 Don Towsley 2000 Network Tomography for the Internet: Open Problems D. Towsley U. Massachusetts

 Don Towsley 2000 Network Tomography: I Goal: obtain spatio-temporal picture of a network/internet from end-to-end views ? Infrastructure (NIMI) Avg. Delay cross section view LOSS % cross section view LOSS % Avg. Delay composition of views LOSS % Delay ?

 Don Towsley 2000 Rationale Why? v network management: bottlenecks/faults v agreement verification v adaptive applications: loss, delay, shared point of congestion Why not query routers? v 1000s of autonomous systems v 100,000s routers v need special privileges v router info not always complete

 Don Towsley 2000 Example: MINC Uses end-end observations to peer inside network o multicast probes o correlated performance observed by receivers o exploit correlation to estimate link behavior v loss rates v delay statistics receivers source  ,  ,   ^^^ 11  33 loss rates

 Don Towsley 2000 Inference Methodology (Losses) o model v known multicast tree topology  independent Bernoulli processes across all links with unknown loss prob. {  k } o methodology  maximum likelihood estimates for {  k } o extensions v link delays v topology inference

 Don Towsley 2000 Open Problems o data massaging v delay measurements exhibit many artifacts o scalability o robustness to missing data o layout/composition of views o use (partial) information from network Characteristic of any approach

 Don Towsley 2000 o most traffic is point-point o point-to-point behavior very different from multicast behavior Q: how to infer internal network behavior from point-to-point measurements? The Real Internet o introduce correlation o exploit correlation

 Don Towsley 2000 Network Tomography: II Goal: obtain detailed picture of end-end behavior from internal views v network design From internal observations, infer v end-end application-level behavior v traffic flows v workload characterization

 Don Towsley 2000 Traffic Analysis Many applications have well known protocol/port (in packet header) 21 - ftp, 23 - telnet, 80 - http ftp, Some dynamically select ports napster games denial of service attack

 Don Towsley 2000 Ftp Traffic courtesy of kc

 Don Towsley 2000 Napster: until recently courtesy of kc

 Don Towsley 2000 Challenges o application signatures v napster –signaling/data transfer pattern? v games o denial of service attack signatures napster server user 1 user 2 trace collector

 Don Towsley 2000 Summary o observations v internal v end-end o views v internal v end-end o theory needed to make this happen o correlation, correlation! o scalability, scalability! o robustness, robustness! Work with a networking specialist