Network delay estimation to remote locations based on passive RTT measurements A digest of recent related works at Salzburg Research

Transcription

1 Network delay estimation to remote locations based on passive RTT measurements A digest of recent related works at Salzburg Research Felix Strohmeier Salzburg Research Forschungsgesellschaft m.b.h. Jakob-Haringer-Straße 5/ Salzburg, Austria T F felix.strohmeier@salzburgresearch.at

2 Outline Motivation Packet-based RTT measurements AS-Level Delay Evaluation Flow-based RTT measurements Future and related work 2

3 Motivation RTT measurement RTT is a dominant QoS parameter High impact on customers user experience Connection establishment time (initial response) (Indirect) proportional to TCP Throughput Multiple methods available Active/Passive Evaluation and combination of different methods Passive monitoring enables large-scale measurement campaigns App-specific anonymisation PRISM 3

4 Passive RTT measurement approach Measurement point location End point Access network Core network 4

5 Packet-based RTT estimations 5 packet-based methods for TCP SYN/ACK FIN/ACK* Timestamp method Slow-start method Self-clocking method * A. Moosbrugger and P. Dorfinger: Passive RTT Measurement during Connection Close Proceedings of the 18th International Conference on Software Telecommunications an Computer Networks (SOFTCOM 2010) 5

6 Correlation of methods 10day capture on 3,5Mbit link High correlation between methods E.g. Timestamp Method vs. FIN/ACK Method Correlation coefficient: SYNACK-Timestamp RTT (µs):timestamp RTT (µs):synack 6 A. Moosbrugger: Passive RTT Measurement of TCP Flows, Diploma Thesis, FH Salzburg

7 Autonomous System Delay Finder A Privacy-preserving Network Performance Monitoring Application in F. Strohmeier: Estimating Inter-domain Network Delays by Passive Monitoring, Master Thesis, FH Salzburg 7

8 Levels of Privacy Preservation Disconnect IPs of communication partners RTTa IPa RTTb IPb AS-Level Aggregation Discard IP address information Country-Level Aggregation Discard AS number information 8

9 ASDF Monitoring Application Use Cases RTT measurement/anomaly detection Alert when an AS becomes less reachable Provide a map of the reachability of different ASes or countries ONLINE DEMO Historical trends on the RTT for specific AS Detailed results for each end system 9

10 Flow-based RTT measurements 10

11 Flow-based RTT measurement IPFIX flow exports YAF softflowd Cisco Netflow v9 Common Attributes e.g. 5-tuple store few data aggregation Observation Pint 11

12 Flow-based RTT measurement - Example Observation Point RTT 12

13 Flow measurements - Timeouts 13

14 TCP SYN/ACK vs. flow-based methods MANY additional results with flow-based method 99,5% are SYN-RST flows Failing port scans, detectable via # of packets 0,4% started before capturing (no SYN/ACK) 0,045% long-living TCP flows with breaks (TO= 600s) FEW additional results with SYN/ACK method 11% SYN/ACK RTT > 6 seconds (packet losses) 89% short-living, repeating 5-tuples F. Strohmeier, P. Dorfinger, B. Trammell: Network Performance Evaluation based on Flow Data, under submission. 14

15 TCP vs. UDP comparison same host same second 15

16 Change detections (Future Work) Application of auto-regression models Forecast? Aggregation Levels: IP/AS/Country 16

17 Large-scale evaluation (Future Work) Based on historical flow data 6 years of 5-tuple flow data Real-life problems Cisco Netflow v9 Multiple Exporting Interfaces No flow ordering Low timestamp accuracy 17

18 Related SRFG Traffic Encryption Detection (e.g. Skype) Entropy based estimation MINER Coordinated execution of tools on distributed nodes 18

19 Traffic Encryption Detection Algorithm Use first packet of a TCP/UDP flow for TCP first after 3-way handshake Use entropy of first packet payload as indication for encryption Live decision whether to forward packet/flow or not Result: Classification with high precision into Encrypted protocols like Skype, MSE, encr. edonkey Plain protocols like HTTP, POP3, IMAP, SNMP, SMTP P. Dorfinger, G. Panholzer, W. John: Entropy estimation for real-time encrypted traffic identification, accepted for TMA Workshop, Vienna 19

20 MINER in a nutshell Software platform for coordinated execution of tools on distributed nodes Tool Any executable code e.g. configure a device, generate traffic, emulate WAN, read sensor data Typically, existing executables are integrated Main features Complex scenario definitions Low-cost repeatability Persistent storage API Use cases Performance Evaluation System / Reliability tests (Reactive) Network measurements 20

21 THANK YOU FOR YOUR ATTENTION Contact: Felix Strohmeier Salzburg Research Forschungsgesellschaft m.b.h. Jakob Haringer Straße 5/ Salzburg, Austria T F felix.strohmeier@salzburgresearch.at 21