1. INTERNET MEASUREMENT INTERNET MAPPING OVERHEAD MINIMIZATION  Intra- and inter-monitor redundancy reduction IBRAHIM ETHEM COSKUN University of Nevada, Reno M.Sc.

2.  Detect ingress points of a target AS  Announced IP Subnets (routeviews)  Find which ingress point is passed through to reach an IP Subnet in the target AS  Directly start probing from ingresses  Analyze VPs to efficiently probe a target AS IDEA

3.  traceroute to 223.253.8.1 (223.253.8.1), 30 hops max, 60 byte packets 1 134.197.43.254 [AS3851/AS22911] 0.500 ms 0.964 ms 1.205 ms 2 10.252.1.245 [AS65534] 0.203 ms 0.434 ms 10.251.1.245 [AS65534] 0.184 ms 3 10.255.2.250 [AS65534] 0.907 ms 0.890 ms 10.255.1.250 [AS65534] 0.879 ms 4 134.197.0.9 [AS3851/AS22911] 1.118 ms 1.099 ms 1.090 ms 5 207.197.33.69 [AS3851] 1.082 ms 1.471 ms 1.461 ms 6 137.164.23.37 [AS2152] 4.360 ms 4.267 ms 4.261 ms 7 137.164.46.80 [AS2152] 4.289 ms 4.262 ms 4.303 ms 8 137.164.47.22 [AS2152] 6.807 ms 8.088 ms 6.773 ms 9 137.164.47.18 [AS2152] 7.586 ms 7.571 ms 7.562 ms 10 198.32.176.43 [AS4637] 22.041 ms 22.030 ms 22.014 ms 11 1.208.104.201 [AS55831] 22.007 ms 203.255.234.133 [AS3786] 21.561 ms 203.255.234.145 [AS3786] 21.547 ms 12 203.233.37.73 [AS3786] 166.076 ms 203.233.52.33 [AS3786] 165.376 ms 1.208.104.93 [AS55831] 166.261 ms 13 210.120.105.214 [AS3786] 167.341 ms 167.319 ms 1.208.107.218 [AS55831] 167.291 ms 14 211.53.168.214 [AS3786] 163.802 ms 168.335 ms 169.086 ms 15 124.243.3.221 [AS9842] 168.662 ms 168.297 ms 163.744 ms 16 223.253.3.29 [AS9842] 162.751 ms 157.928 ms 157.629 ms 17 223.253.3.6 [AS9842] 173.304 ms 173.295 ms 169.098 ms 18 223.253.8.1 [AS9842] 171.442 ms 177.999 ms 166.311 ms IGRESS POINT IDENTIFICATION

4.  Pick 12 ASes  Based on:  Sizes (#IPs), #Ingresses, #Peers, Ranks  1 small, 1 medium, 1 large  Probe these ASes from each VP AS ingress analysis

5.  SIZE (#IPs) SMALL, ASN: 65222, SIZE: 32 SIZE (#IPs) MID, ASN: 1301, SIZE: 9728 SIZE (#IPs) LARGE, ASN: 4134, SIZE: 120.840.448  INGRESS SMALL, ASN: 610, #Ingresses: 1 INGRESS MID, ASN: 4366, #Ingresses: 71 INGRESS LARGE, ASN: 701, #Ingresses: 2510  RANK SMALL, ASN: 9989, RANK: 9088 RANK MID, ASN: 9207, RANK: 8714 RANK LARGE, ASN: 3356, RANK: 1  PEER SMALL, ASN: 9253, #Peers: 1 PEER MID, ASN: 8697, #Peers: 34 PEER LARGE, ASN: 174, #Peers: 35737 AS ingress analysis

6.  Ingress point analysis  VP analysis How to reduce redundant probing?

7.  Pick 2 IPs from each prefix  First IP, Last IP  1.0.4.0/24 Ingress Analysis - Probing Mechanism 1.0.4.11.0.4.254 Probe these IPs If they enter the AS from the same ingress, then that means all IPs in this /24 subnet belongs to the same ingress. If they reveal different ingress points, then divide the subnet in two and continue probing each subnet.

