienna [L5] FrameVis. Finally all the tools represented before are compared and some of the advantages and disadvantages are described in more detail. 1. Visualization Techniques and Goals The field of information visualization is a growing scientific topic. Visualization itself consists of two fields: Scientific Visualization o Volume Visualization o Flow Visualization Information Visualization Visualizing network traffic belongs to Information Visualization. The main goal of visualizing data is to gain cognition, deeper understanding and a properly new insight into data or processes. The most important aspect of visualization is to deliver an overview of the data to user. Afterwards the user should have the possibility to zoom and filter the data and retrieve details on demand. Information visualization knows several different techniques. Some of the most relevant ones are: Geometric Techniques o Scatter plots o Parallel Coordinates Icon-Based Techniques o Stick-Figures Graph-Based Techniques o Polyline o Curved Line Hierarchical Techniques o Cone Trees o Cam Trees Depending on the goal of the visualization application in other words: depending on what you want to visualize each technique has got its advantages and disadvantages. Due to the tools we discuss in this paper and due to FrameVis we focus on Icon-Based Techniques and on Hierarchical Techniques. 2. Visualizing Networks Problems Before visualizing network data we have to consider several relevant aspects. Each visualization application is a kind of filllimited. In other words we cannot draw everything on the screen we want, because there is not that much space available. Due to this, well-implemented tools filter data right from the start. The first attempt should be to deliver just an overview over the current status of the complete network. The designer of network management visualization tools has also to consider whether he wants to illustrate the network in two dimensional or a three dimensional way. In the case of visualizing data just in two dimensions the designer must be aware that on the one hand possibly one presentation attribute is lost and on the other hand less space for the visualization is available. Three dimensional design depict the problem of overlapping objects and the possible loss of orientation of the user if the complete scene is rotatable and transformable [2]. Another very important aspect is the kind of data that should be visualized. The data could be generated on the fly by the application or the data could be delivered by another application or machine (e.g. a router). Other important factors are the temporal behaviour of the data and of course the amount of data [2]. If we assume that the data is delivered by a router, we are interested in very different information, because we visualize the throughput of a whole network, whereas the sniffing tools listen on the traffic within a network. Furthermore the data provided by 3

4 the router is aggregated, that means we don t have to deal with all the bits send through the gateway, but with the relevant information: the bytes send and received from every host inside the network to some destination in the internet. Due to that the visualization will not show the absolute traffic among the hosts, but the traffic to the internet. Sniffing tools like Etherpeek get IP-packets and analyse its content, which will result in a huge amount of detailed information that should be displayed. FrameVis a representative of the router-data tools only gets the information of how many bytes are transmitted from where to where. Thus, the data is already enhanced and then can be displayed. Surely, the amount of data delivered from a router measured over time is either small, because each flow of each particular host is recorded. The most important point might be: what should be drawn in which way. There are different aspects in monitoring networks. Sometimes e.g. if critical servers are monitored the system or network administrator might be more interested in the availability of the computers than in the rate of traffic. But an Internet Service Provider might be interested in how mach traffic the clients on his own network produce. Of course there are also cases in which both, the availability in the traffic rate are interesting. 3. Visualizing Networks Motivation Simply the main goal of visualization is to make the life easier especially for system administrators. The maintenance of a network isn t that easy, so there is a more and more growing need of obtaining an insight in the network. However, the interest of people in visualizing the traffic of a network can be driven by two basic motivations: availability traffic detection Large companies often run computer systems such as web servers, application servers, mail servers and so on that should be available 24 hours a day and 7 days a week. Each minute these servers are offline produces costs and probably loss of image. Driven by these factors a lot of tools have been developed to monitor computer networks. Most of these applications