1.  Don Towsley 2000 Network Tomography for the Internet: Open Problems D. Towsley U. Massachusetts

2.  Don Towsley 2000 Network Tomography: I Goal: obtain spatio-temporal picture of a network/internet from end-to-end views ? Infrastructure (NIMI) Avg. Delay 1 2 3 cross section view 1 2 3 LOSS % 1 2 3 cross section view LOSS % 4 5 6 Avg. Delay 4 5 6 4 5 6 composition of views LOSS % 1 2 3 4 5 6 Delay 1 2 3 4 5 6 1 2 3 4 5 6 ?

3.  Don Towsley 2000 Rationale Why? v network management: bottlenecks/faults v agreement verification v adaptive applications: loss, delay, shared point of congestion Why not query routers? v 1000s of autonomous systems v 100,000s routers v need special privileges v router info not always complete

4.  Don Towsley 2000 Example: MINC Uses end-end observations to peer inside network o multicast probes o correlated performance observed by receivers o exploit correlation to estimate link behavior v loss rates v delay statistics receivers source 101101 110110  ,  ,   ^^^ 11  33 loss rates

5.  Don Towsley 2000 Inference Methodology (Losses) o model v known multicast tree topology  independent Bernoulli processes across all links with unknown loss prob. {  k } o methodology  maximum likelihood estimates for {  k } o extensions v link delays v topology inference

6.  Don Towsley 2000 Open Problems o data massaging v delay measurements exhibit many artifacts o scalability o robustness to missing data o layout/composition of views o use (partial) information from network Characteristic of any approach

7.  Don Towsley 2000 o most traffic is point-point o point-to-point behavior very different from multicast behavior Q: how to infer internal network behavior from point-to-point measurements? The Real Internet o introduce correlation o exploit correlation

8.  Don Towsley 2000 Network Tomography: II Goal: obtain detailed picture of end-end behavior from internal views v network design From internal observations, infer v end-end application-level behavior v traffic flows v workload characterization

9.  Don Towsley 2000 Traffic Analysis Many applications have well known protocol/port (in packet header) 21 - ftp, 23 - telnet, 80 - http ftp, Some dynamically select ports napster games denial of service attack

10.  Don Towsley 2000 Ftp Traffic courtesy of kc claffy@CAIDA

11.  Don Towsley 2000 Napster: until recently courtesy of kc claffy@CAIDA

12.  Don Towsley 2000 Challenges o application signatures v napster –signaling/data transfer pattern? v games o denial of service attack signatures napster server user 1 user 2 trace collector

13.  Don Towsley 2000 Summary o observations v internal v end-end o views v internal v end-end o theory needed to make this happen o correlation, correlation! o scalability, scalability! o robustness, robustness! Work with a networking specialist