1. 1 Synchronizing Management Information using Traffic Pattern Matching Technique Kohei Ohta, Yohsuke Takei, Nei Kato, Glenn Mansfield, Yoshiaki Nemoto Cyber Solutions Inc., Tohoku University SPECTS’99, July 11-16, 1999

2. Cyber Solutions 2 outline X background –recent environment X Internet measurement –black box in the measurement X approach with pattern match technique –traffic characteristics at a border of network –incoming/outgoing traffic characteristics X evaluation –sample application X conclusion

3. Cyber Solutions 3 background X Internet traffic measurement –effective operation –management and analysis X planning networks X managing QoS, …. X Efforts –IETF-WG X IPPM, RTFM, SNMP(RMON, DISMAN) –Research X NIMI, INI, so many measurement research and tools

4. Cyber Solutions 4 measurement the Internet probe router TRAFFIC accounting policing shaping server A host A server B network A §who is speaking? §where is congested? §how far to the servers?

5. Cyber Solutions 5 issues on high-speed network measurement X a large amount of traffic –difficult for exhaustive examination X rapid changing situation –the event handling is time sensitive X widely distributed –difficult to observe from one point

6. Cyber Solutions 6 points of observation X points of observation –Interfaces of network devices –probing shared media X traditional Ethernet, FDDI/CDDI,… –remote monitoring X remote management, DISMAN, RMON X range of observation –inside LAN –large scale backbone network –end-to-end across global Internet centralized distributed local area wide area

7. Cyber Solutions 7 synchronization issue X What is synchronization? –information correlation observed at different independent point X Why synchronize? –all network activities are related each other –to know the picture of global behavior X How to synchronize? –NTP, GPS

8. Cyber Solutions 8 black box in the measurement How to synchronize?

9. Cyber Solutions 9 what is traffic pattern? network related activity?

10. Cyber Solutions 10 modeling the traffic pattern traffic transition vector

11. Cyber Solutions 11 similarity evaluation correlation coefficient (r ij ) between incoming and outgoing traffic

12. Cyber Solutions 12 experimental environment X two types of operational network –100Mbps FDDI backbone network X providing connectivity to some big universities, colleges, and museums X over 20 organizations connected –10Mbps Ethernet Internet-eXchange, X providing connectivity to 5 commercial ISPs.

13. Cyber Solutions 13 data for evaluation X whole traffic data from the operational network X traffic data of each observation point derived from whole traffic X comparing the simulated data with original whole traffic data

14. Cyber Solutions 14 overall evaluation X comparison between logged data and calculated data the best case with exact match (most strict evaluation)

15. Cyber Solutions 15 sample synchronization result mismatching

16. Cyber Solutions 16 what is the traffic in the network synchronized LiI is amount of synchronized incoming traffic via link i

17. Cyber Solutions 17 who is using the bandwidth

18. Cyber Solutions 18 traffic MATRIX in switching HUB 100M Ethernet SW-HUB 24-ports Access method SNMPv1 MIB object ifInUcastPkts ifOutUcastPkts Polling Interval: 10sec.

19. Cyber Solutions 19 considerations X Good points –suitable for high-speed network –small resources needed –within well-standardized framework, e.g. SNMP –no new additional equipment needed. X Limitations –only for small delay network –result is just estimation –difficult to apply to homogeneous network

20. Cyber Solutions 20 conclusion X On traffic measurement issues: –point out the strong requirement in case of high- speed network measurement in distributed manner. –proposed a novel idea to synchronize the traffic information observed at different independent points, which use traffic pattern match technique. –show the experimental result and sample application with this proposed technique.