do not support visualization of network data. Due to this cognition and perception of the status of the network might not always be easy for network administrators. To defend the network against attacks Denial of Service is a favoured method the administrator is interested in the distribution of the produced traffic of single hosts in relation to the others to detect anomalies. Another point of motivation represents the large field of intrusion detection. This topic is far to complex for discussing it within this paper. The compared tools which are presented in section 4 - shall cover the whole range of network visualization tools and researches. They range from network sniffing tools [L1,L2,L3L4] which visualize the up-time of machines to router-data fed tools FlowScan [3] or FrameVis that overviews the whole network traffic and gives the network administrator the insight into the traffic distribution to identify activities that require further investigations, as discussed in [4]. 4. Available Tools In this section the authors try to give an overview over four commonly used applications in the field of network visualization. The investigated tools differ on the one hand in their dedication, detail of visualization and on the other hand in their type of network management. Most tools provide a lot of network specific functionality, but lack of functionality in the field of visualization. 4.1 AdRem Netcrunch NetCrunsh 2.2 by AdRem Software [L1] aims at the first motivation mentioned in Section 3: the reliability of a network is the main interest of a company. Due to the fact that NetCrunsh is a standalone application the data acquisition is accomplished by scanning the local or remote network. Using ICMP and SNMP the program can rescan user-specified host (servers, routers, workstations) to provide a continuous monitoring of these critical hosts. From the point of view of visualization NetCrunsh 2.2 offers the user the total liberty to arrange the scanned hosts. So, the application is not fixed to one visualization: primarily the topology of the network either 4

5 physically or logically is defined by the user and therefore displayed. More or less an Icon-based technique (see Figure 1) is used, combined with a hierarchically approach. Hosts or whole subnets are displayed by user-defined glyphs (e.g. computers) on a user-defined map with symbolizes the physical or logical context (e.g. a map of Europe). If the user selects an icon and the icon represents a network, then the user is linked to the detailed visualization of the selected network if the selected icon is a host, then the monitored status of that particular host is displayed (Detail-on demand). As a conclusion, we can say that NetCrunsh works right according to the Visual Information Seeking Mantra [5]: Overview first, zoom and filter, then details on demand. The main drawbacks result from the fact, that the icon-based techniques are 2Dvisualizations and in combination with the hierarchical linking of networks and their subnets in 2D, the user completely looses the context if a subnet is selected, the whole display is used to show that particular subnet. offered for a easier overview of the whole traffic analysed by different characteristics (e.g.: port, protocol, address, etc.) received by the network interface card. Primarily this tool s design intention is network information and not network visualization. Nevertheless the job of network analysis is well done: the interesting information are provided (e.g. port, source and destination address, etc.) and as mentioned the traffic is analysed and on the one hand listed and on the other hand visualized by diagrams. Figure 2: Pie chart with additional information in text form 4.3 Etherpeek Wildpackets Etherpeek (EP) is a full-featured network-sniffing tool. It collects and analyses all packets received and sent by the local NIC (network interface card). Figure 3 shows the application window with a big pie chart showing the protocols the local machine is currently using and three tachometers on the lower left side. Figure 1: View with Texture and Icons 4.2 Distinct Network Monitor The intension of the Network Monitor by Distinct [L2] is the analysis of IP packets, that are captured from the local network interface card. It tries to translate the encoded information of the IP packets into a natural language due to that fact the use is intended for experienced network users or administrators. In terms of visualization the tool offers only a graphical representation of the filtered information, not a real visualization. The data is displayed in tables and as a sort of add-on bar charts or pie charts (see Figure 2) are Figure 3: Pie chart showing packet size distribution of one computer 5

6 From the point of visualization EP does not provide new or very sophisticated techniques to display information. The application allows only switching between the pie chart as seen in Figure 3 and a bar chart. In other words: EP implements visualization techniques similar to Microsoft Excel. The three tachometers show from left to right the rate of utilization, the packets received per second and the errors occurred per second. However, EP provides enough functionality in the field of computer networking. The application collects information about nodes, protocols and complete networks this has been disabled for demo use and is able to filter data in various ways. EP even provides the generation of statistics and comes with a history function (Figure 4). assume, WUG shows different icons (see Figure 5). Figure 4: History Bar Chart Conclusion: EP comes with a lot of nice features for monitoring protocols and packets in real time. The visualization techniques used in EP are rather simple. The application supports as hardly another application the system administrator in detecting errors in network connections and services (protocols). The visualization techniques are limited to bar charts, pie charts and tachometers. These visualizations only document packet sizes, traffic history and the current rate of packets, errors and utilization of the NIC. EP does not provide any functionality for visualizing the structure of the network or the current state of other computers in the network. Figure 5: Default Icons in WUG WUG is designed for monitoring servers and other important computers. The tool provides several methods for notifying the system administrator if a computer has crashed, is currently not available or just a single service is not responding. Figure 6 shows a map of computers in a network. The user can immediately identify that the computers on the tight lower side are down (exactly: the computers lost more than eight packets in a row). 4.4 What s up Gold What s up Gold (WUG) is developed and published by Ipswitch [L4]. The visualization is done by icon-based techniques using arrows to show dependencies between network nodes. For each state a computer or server can Figure 6: Map-View in WUG 6

7 In general WUG is an adequate tool for monitoring a server farm or a cluster. It provides additional functionality in discovering devices over SNMP, ICMP or from the Microsoft Windows Network Neighbourhood. Logging and report generation deliver satisfactory information to the system administrator. Via SMS (Short- Message-Service) notification WUG sends alerts directly to a pager or cell-phone. The main problem as mentioned above in the section about Netcrunch represents the space limitation in arranging icons, e.g. if huge networks should be monitored. WUG handles this problem with acoustical alerts and sophisticated notification mechanisms. The layout, the icons and the structure of the network depends on the work of the user, who has to generate complete maps. WUG does automatic layout if complete networks are scanned, but these are neither very concise and nor coherent. 5.2 Colour and Size The main idea was to display the traffic of a subnet and a host by scaling the appropriate cube, which represents the subnet/host. The big advantage of that method is that the user easily perceives the relevant subnets/hosts because of their size. So, in average networks are plenty of subnets with again plenty of hosts. Therefore we are hardly space limited and thought of an additional differentiation: the colour. The maximum size of the cubes is fixed to common size by an user defined value. Each cube, which has traffic that would produce a bigger size, is first set to the fixed maximum size and additionally the cubes are coloured according to their traffic (see Figure 8). 5. FrameVis 5.1 Concept and Design The goal of FrameVis is to deliver an overview of subnets and hosts in a complex computer network in a three dimensional way. On the one hand the most traffic consuming subnets and hosts should be found immediately on the other hand the complete computer network should be illustrated. In other words the main goal of this project is to find an assignment of the Internet bandwidth to computer subnets and hosts. FrameVis has been designed for visualizing huge networks (e.g.: network with several hundreds of subnets). Figure 7 shows the FrameVis main window. Figure 8: FrameVis colouring scheme 5.3 Tree View The tree-view provides a complete view over all subnets of the monitored network. At the top level the routers from and to the Internet are symbolized as a single node - the root node. All subnets are displayed in the shape of a circle below. The size and the colour of each subnet depend on the traffic it has produced in the last "data-validity" period. Below the activated subnet, which is labelled by an IP- Address and/or a name, the hosts are displayed (see Figure 9). The front most host represents the host that produces the sum of all received and sent packets the most traffic within this subnet. Figure 7: FrameVis Application in action 7