8. Ingress Analysis - Probing Mechanism 1.0.4.0 First IP: 1.0.4.1 Last IP: 1.0.4.254 First IP: 1.0.4.1 Last IP: 1.0.4.126 First IP: 1.0.4.129 Last IP: 1.0.4.254 /24 Divide: 1.0.4.0 /25 || 1.0.4.128 /25 Ingress A Done! Ingress A Ingress B Continue Done! Ingress A Done! Ingress B 1.0.4.0 /25 Ingress B 1.0.4.128 /25 Ingress A

9.  Program probes every subnet that each AS announces  Program selects a subnet from the target AS's list randomly and probes first and last IPs of that subnet.  If the actual entrance point of the target AS cannot be identified, then the entrance point for the target AS is predicted. Ingress Analysis - Probing Mechanism

10.  Predicted Entrance Routers:  1.If the trace ends before revealing the target AS, and if there are some unresponsive hops: traceroute [(134.197.43.77:33456) -> (4.0.0.1:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 0.721 ms 0.701 ms 0.743 ms 2 10.251.1.245 0.481 ms 0.274 ms 0.274 ms 3 10.255.2.250 0.808 ms 0.787 ms 0.809 ms 4 134.197.0.9 1.874 ms 6.838 ms 4.437 ms 5 207.197.33.69 2.549 ms 1.121 ms 1.022 ms 6 137.164.23.37 3.993 ms 4.036 ms 7.202 ms 7 137.164.46.80 4.090 ms 4.057 ms 4.068 ms 8 137.164.47.22 6.578 ms 6.448 ms 6.471 ms 9 137.164.46.145 8.149 ms 7.953 ms 7.913 ms ---> predicted entrance router 10 * * * 11 * * * 12 * * *134.197.43.77:33456 Ingress Analysis - Probing Mechanism

11.  If the target AS is revealed, however some number of hops before the target did not respond then the entrance is predicted as the last responsive hop before the target: traceroute [(134.197.43.77:33456) -> (38.98.47.254:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 18.613 ms 0.793 ms 0.683 ms 2 10.251.1.245 0.276 ms 0.268 ms 0.274 ms 3 10.255.2.250 0.724 ms 0.737 ms 0.769 ms 4 134.197.0.9 0.922 ms 0.883 ms 0.879 ms 5 207.197.33.69 1.054 ms 1.082 ms 1.030 ms 6 207.197.17.101 19.446 ms 19.260 ms 19.430 ms 7 199.189.117.17 19.789 ms 19.985 ms 19.814 ms 8 199.189.116.249 20.514 ms 20.244 ms 20.492 ms 9 38.104.170.97 20.723 ms 20.730 ms 20.404 ms 10 154.24.35.245 21.409 ms 21.017 ms 21.208 ms 11 154.54.82.25 28.404 ms 30.726 ms 28.339 ms 12 154.54.47.166 27.910 ms 28.304 ms 27.947 ms ----> (ASN X) predicted entrance router 13 * * * 14 * * * 15 * * * 16 38.104.77.118 29.261 ms 28.980 ms 29.130 ms --- > (ASN T) Target AS revealed134.197.43.77:33456 Ingress Analysis - Probing Mechanism

12.  If the trace ends before revealing the target AS, and if there is no unresponsive hops at the end, then this is considered as "NO_ENTRANCE_INFO": traceroute [(134.197.43.77:33456) -> (206.192.120.3:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 0.730 ms 12.861 ms 0.677 ms 2 10.251.1.245 0.273 ms 0.272 ms 0.459 ms 3 10.255.2.250 0.822 ms 0.796 ms 0.764 ms 4 134.197.0.9 0.882 ms 0.963 ms 0.862 ms 5 207.197.33.69 1.073 ms 0.976 ms 1.051 ms 6 137.164.23.37 3.981 ms 4.002 ms 3.914 ms 7 137.164.46.80 4.073 ms 4.023 ms 4.161 ms 8 137.164.47.22 6.560 ms 6.477 ms 6.396 ms 9 137.164.47.174 7.340 ms 7.087 ms 7.276 ms 10 198.32.251.70 21.652 ms 21.820 ms 21.717 ms 11 184.105.213.178 90.337 ms 90.639 ms 140.444 ms 12 209.51.161.82 88.132 ms 88.042 ms 87.983 ms 13 216.235.224.6 88.029 ms 87.763 ms 88.084 ms 14 216.235.224.6 3096.839 ms !H 3046.738 ms !H 2996.631 ms !H 134.197.43.77:33456 Ingress Analysis - Probing Mechanism

13.  Tried to use 550 Planetlab Nodes  350 of the nodes are usable  Got results from only 225 Nodes  Utilized from Paris-traceroute Ingress Analysis - Probing Mechanism

14.  Some nodes do not allow users to use ‘sudo’ command through ssh connection  Nodes are not consistent  SSH connection to nodes was interrupted while getting the results  Nodes cannot SSH to our servers in UNR  Need to use a server outside the firewall of the UNR Campus PROBLEMS!

