RAWDAD : A Wireless Data Archive for Researchers

Transcription

1 RAWDAD : A Wireless Data Archive for Researchers Jihwang Yeo November 2007

2 Outline The Challenges of Measuring Wireless Network Dartmouth campus measurement Measurement Challenges Modeling CRAWDAD: A Wireless Data Archive for Researchers

3 The Challenges of Measuring Wireless Network Slides courtesy of David Kotz

4 Why measure? For better management Large WLANs need scalable management To manage you must monitor To monitor you must measure Where is there trouble... or trouble-makers? Where are your users? How and when do they move? What do they use the network for? How is it abused? Where should your network grow?

5 Why measure? For research and innovation To improve our understanding of user and network behavior. This understanding leads to better models. Better models are critical to innovation: network protocols distributed algorithms and applications deployment strategy

6 Wireless is not Wired Many inherent differences Wired medium: clear points of connection Wireless medium: physically dispersed Not everything is visible for measurement Mobility inspires new usage patterns Novel devices inspire new usage patterns protocol inspires new attacks

7

8 Dartmouth s wireless network Over 1000 APs Aruba AP 52 or AP 70

9 Dartmouth Campus 20,000 square meter 188 buildings (as of 2004) 50% Residential 20% Academic 14% Administrative 4% Library 12% Social 5,500 students and 1,200 professors Complete Wi-Fi coverage

10 1: Syslog data collection AP reports interesting events Authenticate Associate Deauthenticate Disassociate Record date, time, MAC, AP name Sent by access point to syslog recorder

11 2: SNMP data collection Every 5 minutes, poll each AP Record: MAC of associated clients Counter: inbound bytes Counter: outbound bytes Outbound Inbound

12 3: tcpdump data collection Hub AP Tiny Linux box promiscuously sniffed all packet headers

13 4: VoIP collection Cisco VoIP system on campus since 2003 CDR (Call Detail Records) from Cisco Call Manager server Time and duration of calls IP address of caller and callee Reasons for call termination

14 [syslog] Active cards per week 1706 cards 7134 cards

15 GB [snmp] Average hourly traffic, by hour Fall 2003 Winter 2004

16 [cdr] VoIP devices in use Fall 2003 Winter 2004

17 [cdr, snmp] VoIP call duration Fall 2003 Winter 2004 All VoIP calls are significantly shorter than non-voip calls Median wired call duration: 42 seconds Median wireless call duration: 31 seconds

18 Sessions time Associated Reassociated Deauthenticated Session duration 30 mins

19 Session diameter by device Fall 2003 Winter 2004 VoIP and PDA devices tend to move farther during a single wireless session A B diameter = max inter-ap distance E C D

20 Measurement challenges

21 Measuring real networks: Practical challenges Lack of portable tools for collection, analysis Lack of information about network hardware Lack of common data formats Reluctance of network administrators Avoiding, identifying, and handling data holes

22 Capturing traffic: sniffing the wire One sniffer captures traffic from many APs But... Does not capture intra-ap traffic Does not capture control frames Does not capture collisions, drops to Internet Sniffer Ethernet Switch AP AP AP

23 Capturing traffic: switched wireless Can capture nearly all MAC-layer traffic But... Needs explicit support from switch to Internet Today s switches are underpowered Wireless Switch GRE tunnel Sniffer AP AP AP

24 to Internet sniffing the air Ethernet Switch client Sniffer Sniffer client Sniffer AP client client

25 sniffing the air Can capture full MAC-layer traffic But... Need multiple radios, multiple locations Still might not capture all traffic Frames may be encrypted

26 Understanding traffic Encryption limits what we can see WEP and WPA encrypt traffic in the air VPNs and other tunnels encrypt the wire Firewalls and NAT may block traffic Identifying P2P traffic is hard Identifying VoIP traffic is hard

27 Correlating sources Hard to match data across sources syslog: device movements SNMP: traffic counts (poor granularity) CDR: call detail records tcpdump or other packet traces RADIUS: authentication records

28 Network structure Must know network structure and history location of all APs subnet structure switched wireless AP structure channel assignments, power levels?

29 Devices Tracking device movements syslog, SNMP: lack of common formats no clean way to identify device departure no clean way to tie cards to users no standards for localization Device type: laptop, palmtop, phone, psp...?

30 Human subjects Laws governing research and privacy For research in US universities, need approval of Institutional Review Board In any case, we must protect privacy: secure the collection infrastructure encrypt the data storage anonymize data where possible

31 Real user behavior Ultimately, it is hard to map observed network activity to real user behavior.

32 Modeling wireless networks

33 Building models Models should be derived from real data What is modeled, and what is assumed? Carefully define assumptions Clearly identify usable range of the model Is the model portable? translates to other places, other times, other sizes

34 Mobility models The MANET world is full of fake models! We need new models from real users Mobility model: the path of users in geographic space Association model: sequence of APs associated by a device

35 Summary Large WLANs require scalable management Management requires monitoring Monitoring requires measurement Measurement is hard! We need better tools and data formats Researchers and providers must cooperate We need shared archives and testbeds Motivation of CRAWDAD!

