Cheleby: Subnet-level Internet Mapper

Transcription

1 Cheleby: Subnet-level Internet Mapper ISM 2010 IMS-2 Workshop on ctive Internet Measurements Talha Oz, Hakan Kardes, Mehmet Gunes University of Nevada, Reno 02/09/10 San Diego Supercomputer Center, UCSD, La Jolla, C

2 Goal Build an efficient system that produces a map of the Internet such that lias IP addresses that belong to the same router, Star (*) occurrences that stand for the same router, IPs that belong to the same subnet are identified. Subnet-level Internet mapping 2

3 Outline Goal Subnet-level Internet Mapping Issues nonymous Routers Resolution Structural Graph Indeing Subnet Inference Distance Preservation lias IP ddresses Resolution lly, nalytical & Probe based (PR) Cheleby Mapping System Outer Space 3D Visualization Subnet-level Internet mapping 3

4 nonymous Routers nonymous routers do not respond to traceroute probes and appear as in traceroute output Same router may appear as in multiple traces. y y y y: S L H y: S H S Current daily raw topology data sets Sinclude ~ 20 million path traces with ~ 20 million occurrences of s along with L ~ 500K public IP addresses L S 1 2 The raw topology data is far from representing the underlying H sampled network topology H H : H L S y : H S y Subnet-level Internet mapping : nonymous Routers 4

5 nonymous Router Resolution S U K C N f Traces d--l-s-e d -- -W --f e-s-l--d e-s-u--c--f f--c---d f--c--u-s-e e e S U L L H W d Sampled network C W f d Resulting network Subnet-level Internet mapping : nonymous Routers 5

6 Previous pproaches Basic heuristics IP: Combine anonymous nodes between same known nodes [Bilir 05] Limited resolution NM: Combine all anonymous neighbors of a known node [Jin 06] High false positives y y S S U U L L H C z W W fter fter resolution resolution y S U L C W Resulting network z S U K C N z L H W Subnet-level Internet mapping : nonymous Routers 6 y Sampled network

7 Previous pproaches More theoretic approaches Graph minimization [Yao 03] Combine s as long as they do not violate two accuracy conditions: (1) Trace preservation condition and (2) distance preservation condition High compleity O(n 5 ) n is number of s ISOMP based dimensionality reduction [Jin 06] Build an nndistance matri then use ISOMP to reduce it to a n5 matri Distance: (1) hop count or (2) link delay High compleity O(n3) n is number of nodes Semisupervised Spectral Clustering [Shavitt 08] Clustering algorithm based on semi-supervised spectral embedding of all the nodes followed by clustering of the anonymous nodes in the projected space. node will not be chosen to be an unknown root if it shares two or more neighbors with an unknown root. Subnet-level Internet mapping : nonymous Routers 7

8 Structural Graph Indeing (SGI) Structural Graph Indeing graph data mining technique Inde all pre-defined substructures in a graph data Use of SGI for anonymous router resolution pply SGI to collected path traces Merge anonymous routers using identified structures Trace Preservation Condition Don t merge anonymous routers within the same trace Subnet distance as tie-breaker Subnet-level Internet mapping : nonymous Routers 8

9 Common Structures due to Rs C y2 C y2 Parallel -substring y1 y3 y1 y3 D w C y D w E z D w 9 D w E z D w C y E z Star C y F v C y D w F v E z Complete Bipartite C y E z C y D w E z Clique Subnet-level Internet mapping : nonymous Routers

10 Graph Indeing based Resolution Indeing Phase parallel star bipartite clique Resolution Phase parallel clique bipartite star Subnet-level Internet mapping : nonymous Routers 10

11 Outline Goal Subnet-level Internet Mapping Issues nonymous Routers Resolution Structural Graph Indeing Subnet Inference Distance Preservation lias IP ddresses Resolution lly, nalytical & Probe based (PR) Cheleby Mapping System Outer Space 3D Visualization Subnet-level Internet mapping 11

12 Subnet Inference Subnet resolution Identify IP addresses that are connected over the same medium IP1 IP1 IP2 IP3 IP2 IP3 Improve the quality of resulting topology map B B B B C D C D C C D D (underlying topology) (observed topology) (inferred topology) Subnet-level Internet mapping : Subnet Inference 12

13 Subnet Inference pproach V.P /24 / /16 / / /31 / /24 / /29 / / / / / /28 / /24 / / Subnet-level Internet mapping : Subnet Inference 13