15. VP Node Name: 75-130-96-13.static.oxfr.ma.charter.com Target AS: 174 ENTR: 75.130.96.1 ENTR_AS: 20115 ENTR: 4.35.114.187 ENTR_AS: 3356 (Divided Subnet: 38.101.40.4/30) ENTR: 81.95.15.62 ENTR_AS: 33891 Target AS: 3356 ENTR: 204.70.196.234 ENTR_AS: 3561 very small amount ENTR: 130.215.7.242 ENTR_AS: 10326 Target AS: 701 ENTR: 154.54.12.46 ENTR_AS: 174 VP Node Name: ampelos.ipv6.lip6.fr Target AS: 3356 ENTR: 195.2.9.46 ENTR_AS: 1273 ENTR: 88.151.80.187 ENTR_AS: 39449 PRE_ENTR: 66.218.182.5 ENTR_AS: 33227 PRE_ENTR: 207.93.98.69 ENTR_AS: 33227 PRE_ENTR: 146.82.34.246 ENTR_AS: 3549 Target AS: 174 ENTR: 195.10.62.25 ENTR_AS: 1273 ENTR: 195.2.22.138 ENTR_AS: 1273 PARTIAL RESULTS

16. VP Node Name: planetlab1.net.in.tum.de Target AS: 701 ENTR: 4.68.62.138 ENTR_AS: 3356 ENTR: 64.215.195.114 ENTR_AS: 3549 very small amount VP Node Name: planetlab2.informatik.uni-erlangen.de Target AS: 174 ENTR: 188.1.144.185 ENTR_AS: 680 Target AS: 4134 ENTR: 4.53.210.210 ENTR_AS: 3356 ENTR: 4.71.136.102 ENTR_AS: 3356 VP Node Name: 75-130-96-12.static.oxfr.ma.charter.com Target AS: 4134 ENTR: 137.164.130.130 ENTR_AS: 11164 ENTR: 64.57.20.90 ENTR_AS: 11164 small amount PRE_ENTR: 219.158.100.197 ENTR_AS: 4837 PARTIAL RESULTS

17.  Probe target AS IPs starting from the entrance router of the target AS.  -f option of paris-traceroute allows to set the TTL value of the first packet  Reduce the redundant probing through target AS START PROBING FROM ENTRANCE ROUTER

18. Target IP VP 3 VP 2 VP 1 Entrance Point A Entrance Point B AS X AS Y AS T AS R AS Z Directly start probing from entrance points

19.  Ant Census Data  Starting in 2003, researchers at ISI have been collecting data about the Internet address space.  ~80.000.000 IP addresses that response to ping  Parse the data  Which IPs belong to which AS Subnets  Get the min hop number of the entrance point from the first probing results  Probe the target IP starting from the entrance router hop number START PROBING FROM ENTRANCE ROUTER

20.  Entrance Point Hop number:  traceroute [(75.130.96.12:33456) -> (1.204.0.1:33457)], protocol icmp, algo hopbyhop  1 75.130.96.1 0.524 ms 0.509 ms 0.551 ms  2 207.210.142.41 2.121 ms 2.453 ms 2.302 ms  3 192.5.89.21 3.704 ms 3.630 ms 3.593 ms  4 198.71.47.57 8.059 ms 8.020 ms 8.075 ms  5 64.57.20.196 14.226 ms 13.917 ms 13.998 ms  6 64.57.20.247 80.246 ms 80.318 ms 80.277 ms  7 137.164.130.130 84.451 ms 82.294 ms 84.126 ms  8 202.97.50.33 84.980 ms 82.220 ms 84.298 ms  9 202.97.58.225 360.122 ms 356.232 ms 349.381 ms  10 202.97.34.69 341.589 ms 343.422 ms 341.274 ms  11 * 202.97.33.193 340.538 ms 342.577 ms  12 202.97.69.98 378.073 ms 375.887 ms 377.994 ms  13 61.189.177.234 366.197 ms 361.223 ms 361.012 ms ------ > Entrance IP(AS -X) Hop Number: 13  14 1.204.0.1 349.854 ms * 349.524 ms --------- > Target IP(AS -T) START PROBING FROM ENTRANCE ROUTER

21. VP analysis Target AS Ingress router VP Target AS Other ASes

22. ? QUESTIONS?