An Internet router level topology automatically discovering system

Transcription

1 Vol.23 No JOURNAL OF CHINA INSTITUTE OF COMMUNICATIONS October Internet 1,2 1,2 1,2,3 1,2 ( , ) Internet CERNET IP Internet Internet TP B X(2002) An Internet router level topology automatically discovering system JIANG Yu 1,2, HU Ming-zeng 1,2, FANG Bin-xing 1,2,3, ZHANG Hong-li 1,2 (1. School of Computer Science and Technology, Harbin Institute of Technology, Harbin , China; 2. National Key Laboratory on Computer Information Content Security, Harbin , China; 3. China National Network Information Security Center, Beijing , China) Abstract: In this paper, we present the architecture, some issues encountered, and some key techniques in constructing an Internet router level topology automatically discovering system, and have developed a prototype system targeted at discovering the router level topology of CERNET. Experiment results show that the methods and discovery principles we take are feasible and operational on large scale IP network. Therefore, this prototype system can be developed into a system for discovering the whole Internet router level topology in China. Key words: Internet topology; router level; discovery; network security; network management B

2 12 Internet Internet Internet RFC Internet Internet [1] Internet Internet Internet (1) (2) Internet [2] (3) [3] (4) [4] ISP (5) RTT ( DDoS) (fault isolation) [5] (6) Internet (traffic engineering) [6] (1) SNMP RMON MIB SNMP MIB ICMP DNS [7] SNMP MIB (2) ( ) ( ) Internet Internet Internet Internet Internet Internet Poisson [8] Internet ISP Internet SNMP SNMP [2] Internet Internet AS (RFC 1930) Internet AS 2 Internet IP 1988 Van Jacobson traceroute

3 IP IP 1996 Jack Rickard traceroute [9] Cheswick B. IMP(Internet mapping project) CAIDA(cooperative association for Internet data analysis) skitter IMP 1998 Internet DDoS Internet [10] skitter traceroute ping (forward) RTT skitter 18 skitter 4 [11] 66 ( 52% ) skitter Internet AS (visualizing) Internet (Internet measurement) Mercator [12] UDP (limited-hop) IP [13] Mercator IP 10% [12] Cornell Octopus [2] SNMP broadcast ping zone transfer Internet [14, IP 15] SNMP MIB ICMP [16, 17] IP Internet AS Internet ICMP UDP Internet Internet Internet Internet Internet 3 Internet (1) (2) (3) 1 CERNET IP CERNET IP Linux Oracle

4 12 Internet 57 Windows NT ( ) ATM IP IP 1 AS AS Internet IP IP 1 ( ) 2 3 ( ) ( GUI) API API a.b. 0.d1 a.b. 32.d1 a.b. 224.d1 a.b. 1.d1 a.b. 33.d1 a.b. 225.d1 a.b. 31.d1 a.b. 63.d1 3 IP ( ) IP Log (Pro C,socket) Log API API Log / ( ) / a.b. 225.d1 a.b. 0.d2 a.b. 32.d2 a.b. 224.d2 a.b. 31.d2 a.b. 63.d2 a.b. 255.d2 a.b. 0.d16 a.b. 32.d16 a.b. 224.d16 a.b. 31.d16 a.b. 63.d16 a.b. 255.d Internet traceroute UDP CERNET (1) a.b.c.d a.b.c/24 2 IP *.0 *.127 *.128 * IP 71 a.b/16 4 a.b/16 (2) a.b/16 8 a.b.c/

5 trace 0.5min a.b.0.d a.b.1.d 0.5 8=4min a.b.c.d 1 a.b.c.d =128min 2h IP [18] (3) trace trace 3 TTL 3 [12] IP IP (4) IP IP whois IP b n b b=lg( )/n (1) IP 3(a) ( ) 3(b) P P P (2) IP IP IP G= V IP,E IP G = V C,E C V E C C = { c v = {( v ip, v V City ( v IP ) ( v 1, v 2 ip ) E ) = c} City( v (a) (b) 1 ) = v City( v 1 2 ) = v c1 c2 ip ip IP ip c ip c 3 (3) [19] (4) IP ( 1 ) 2

6 12 Internet Internet (1) (2) (3) IP IP IP (4) IP (5) ToolTip IP VC++ ToolTip 5 ( ) 1611 ( IP) 2939 ( ) 4 CERNET CERNET 6 7 ( )IP trace ( - - )

7 CERNET 5 CERNET 6 CERNET trace byte UDP 3 56byte ICMP trace 30s (32+56) 20 71/1024=122Kbyte( ) /30= /30=4 traceroute trace 3 IP IP 1 ( ) 2 3 ( ) (1) IP ( [20] 1 3 trace IP if1,if3

8 12 Internet 61 IP if4,if2 if2 if3 if1 if4 ) IP [11] (2) IP IP NAT DHCP (multi-homed) IP IP NAT DHCP (3) IP a (b) (c) 7 IP 6 Internet

9 traceroute (CERNET) CERNET traceroute Internet [1] Internet domain survey [EB/OL]. December [2] SIAMWALL A R, SHARMA R, KESHAV S, Discovering Internet Topology [R]. Technical Report, Computer Science Department, Cornell University, July [3] MILLER N, STEENKISTE P. Collecting network status information for network-aware applications [A]. Proc of IEEE INFOCOM 2000 [C]. Tel-Aviv, Israel, March [4] QIU L, PADMANABHAN V N VOELKER G M. On the placement of web server replicas [A]. Proc of IEEE INFOCOM 2001 [C]. Anchorage, Alaska, April [5] REDDY A, ESTRIN D,GOVINDAN R. Large-scale fault isolation [J]. IEEE Journal on Selected Areas in Communications, 2000, 18(5): [6] JAMIN S, JIN C, JIN Y, et al. On the placement of internet instrumentation [A]. Proc of IEEE INFOCOM 2000(I) [C].Tel-Aviv, Israel, March [7] LIN H, LAI H, LAI S. Automatic link layer topology discovery of IP networks [A] IEEE International Conference on Communications (II) [C].Vancouver, BC, Canada, June [8] PAXSON V, FLOYD S. Wide area traffic: the failure of poisson modeling [J]. IEEE/ACM Trans on Networking, 1995, 3(3): [9] RICKARD J. Mapping the internet with traceroute [J]. Boardwatch magazine, 1996,10(12). [10] CHESWICK B, BURCH H, BRANIGAN S. Mapping and visualizing the Internet [A]. Proc of the 2000 USENIX Annual Technical Conference [C]. San Diego, California, USA, June [11] HUFFAKER B, PLUMMER D, MOORE D, et al.topology discovery by active probing [EB/OL]. papers/2002/skitteroverview/. Jan [12] GOVINDAN R, TANGMUNARUNKIT H. Heuristics for Internet map discovery [A]. Proc of IEEE INFOCOM 2000(III) [C].Tel-Aviv, Israel, March [13] DANESH A, RUBIN S H, SMITH M H, et al. Mapping the Internet [A]. Joint 9th IFSA World Congress and 20th NAFIPS International Conference [C]. Vancouver, BC, Canada, July [14],,. [J]., 2001,22(4): [15],,. [J].,1999,19(2):4-6. [16],,. IP TTL [J].,2000,19( 7): [17],,. [J].,2000,21(8): [18],,. [J].,2001,12(2): [19] FALOUTSOS C, FALOUTSOS P, FALOUTSOS M. On power-law relationships of the Internet topology [A]. Proc of the ACM SIGCOMM 99 [C].MA, USA, Sept [20] STEVENS W R,,. TCP/IP 1: [M].,