36 RAWDAD : A Wireless Data Archive for Researchers

37 CRAWDAD Any of various freshwater crustaceans of the genera Cambarus and Astacus, resembling a lobster but considerably smaller.

38 What is CRAWDAD? Community Resource for Archiving Wireless Data At Dartmouth Co-led by David Kotz and Tristan Henderson Hosted by the Center for Mobile Computing at Funded by US National Science Foundation Archive Wireless-network traces Tools for trace collection HOWTO documents in wiki Support for the research community Event calendar Bibliography Specialist groups (MANET, Education) Annual Workshop (free!)

39 Why CRAWDAD? Wireless network researchers are seriously starved for real wireless data! Data is hard to collect leverage effort to benefit all Obtain better model for simulation Understand real network usage and identify the real problem Evaluate solutions better than simulation Make our field more scientific Reusing/sharing data is good practice More appreciation (citations!) if you share data Learn from others experience Learn in more ways than from a paper

40 Research Example: Model Inter-Contact Times Work by Karagiannis et al., MobiCom 07 Motivation: Inter-contact times between mobile devices Data forwarding in opportunistic communication Question: ICT distribution follows power law over all time range? If yes, expected packet delay is infinite for any packet for warding scheme Traditional models - distribution decays exponentially CCDF (log) * Slide courtesy of Thomas Karagiannis ICT(log)

41 Research Example: Model Inter-Contact Times Methodology: examine ICT distribution from 6 real mobility traces 4 CRAWDAD data sets used! * Slide courtesy of Thomas Karagiannis

42 Research Example: Model Inter-Contact Times Result: Empirically found a dichotomy in ICT distribution Power-law up to a point (order half a day), exponential decay beyond * Slide courtesy of Thomas Karagiannis

43 Research Example: Identify Privacy Problem Work by Pang et al., MobiCom 07 Motivation: Privacy threat in wireless network Adversary can easily track users identity. Question: Is the well-known solution (Pseudonyms - change addresses over time) sufficient to prevent tracking? MAC address now: 00:0E:35:CE:1F:59 tcpdump? MAC address later: 00:AA:BB:CC:DD:EE tcpdump time * Slide courtesy of Jeffrey Pang

44 Research Example: Identify Privacy Problem Methodology: From real trace (uw/sigcomm2004) find implicit identifiers (e.g., broadcast pkt size) Develop a tracking scheme and evaluate on three real traces (including uw/sigcomm2004) Broadcast pkt sizes: 239, 245, 257 MAC address now: 00:0E:35:CE:1F:59 tcpdump Broadcast pkt sizes: 239, 245, 257? MAC address later: 00:AA:BB:CC:DD:EE tcpdump time * Slide courtesy of Jeffrey Pang

45 Research Example: Identify Privacy Problem Result: Majority of users can be identified if active long enough. Good example of how CRAWDAD helps researchers identify problems and evaluate solutions! * Slide courtesy of Jeffrey Pang

46 CRAWDAD Data sets Wireless (internet) traffic data sets dartmouth/campus, stanford/gates, uw/sigcomm2004, ucsd/sigcomm2001, Mobility/DTN (Delay Tolerant Net) data sets cambridge/haggle, mit/reality, nus/contact, umass/diesel, Location/Localization data sets intel/placelab, dartmouth/wardriving, Vehicular Network data sets gatech/vehicular, umass/diesel, ucdavis/unitrans, PHY-layer data sets rutgers/capture (from ORBIT testbed),

47 CRAWDAD Tools Collection tools tools/collect/snmp/snmputil.exe, Sanitisation tools tools/sanitize/generic/anontool, Processing tools tools/process/pcap/wifi_parser, Analysis tools tools/process/802.11/wit,

48 Top 10 Datasets/Tools Dataset/tools dartmouth/campus cambridge/haggle mit/reality stanford/gates uw/sigcomm2004 tools/process/snmp/extract.pl tools/process/pcap/wifi_parser nus/contact ucsd/sigcomm2001 umass/diesel Download users

49 Building CRAWDAD Community Online Wiki, Special Interest Groups (MANET, Education) Custom mailing list for each data set Monthly download stats for contributors Offline - Annual workshop (free!) in MobiCom

50 CRAWDAD is growing! (as of November 2007) 800 users from 450 institutions around the world 35 data sets One data set (cnu/cdma) contributed from Korea! 12 tools 100 papers Staff: full-time researcher plus 2 undergrads contact: crawdad@cs.dartmouth.edu

51 World Map of CRAWDAD Users

52 Demo: How to Find the Data/Tools Browsing Browse all datasets Browse all tools Browse by keywords Searching

53 Any Site for Internet Data? Check out DatCat.org! Indexes Internet measurement data Developed and run by CAIDA Users can search, annotate, and cite Not store data but point to download location CRAWDAD-DatCat gateway Converting CRAWDAD metadata to DatCat index Currently 25 CRAWDAD datasets indexed on DatCat

54 Conclusion To help the community, we provide: Wireless network traces Tools for easy trace collection and sanitisation How-to documentaton, and many more! Looking for data? Register now! Have wireless data? Contact: