Reading Report 14 Yin Chen 14 Apr 2004 Reference: Internet Service Performance: Data Analysis and Visualization, Cross-Industry Working Team, July,

Overview This work focuses on 3 primary internet performance issues:  Establishing baselines Will the application work? -- Whether the infrastructure can support new applications and services.  Detecting anomalies whether the existing infrastructure is currently meeting the performance and reliability requirements.  Identifying trends Will the application continue to work? – Predict the future performance of the infrastructure. Metrics of interest  Roundtrip delay  Packet loss  Reachability  Availability  Refer to Reading Report 7

Related Works Visual Networks(1999) and Keynote(2000)  Offer products and services for assessing the performance of applications and offer QoS in dial-up network.  NOT offer the detailed data analysis and statistics generation capabilities. The PingER project  Led by Stanford Linear Accelerator Center (SLAC)  An effort to monitor and understand the parts of the Internet used in high energy nuclear and particle physics research.  Involved 71countries on six continents.  The monitoring site sends pings to a remote site, gather the packet loss and roundtrip time reported by ping from each of the 20 monitoring sites, and write to a database at Fermilab. The Cooperative Association for Internet Data Analysis  Developed a series of measurement and analysis tools that can be used to better understand Internet traffic  Most of the tools can be download from

Methodology Experiment Setting Up Use PingER software, to measure roundtrip delay, packet loss and availability between pairs of hosts. About dozen measurement hosts are included. Every 30 min, each host pings every other host to detect anomalies. A set of 11 pings of 100 bytes each is send first, the first ping is uses to eliminate possible effects, i.e., priming of caches A set of 10 pings of 1,000 bytes is followed. Also sent a traceroute command to each remote host. It provides information about the nodes a packet encounters along the path from the source to the destination, and the times the packet reaches those nodes. Once a day, and archive host retrieves ping and traceroute data from each of the measurement hosts and stores the data in a database. Each ping packet received by a source host contains a value for the roundtrip delay between that host and the destination host.  Packet lost -- If one ping is not returned within timeout time  Unreachable -- If none of the pings returned By retaining data on all the pings, can calculate a variety of statistics, i.e., mean, median, minimum, maximum, quartile, and can perform this calculation over any aggregated set of data, i.e., aggregation over all hosts or over a particular period of time.

Methodology Advantages & Disadvantages Advantages  Simple  Availability of the ping tool on all machines Disadvantages  Ping uses the Internet Control Message Protocol (ICMP), does not necessarily have the same performance as TCP, UDP, or other IP protocols.  i.e., ICMP packet can be given lower priority on some routers, or they can be clocked by firewalls.

Examples A set of ping samples are collected every 30 min between each source and destination pair. i.e., (default timeout for ping is 20 sec.) {78ms, 85ms, 72ms, ∞, 64ms, 53ms, 81ms, 93ms, 101ms, 67ms} Over the course of a day, 48 of these samples sets are collected : TimeSample Sets 112:00 am{78ms, 85ms, 72ms, ∞, 64ms, 53ms, 81ms, 93ms, 101ms, 67ms} am{42ms, 77ms, 68ms, ∞, ∞, ∞, 95ms, 43ms, 41ms} am{…} am{…} … pm{…} pm{…} 2 techniques for reducing large volume :statistics generation and data aggregation  The median : |78|  The Mean : ( ) / 9 = 77.1ms  The maximum : 101ms  The minimum : 53ms

Example (Cont.) Loss Loss = unsuccessful pings / the total number of pings,  i.e., for 12:00am set L = 1/10 = 10%  Aggregate the data collected between a single source and multiple destinations, (or reverse) Destination No Loss0% 0% 10% 30% 0% 100% 40% 0% 10% 0%  The media0% 0% 0% 0% |0%| 10% 10% 30% 40%  The mean ( ) / 9 = 10%  The maximum40%  The minimum0%

Baselines

Baselines (Cont.)

Baselines (Cont.) Visualizing the Aggregation FIGURE 25 Conceptualization of a Large Set of Loss Samples (All Source-Destination Pairs)

Baselines (Cont.) Time of Day Baselines

Baselines (Cont.) Daily Baselines

Baselines (Cont.) Weekday Baselines

Data visualization Single-dimensional

Data Visualization Two-dimensional 2 ways  Direct plots of the two metrics  Plots of some function of the two metrics i.e., for availability,  Availability is the fraction of time when the delay and loss rate of pings sent to a destination are within selected thresholds: GoodDelay < 100ms and loss < 5% UnavailableDelay > 400ms or loss > 20% PoorOtherwise  Plot ping data from a host pair during 10 weeks,  Each point on the graph is a {loss, delay} pair  i.e., for a set of delay measurements: {78ms, 85ms, 72ms, ∞, 64ms, 53ms, 81ms, 93ms, 101ms, 67ms} Produce 10 {loss, delay} pairs : {10%, 78ms} {10%, 85ms} {10%, 72ms} {10%, ∞} {10%, 64ms} {10%, 53ms} {10%, 81ms} {10%, 93ms} {10%, 101ms} {10%, 67ms}

Data Visualization Examples of Baselines