1. Network Measurements @ Planète Chadi Barakat Email: Chadi.Barakat@inria.fr http://planete.inria.fr/chadi/

2. Chadi Barakat- 2 Covered topics  Traffic measurements in the core -Packet sampling [Infocom,IMC,ITC,Presto@CoNext]  Edge measurements of Internet access performance -Delay monitoring [ITC,GIS@Infocom]  Applications’ traffic measurements -Application identification [Infocom,Networking,ICC] -Video streaming [CoNext]  Particular focus on the scalability of measurements and the limitation of their overhead

3. Chadi Barakat- 3 1- Traffic measurements in the core  Common configuration -NetFlow at edge -Packet sampling -Static rates  Simple but, -reduced coverage -lacks adaptability and flexibility  Our approach (funded by FP7 ECODE led by Alcatel-Lucent): -Sample traffic over the network and combine measurements -Optimize/Adapt sampling rates given a measurement task E.g. maximum accuracy for NetFlow records, traffic matrix of some ASes/prefixes

4. 1- Problem formulation Chadi Barakat- 4  Network-wide measurements -Combine the different local and noisy measurements to build a global and more reliable estimation of traffic  Sampling rate optimization -Find the sampling rate vector that minimizes a weighted sum of mean square estimation error over tasks Two implemented solutions: (netflow/s) -Either one shot (requires overhead prediction) -Otherwise iterative using Gradients

5. 1- MonLab: A platform for the validation of network trafic monitoring solutions http://planete.inria.fr/MonLab/ Chadi Barakat- 5  Emulate network topologies (routers, routing)  Replay real traffic traces  Implement real monitoring tools (tcpdump, Sampling, SoftFlow)  Available in Open Source  Implement our algorithms

6.  In collaboration with Grenouille.com (funded by ANR CMON)  Context – Large scale measurements of network access: -Bandwidth, delay, anomalies, neutrality, etc -Problem of scale and lack of collaboration of operators -(Volunteered) Users do the maximum, their measurements correlated, with the help of dedicated servers  First project: ACQUA – a scanner of my access delay -Is there a network problem? How many paths are impacted? -Ratio of impacted paths points to gravity (and locality) -Track network delay to random landmarks (sample access tree) -Few landmarks are enough – iPlane data [ITC09]  ACQUA for service differentiation Chadi Barakat- 6 2- Edge measurements of access performance Internet weather Average delay over abnormal paths Ratio of abnormal path delays http://planete.inria.fr/acqua/

7.  Second project: Can one use coordinates for network monitoring instead of direct delay measurements?  Virtual coordinates: -General purpose service for delay estimation and host positioning -By embedding partial network delays in an Euclidean space -Available information in P2P applications (Vivaldi @ Azurus)  Observations [GIS@Infocom2010]: -Vivaldi coordinates move even in normal situations (PlanetLab) -But there is a cluster of stable nodes that move together -Network can be monitored by tracking content of this cluster, the downside is a slow reaction time 2- Edge measurements of access performance Chadi Barakat- 7

8. Chadi Barakat- 8 3- Applications’ traffic measurements  Objectives: -Understand and model traffic of major applications -Use the resulted models for application identification -Without solely relying on port numbers and payload  Profiling, dimensioning, anomalies, etc  Example of two contributions: -A statistical iterative method for application identification using packet level (size, time) and host level (profile) measurements -A study of video streaming traffic for different players  Activities will extend to further applications/protocols (VoIP, P2P, etc)

9. Chadi Barakat- 9 3- Iterative Bayesian approach for application identification on the fly  Start from a trace where reality of applications is known  Build a histogram for the features of each packet of each application -E.g. size of packet 1, time of packet 1, size of packet 2, etc  On the fly Capture a packet, get its feature Get the corresponding probability per application Update a global likelihood function per application Stop when either a threshold or a maximum number of iterations are reached Map the flow to the most likely application

10. Chadi Barakat- 10 Ratio of correctly classified flows Packet number / application 3- Iterative Bayesian approach for application identification on the fly

11. Chadi Barakat- 11 3- Characterizing video streaming traffic  Motivated by the increase in streaming traffic (20% to 40%)  Understand its fingerprint on the network for different players  Data: -Youtube: 5000 FLASH, 3000 HTML5, 2000 HD FLASH, 50 mobile -Netflix: 200 to Desktop, 50 to mobile  Three main strategies identified

12. Chadi Barakat- 12 3- Characterizing video streaming traffic No On Off Cycles Long On Off Cycles OFF Short On Off Cycles

13. Chadi Barakat- 13 3- Characterizing video streaming traffic  Motivated by the increase in streaming traffic (20% to 40%)  Understand its fingerprint on the network for different players  Data: -Youtube: 5000 FLASH, 3000 HTML5, 2000 HD FLASH, 50 mobile -Netflix: 200 to Desktop, 50 to mobile  Three main strategies identified  An analytical model to capture the impact of the different strategies on the aggregate network traffic: -No impact if videos are not interrupted -Otherwise, waste of resources for greedy strategies

14. Chadi Barakat- 14 Concluding remarks  Everything is scaling up, measurements should follow -Sampling, inversion, compression -More monitors (passive/active). Correlating measurements. -Need for dedicated infrastructure -Capture, probe, reply to probes, perform computations, store data, etc  Applications behave far from standards -Measurements and models are needed  Access performance for the large public -More faithful (“my measurements”) -Easier to understand (application level metrics?)  Real traces are a big issue. Experimental platforms another one.

15. merci www.inria.fr

16. Chadi Barakat- 16 Context  Scalable solutions for network and traffic measurements -Improve accuracy while limiting the overhead  Understand the performance of existing solutions -NetFlow, coordinates, localization, etc  Propose new solutions -Traffic classification, access delay, etc  Observe and understand the network behavior -Traffic, applications, protocols, etc

17. 1- Adaptive network-wide sampling Chadi Barakat- 17 Traffic inference block Sampling rate configuration block Sampled flow monitoring deployed in all routers Monitoring application e.g, calculate user traffic, estimate flow sizes, track traffic as function of time Optimize some accuracy function while maintaining sampling rates and overhead below some threshold Iterate to adapt to network conditions

18. 1- Case study: Traffic matrix calculation Estimate amount of traffic flowing among a set of edge routers (common task for traffic engineering apps) GEANT European Research Network MonLab (planete.inria.fr/monlab/): An experimental platform that integrates: Sampled NetFlow + Collector + Online optimizer of the sampling rates + Traffic emulator + Overhead measurement Chadi Barakat- 18

19. 1- Sample of results: Precision vs Target Overhead When the sampling rates are optimally set for the edge solution Small flows are better captured by our method Chadi Barakat- 19 [Infocom 2011, ITC 2011, Presto@CoNEXT 2010]