Presentation is loading. Please wait.

Presentation is loading. Please wait.

A Non-intrusive, Wavelet-based Approach To Detecting Network Performance Problems Polly HuangETH Zurich Anja FeldmannU. Saarbruecken Walter WillingerAT&T.

Similar presentations


Presentation on theme: "A Non-intrusive, Wavelet-based Approach To Detecting Network Performance Problems Polly HuangETH Zurich Anja FeldmannU. Saarbruecken Walter WillingerAT&T."— Presentation transcript:

1 A Non-intrusive, Wavelet-based Approach To Detecting Network Performance Problems Polly HuangETH Zurich Anja FeldmannU. Saarbruecken Walter WillingerAT&T Labs-Research

2 Road Map zMotivation and rationale zMechanism details zConclusion and outlook

3 Performance Problem Web TCP Network Link/Physical Web TCP Network Link/Physical Google.com congestion routing server else Internet Web TCP Network Link/Physical congestion routing proxy else

4 Current State zActive probing yEx: traceroute, ping yDisturbing - injecting unnecessary traffic yBiasing - distort metrics of interest xHeisenberg effects zPassive measurements yEx: Cisco NetFlow, IP Accounting, other packet-level measurment ygive much information yDo not infer problems inside the network

5 What Would Be Cool zPassive zTrigger alerts in real time zFor problems due to yServer load yCongestion yRouting error zCommon Symptoms yDelay and drop

6 TCPs Closed-loop Control zDelays/drops reflected in RTT/RTO estimations yRTT: round trip time yRTO: retransmission timeout zQuality of Network Path yValues of RTT/RTO estimations yAmounts of RTT/RTO samples zCan be measured passively

7 Detailed Estimation zMethodology yA hash table of all data packets observed yOne RTT sample per data-ack pair yOne RTO sample per data-data pair zSlow y~ #packets/observation period yespecially with high date rate connections (the likely trouble makers)

8 Objectives zPassive measurement yNon-intrusive zInfer quality of network paths yDetecting network performance problem zEfficiently (so can be done in real time) yWavelet-based technique

9 Road Map zMotivation and rationale zMechanism details zConclusion and outlook

10 Wavelet-based Technique zTheoretical ground yWavelet transform yEnergy plots (or scaling plots) yInterpreting energy plots zWIND, the problem detection tool yFeatures & examples yDetection methodology yValidation effort

11 Theoretical Ground zFFT yFrequency decomposition yf j, Fourier coefficient yAmount of the signal in frequency j zWT: wavelet transform yFrequency (scale) and time decomposition yd j,k, wavelet coefficient yAmount of the signal in frequency j, time k

12 Wavelet Example 0 1 00 00 00 00 11 11 11 11 s1s2s3s4s1s2s3s4 d1d2d3d4d1d2d3d4 0 0 0 0 2 2 2 20 0 0 0 0 0 4 40 0 0 8 0 88

13 Self-similarity zEnergy function yE j = Σ(d j,k ) 2 /N j zSelf-similar process yE j = 2 j(2H-1) C <- the magic!! ylog 2 E j = (2H-1) j + log 2 C ylinear relationship between log 2 E j and j

14 Self-similar Traffic

15 Effect of Periodicity self-similar Internet Traffic

16 Adding Periodicity zpackets arrive periodically, 1 pkt/2 3 msec zcoefficients cancel out at scale 4 10 00 00 00 s1s2s3s4s1s2s3s4 d1d2d3d4d1d2d3d4 1 0 0 0 1 0 1 20

17 Simulation Traffic Single RTT

18 Simulation Traffic Congestion

19 Interpreting Energy Functions zAbrupt knees at yRTT time scale yRTO time scale zKnee shifts yRTT/RTO time changes zLow energy level (after normalization) ycongestion ylow traffic volume

20 WIND - The Detection Tool Wavelet-based Inference for Network Detection zBased on libpcap and tcpdump zOn-line mode (efficient) yPer packet: compute d j,k yPer observation period: output E j yOn a subnet basis zOff-line mode yDetailed RTT/RTO estimation

21 Real Traffic By Subnets

22 Real Traffic By Periods

23

24 Detecting Methodology zReference function ySmoothed average zDifference yArea below the reference function yWeighted sum by scale zFlagged interesting yTop 10% deviations

25 Pick Out Interesting Ones 26, 30, 31

26 Validation By zWIND off-line mode yDetailed RTT/RTO estimations yVolume zSimilar heuristics (area difference) yCCDF of RTT/RTO yRatio of RTO/RTT yVolume

27 Validate period 26, 30, 31 CCDF of RTO: pick out period 23, 26, 31 CCDF of RTT: pick out period 29, 30, 31 80-90% are validated interesting

28 Road Map zMotivation and rationale zMechanism details zConclusion and outlook

29 Summary zDetect problems using energy plots yIf self-similar, clean linear relationship yIf periodic, getting knees yIf problems, knee shifts or low energy level zWIND: the online/offline analysis tool yPassive yEfficient

30 Outlook zFull-fledged diagnosing tool yMore sophisticated heuristics yUse of traceroute data zIllustrative examples yUsing the tool (beta release) yUsing the methodology

31 Questions? zhttp://www.tik.ee.ethz.ch/~huang


Download ppt "A Non-intrusive, Wavelet-based Approach To Detecting Network Performance Problems Polly HuangETH Zurich Anja FeldmannU. Saarbruecken Walter WillingerAT&T."

Similar presentations


Ads by Google