8 5.4 Top-Subnet and Top-Host View Figure 9: Subnet (terminator) with its hosts As mentioned in section 2 of this paper it is often a problem to draw everything onto the screen. In most cases only some nodes might be relevant to the system administrator. Occlusion depicts a serious problem. Objects that are behind other objects do not influence the visualization and the cognition of the user. Therefore FrameVis implements a kind of distortion technique which actually is unnamed until now. The main idea was to gain more space between the nodes in the front and to shrink the objects in the rear. Figure 10 illustrates this concept. Figure 10: distorting ring This mechanism does not avoid occlusions completely, but supports the user in identifying the most relevant objects. From a non very scientific point of view we can say: with this additional feature FrameVis looks even better. Top subnet view and top host view provide chart diagrams about the most traffic producing subnets and hosts in the monitored computer network and their temporal behaviour. The front row symbolizes the actual traffic of the subnets/hosts. At each new timeinterval the traffic of each element starts with zero and no recalculation (reordering) is done. If new router generated data are read, the traffic is added to the current traffic that has been produced until now in this time period. In this way the user perceives immediately what had happened for e.g. the last 24 hours. The shading on a box symbolizes the border between incoming and outgoing traffic. The subnets/hosts are ordered by their traffic from the left side to the right side (default view). On the left most position the selected subnet/host is displayed. A very nice feature provides the Watchdog- List. This feature allows monitoring any subnet or host similar to the top-ten subnets/host. 6. Advantages and Disadvantages In this section the authors try to compare the tools presented in the previous section. Table 1 delivers an overview of the analysed tools. This comparison is divided into three sections. The first part compares the analysed tools in the field of visualization. It is described how the tools gain data, how these data are visualized and the available and missing interaction possibilities. The next part of this table discusses the differences in the network specific functionality of the tools. FrameVis seems to be the best tool in the field of visualization, but in the section of networking aspects all the other tools implement quite more functionality. FrameVis was not designed for comparing to commercial applications in the field of network management. It was rather a investigation about possibilities in visualizing network data. The last section of this table just depicts license information and price. 8

9 Netcrunch Network Monitor Etherpeek Visualization Aspects What s up Gold FrameVis Space 2D 2D 2D 2D 3D Data acquisition Network Scanning Sniffing Sniffing Network Scanning Router Data Primary Technique Icon-Based Technique Bar Charts, Pie Charts Bar Charts, Pie Charts Icon-Based Technique Hierarchical Technique Interaction Selection, Detail-on-demand, Editable Maps None None Selection, Detail-on-demand, Editable Maps Selection, Linking + Brushing, Desirable Interaction Focus + Context Any Any Focus + Context Filtering Networking Aspects Data Source Packet Flow Packet Analysis Packet Analysis Packet Flow Packet Size Protocols TCP/IP None TCP/IP, UDP TCP/IP None Services Most Internet None Most Internet Most Internet None Protocols Protocols Protocols Update Time User-Defined Immediately Immediately User-Defined Router-Dependent Design Availability Availability Availability Availability Traffic Detection Motivation Monitoring Type Service Crash Top Talkers Error Rate Service Crash Top Talkers General License Commercial Commercial Commercial Commercial Freeware Price $ 795 $ 895 On Demand $ 795 Free (1 workstation) (standard version) (standard version) Table 1: Comparison of the presented tools 7. Visualizing Networks possible Solutions As we can see now the bulk of network management tools has to cover a wide range of functionality: packet analysis, server crash protection, traffic detection, etc. But, the aim of this report is to find out how specially how common visualization is used in the field of network management. The main question is: What shall visualization do for me?. From this point of view there are two main approaches: Firstly, visualization is only an utility that should in some cases help the user to easily perceive the relevant information. On the other hand, there are applications that map the whole network with only the relevant information to an appropriate visual representation. In section 4 and 5 the authors give examples with no warranty of completeness for each of these two approaches. Some of them do not want to visualize a complete network and therefore, the used visualization techniques are not that sophisticated. But what we can see clearly is, which problems can arise from using the wrong or improper visualization techniques. To know which visualization technique (see section 1) is the most suitable, we overview the encountered problems. As we can see in Table 1 it is favoured to use a 2D-visualization, because it s easy to implement and only some aspects of the network should be