14 Subnet Inference pproach Inferring Subnets Cluster IP addresses into maimal subnets up to a given size (e.g. /22) Distance analysis on candidate subnets to break them down as necessary IP1 IP2 IP3 IP4 IP5 IP6 IP7 IP8 /22 /25 /29 /26 /30 /31 /27 /27 subnet can have up to 2 5 IP addresses. IP9 Completeness: Ignore candidate subnets that have less than one quarter of their IP addresses present after additional probing Subnet-level Internet mapping : Subnet Inference 14

15 Inference with Distance Matri Obtain distance of each IP from 8 vantage points (VP) Only one IP at a subnet might be at a distance hop-1 per VP IPs after per-destination and per-packet load-balancers Get minimum hop (seen at any ICMP Paris Traceroute) of an IP per VP IP hops after a LB has lower trust Two rounds of computations Compensate for diamond asymmetry if per-destination LB VP: IP IP IP Subnet-level Internet mapping : Subnet Inference 15

16 Outline Goal Subnet-level Internet Mapping Issues nonymous Routers Resolution Structural Graph Indeing Subnet Inference Distance Preservation lias IP ddresses Resolution lly, nalytical & Probe based (PR) Cheleby Mapping System Outer Space 3D Visualization Subnet-level Internet mapping 16

17 IP lias Resolution e s.1 S s.2 l.1 L l.3 s.3 l.2 u.1 U u.3 u.2 f n.1 c.2 c.1 w.1 C c.3 k.1 c.4 K k.2 k.3 a.1 a.2 a.3 h.2 H h.3 h.1 h.4 d n.2 N n.3 w.2 W w.3 Traces d - h.4 - l.3 - s.2 - e d - h.4 - a.3 - w.3 - n.3 - f e - s.1 - l.1 - h.1 - d e - s.1 - u.1 - k.1 - c.1 - n.1 - f f - n.2 - c.2 - k.2 - h.2 - d f - n.2 - c.2 - k.2 - u.2 - s.3 - e Subnet-level Internet mapping : IP liases 17

18 IP lias Resolution Sampled network e S U K C N L H W f d s.3 e s.1 s.2 l.3 l.1 Sample map without alias resolution Subnet-level Internet mapping : IP liases u.1 k.1 c.1 n.1 u.2 k.2 c.2 n.2 h.1 d h.4 h.2 a.3 w.3 n.3 Traces d - h.4 - l.3 - s.2 - e d - h.4 - a.3 - w.3 - n.3 - f e - s.1 - l.1 - h.1 - d e - s.1 - u.1 - k.1 - c.1 - n.1 - f f - n.2 - c.2 - k.2 - h.2 - d f - n.2 - c.2 - k.2 - u.2 - s.3 - e 18 f

19 Previous pproaches Source IP ddress Based Method [Pansiot 98] Relies on a particular implementation of ICMP error generation. IP Identification Based Method (ally) [Spring 03] Relies on a particular implementation of IP identifier field, B B Many routers ignore direct probes. Dest = DNS Based Method [Spring 04] Relies on similarities in the host name structures Dest = sl-bb21-lon-14-0.sprintlink.net sl-bb21-lon-8-0.sprintlink.net, ID=100 B Dest = B Works when a systematic naming is used. Dest = B B, ID=103 ID=99 Record Route Based Method [Sherwood 06] Depends on router support to IP route record processing Subnet-level Internet mapping : IP liases 19

20 nalytical lias Resolution UTD no response no response liases MIT Subnet-level Internet mapping : IP liases 20

21 nalytical & Probe-based lias Resolution There is possibility of incorrect subnet assumption, a IP 1 IP 2 b IP 3 IP 4 c d IP 7 Two /30 subnets assumed as a /29, incorrect alignment of path traces. IP 8 e a sample network IP 9 f IP 4 and IP 8 are thought of as aliases. To prevent false positives, some conditions are defined Trace preservation, Distance preservation (probing component of PR), Completeness, Common neighbor. Subnet-level Internet mapping : IP liases 21

22 Outline Goal Subnet-level Internet Mapping Issues nonymous Routers Resolution Structural Graph Indeing Subnet Inference Distance Preservation lias IP ddresses Resolution lly, nalytical & Probe based (PR) Cheleby Mapping System Outer Space 3D Visualization Subnet-level Internet mapping 22

23 ChelebyMapping System DNS server Route Views Cheleby Server PlanetLab Node PlanetLab Node PlanetLab Node PlanetLab Node Region 1 Region 2 Region 3 Region 8 Subnet-level Internet mapping : Cheleby Mapping System 23

24 Outer Space 3D Visualization work by David Shelley Multiple zoom levels utonomous System-level Router-level Subnet-level idea Subnet-level Internet mapping : Cheleby Mapping System 24

25 Questions Subnet-level Internet mapping 25