Traffic Monitoring on CJK-Network 16th CJK NGN-WG TTC Nobuyuki NAKAMURA ( Oki Electric Industry Co., Ltd.)

2 Given the situation of interconnectivity among various NGN networks, MPM will become a very important node for traffic observation. We have been investigating the possibility of analyzing network quality by observing traffic at MPM. We will perform monitoring at MPM with the following traffic paths using our monitoring method(see appendix ), which is suitable for analyzing video/audio streaming. ・ Traffic Path 1:China/Korea - Japan RTP traffic ・ Traffic Path 2:Japan – China/Korea - Japan RTP loopback traffic Overview Korea MPM Japan MPM China Network TAP Storage RTCP-XR Network load RTCP-XR Collect RTCP Correlation Analysis Our algorithm is utilizing stream mining, which is useful in Traffic Monitoring in NGN.

3 SIP Server SIP Phone Traffic Path 1: RTP traffic between China/Korea and Japan Japan MPM Network TAP Storage Collect packets Multi Media session Network load ・ We will set up one of terminals in China/Korea NW, and another terminal and SIP server in Japan NW. ・ We will analyze the behavior between collected packets on MPM and network load, and feed back this analysis to the Traffic Path 2 experiment with loopback at China/Korea MPM.

4 Outline of experiments & researches Detection of the network anomaly through traffic analysis at MPM with the following steps. #1 Create Network anomaly by intentionally generating instability to wireless link #2 Collect packets capturing data at MPM (Japan) These packets might contain not only our experiment traffic but also various traffic in CJK testbed. #3 Extract the packets that relates to network anomaly through our analysis. #4 Detect network anomaly point i.e. instability of wireless link in Japan - In #3 and #4, we will utilize our analysis method (see appendix) so that we can confirm whether our method is useful or not. #1 create Instable wireless link #3#4 detect Instability Japan MPM Network TAP Storage #2 Collect packets Our session Various CJK traffic China

5 SIP Server SIP Phone Traffic Path 2: Japan-China/Korea-Japan traffic monitoring Purpose Verification of effective network load or anomaly for Traffic Path 1 experiment - by testing various network load or anomaly Step#1-#4 will also be performed in this path. Next plan Evaluate on the Japan-China-Korea-Japan triangle path. Japan MPM Network TAP Storage Collect packets Multi Media session Return point of traffic routes network load China/Korea

6 Current progress Equipment of Japan NW Setup SIP-server and SIP-Phone terminal. Setup and check the VPN connection to Japan NW from experiment room. Traffic monitoring at Japan MPM is operating continuously. Traffic Path1: China/Korea – Japan traffic path Check the connectivity from a terminal at China NW to another terminal and SIP server at Japan NW. (July 21) (see next page) Step #1 and #2 (July 21) Traffic Path 2: Japan – China/Korea – Japan traffic path Setup return point of traffic routes at Korea MPM.(Done) Collecting packets. (Done) Step #3 and #4 are executing now. - We will use this experimental system to experiment about various network anomaly by the improvisation, according to the result of step #3 or #4.

7 Monitoring Results asof July 21, 2009 We made a experiment on July 21 at CATR site. We captured and collected data in Japan site. Captured data Japan MPM Networ k TAP Storage Collect packets Multi Media session Network load Ｃｈｉｎａ Captured Data taken in Japan site

8 Captured Data taken from MPM in CATR site on July 21 st. Statistics Summary (BT=6) SSRC of source = Begin seq = 2 end seq = 252 Lost packets = 0 Dup packets = 0 Min jitter = 0 (0 ms) Max jitter = 80 (10 ms) Mean jitter = 16 (2 ms) Dev jitter = 16 (2 ms) Min ttl or hl = 127 Max ttl or hl = 127 Mean ttl or hl = 127 Dev ttl or hl = 0 VoIP Metrics (BT=7) SSRC of source = Loss rate = 0 (0.0%) Discard rate = 0 (0.0%) Burst density = 0 (0.0%) Gap density = 0 (0.0%) Burst duration = 0 (ms) Gap duration = 5040 (ms) Round trip delay = 0 (ms) End system delay = 0 Signal level = 0 Noise level = 0 RERL = 0 Gmin = 16 R factor = 93 Ext. R factor = 0 MOS-LQ = 40 MOS-CQ = 44 RX config = 0 JB nominal = 0 JB maximum = 0 JB abs max = 0 Data was also taken from MPM in CATR as follows. Some variation was observed by looking at RTCP-XR parameters such as packet loss and delay. We’ll analyze these data by using our analysis methods, and show the result of analysis on next CJK meeting.

9 Schedule ’ 09 3Q ’ 09 4Q ’ 10 1Q ’ 10 2Q Traffic Monitoring Research Traffic Path1(July 21 st China – Japan ) Traffic Path 2 (Japan – China/Korea – Japan ) Step #3(Extraction) Step #4(Analysis) Although traffic Path2 will be a main experiment, hopefully we would continue traffic monitoring using Traffic Path 1 Through collaboration with CATR and ETRI i.e path from Japan to Korea as well. Continue if needed

10 Appendix References (for pp.4) we will perform analysis by utilizing our algorithm as follows. - Ikada and Hamaguchi, “Improved Approximate Frequency Counts Algorithm based on “Lossy Counting””, IEICE Technical Report Vol.107, No.524, pp.43-47, Ikada, Nakamura and Hamaguchi, “Network Traffic Prediction for Network Quality Anomaly Detection by RTP Communication Monitoring”, IEICE Technical Report Vol.109, No.79, pp.67-72, Nakamura, Ikada, “Detection Method for Network Quality Degradation by using Network Characteristics”, IEICE Technical Report Vol.108 No.458, pp , This work is partly supported by the National institute of Information and Communications Technology (NICT). Thank you for your attention.