displayed. However, NetCrunsh, What s up Gold and FrameVis try to visualize a complete network, these applications use a sort of icon-based encoding of the hosts and try to represent the relation between hosts, but the serious difference is that NetCrunsh and What s Up Gold provide a 2D-visualization (or a Pseudo- 3D visualization), whereas FrameVis utilize all 3D space. The problem of the 2D-display is obvious: in 2D we are more likely to run out of space than in 3D. Also in terms of focus and context, the 3D-visualization is preferable, because you can better utilize the available space. To make use of the power of glyphs is a very good solution to accomplish the huge amount of information to visualize. In combination with a 3D hierarchical method an application provides information about the data (encoded 9

10 in the glyphs), information about the structure (encoded in the layout) and effectively uses the available space. Beneath the additional dimension in 3D space FrameVis uses size and colouring to visualize traffic. Most analysed applications only use colour to show that something has happened or something goes wrong. However, the result produced by What s up Gold and Netcrunch are in most cases acceptable. The user is able to perceive immediately computers that are not reachable anymore. What s up gold backs critical cases with an additional acoustical warning mechanism and a notification-system via SMS. Another important point to consider depicts the visualization of the progress of time. Nearly all tools discussed in this paper implement the visualization of time dependent data. This information might be of interest for an network administrator when he analyses the problems, failures and malfunctions. FrameVis has been designed to view all important information in one view. The other tools use different views for visualizing time dependent data and the current status of the network. An advantage of What s up Gold, Netcrunch, Etherpeek and NetworkMonitor represents the filtering of data. In most cases the user can filter for specific protocols or hosts. This might support the user in finding problems fast and omit nonessential information. The last point which has not been discussed in detail until now depicts the use of distortion. FrameVis implements a kind of distortion technique. The distance between the nodes in the rear of the Cone-Tree is narrower than the distance in the front. With this technique the user can achieves overview about the nodes in the front and the big red ones without loosing essential information. All other tools mentioned in this paper do not implement any of the currently available distortion technique. Maybe in future designers of network management tools have to consider the advantages that distortion techniques like Fish Eye View, Perspective Walls and so on. In general we can assume that information visualization in the field of network management needs quite more investigation and scientific work. The tools available right now are well-implemented in their functionality of networking, but lack of details and up to date techniques in visualization. 8. Summary The authors have gained the impression that the current visualization mechanisms in network management applications just support the presentation of information in form of text, tables and reports and is not the primary data presentation. In most cases visualization in the field of network management places specific problems: Network Topology Data acquisition Desired Visualization Desired Interaction Desired level of detail Due to this most companies, which have a need for visualizing networks, must develop an appropriate application on their own. Maybe FrameVis has been one step into the right direction. The main question we can pose is: Is it really necessary that a network administrator knows exactly how much traffic has been consumed by one network node or if it is more important for him to immediately perceive where problems arise? 10

11 9. Appendix 9.1 Tables of figures Figure 1: View with Texture and Icons Figure 2: Pie chart with additional information in text form Figure 3: Pie chart showing packet size distribution of one computer Figure 4: History Bar Chart Figure 5: Default Icons in WUG Figure 6: Map-View in WUG Figure 7: FrameVis Application in action Figure 8: FrameVis colouring scheme Figure 9: Subnet (terminator) with its hosts Figure 10: distorting ring 9.2 Links [L1] Adrem Netcrunch 2.2: [L2] Distinct Network Monitor: [L3] Wildpackets Etherpeek: [L4] Ipswitch What s up gold: [L5] Institute of Computer Graphics and Algorithm: References [1] Information Visualization Prinzipien und Techniken, W. Meyer 1997 [2] Metaphor-Aware 3D Navigation, C. Russo Dos Santos, P. Gros, P. Abel, D. Loisel, N Trichaud, J.P. Paris; Proceedings Information Visualization 2000 [3] FlowScan: A Network Traffic Flow Reporting and Visualization Tool, Dave Plonka; LISA2000 [4] Visual Behavior Characterization for Intrusion and Misuse Detection, Robert F. Erbacher, Deborah Frincke 2001 [5] Designing the User Interface, B. Shneiderman