Network Measurements @ Planète

1. Network Measurements @ Planète Chadi Barakat Email: Chadi.Barakat@inria.fr http://planete.inria.fr/chadi/

2. Covered topics Traffic measurements in the core • Packet sampling [Infocom,IMC,ITC,Presto@CoNext] Edge measurements of Internet access performance • Delay monitoring [ITC,GIS@Infocom] Applications’ traffic measurements • Application identification [Infocom,Networking,ICC] • Video streaming [CoNext] Particular focus on the scalability of measurements and the limitation of their overhead Chadi Barakat

3. 1- Traffic measurements in the core Common configuration • NetFlow at edge • Packet sampling • Static rates Simple but, • reduced coverage • lacks adaptability and flexibility Our approach (funded by FP7 ECODE led by Alcatel-Lucent): • Sample traffic over the network and combine measurements • Optimize/Adapt sampling rates given a measurement task E.g. maximum accuracy for NetFlow records, traffic matrix of some ASes/prefixes Chadi Barakat

4. 1- Problem formulation Network-widemeasurements • Combine the different local and noisy measurements to build a global and more reliable estimation of traffic Sampling rate optimization • Find the sampling rate vector that minimizes a weighted sum of mean square estimation error over tasks Two implemented solutions: (netflow/s) Either one shot (requires overhead prediction) Otherwise iterative using Gradients Chadi Barakat

5. 1- MonLab: A platform for the validation of network trafic monitoring solutionshttp://planete.inria.fr/MonLab/ Emulate network topologies (routers, routing) Replay real traffic traces Implement real monitoring tools(tcpdump, Sampling, SoftFlow) Available in Open Source Implementouralgorithms Chadi Barakat

6. 2- Edgemeasurements of access performance Internet weather Average delay In collaboration with Grenouille.com (funded by ANR CMON) Context – Large scale measurements of network access: • Bandwidth, delay, anomalies, neutrality, etc • Problem of scale and lack of collaboration of operators • (Volunteered) Users do the maximum, their measurements correlated, with the help of dedicated servers First project: ACQUA – a scanner of my access delay • Is there a network problem? How many paths are impacted? • Ratio of impacted paths points to gravity (and locality) • Track network delay to random landmarks (sample access tree) • Few landmarks are enough – iPlane data [ITC09] ACQUA for service differentiation Average delay over abnormal paths Ratio of abnormal path delays http://planete.inria.fr/acqua/ Chadi Barakat

7. 2- Edge measurements of access performance Second project: Can one use coordinates for network monitoring instead of direct delay measurements? Virtual coordinates: • General purpose service for delay estimation and host positioning • By embedding partial network delays in an Euclidean space • Available information in P2P applications (Vivaldi @ Azurus) Observations [GIS@Infocom2010]: • Vivaldi coordinates move even in normal situations (PlanetLab) • But there is a cluster of stable nodes that move together • Network can be monitored by tracking content of this cluster, the downside is a slow reaction time Chadi Barakat

8. 3- Applications’ traffic measurements Objectives: • Understand and model traffic of major applications • Use the resulted models for application identification Without solely relying on port numbers and payload Profiling, dimensioning, anomalies, etc Example of two contributions: • A statistical iterative method for application identification using packet level (size, time) and host level (profile) measurements • A study of video streaming traffic for different players Activities will extend to further applications/protocols (VoIP, P2P, etc) Chadi Barakat

9. 3- Iterative Bayesian approach for application identification on the fly Start from a trace where reality of applications is known Build a histogram for the features of each packet of each application • E.g. size of packet 1, time of packet 1, size of packet 2, etc On the fly • Capture a packet, getitsfeature • Get the correspondingprobability per application • Update a global likelihoodfunction per application • Stop wheneither a threshold or a maximum number of iterations are reached • Map the flow to the mostlikely application Chadi Barakat

10. 3- Iterative Bayesian approach for application identification on the fly Ratio of correctly classified flows Packet number / application Chadi Barakat

11. 3- Characterizing video streaming traffic Motivated by the increase in streaming traffic (20% to 40%) Understand its fingerprint on the network for different players Data: • Youtube: 5000 FLASH, 3000 HTML5, 2000 HD FLASH, 50 mobile • Netflix: 200 to Desktop, 50 to mobile Three main strategies identified Chadi Barakat

12. 3- Characterizing video streaming traffic No On Off Cycles Short On Off Cycles Long On Off Cycles OFF OFF Chadi Barakat

13. 3- Characterizing video streaming traffic Motivated by the increase in streaming traffic (20% to 40%) Understand its fingerprint on the network for different players Data: • Youtube: 5000 FLASH, 3000 HTML5, 2000 HD FLASH, 50 mobile • Netflix: 200 to Desktop, 50 to mobile Three main strategies identified An analytical model to capture the impact of the different strategies on the aggregate network traffic: • No impact if videos are not interrupted • Otherwise, waste of resources for greedy strategies Chadi Barakat

14. Concluding remarks Everything is scaling up, measurements should follow • Sampling, inversion, compression • More monitors (passive/active). Correlating measurements. • Need for dedicated infrastructure Capture, probe, reply to probes, perform computations, store data, etc Applications behave far from standards • Measurements and models are needed Access performance for the large public • More faithful (“my measurements”) • Easier to understand (application level metrics?) Real traces are a big issue. Experimental platforms another one. Chadi Barakat

15. merci • www.inria.fr

16. Context Scalable solutions for network and traffic measurements • Improve accuracy while limiting the overhead Understand the performance of existing solutions • NetFlow, coordinates, localization, etc Propose new solutions • Traffic classification, access delay, etc Observe and understand the network behavior • Traffic, applications, protocols, etc Chadi Barakat

17. 1- Adaptive network-wide sampling Monitoring application e.g, calculate user traffic, estimate flow sizes, track traffic as function of time Trafficinferenceblock Sampling rate configuration block Iterate to adapt to network conditions Optimize some accuracy function while maintaining sampling rates and overhead below some threshold Sampled flow monitoring deployed in all routers Chadi Barakat

18. 1- Case study: Traffic matrix calculation Estimate amount of traffic flowing among a set of edge routers (common task for traffic engineering apps) GEANT European Research Network • MonLab (planete.inria.fr/monlab/): An experimental platform that integrates: • Sampled NetFlow + Collector + Online optimizer of the sampling rates + Traffic emulator + Overhead measurement Chadi Barakat

19. 1- Sample of results: Precision vs Target Overhead When the sampling rates are optimally set for the edge solution Small flows are better captured by our method [Infocom 2011, ITC 2011, Presto@CoNEXT 2010] Chadi Barakat