Catálogo de publicaciones - libros

We present measurements of stream lifetimes for Internet traffic on a backbone link in California and a university link in Auckland. We investigate the consequences of sampling techniques such as ignoring streams with six or fewer packets, since they usually account for less than 10% of the total bytes. We find that we often observe large bursts of small ‘attack’ streams, which will diminish the integrity of strategies that ‘focus on the elephants’. Our observations further demonstrate the danger of traffic engineering approaches based on incorrect assumptions about the nature of the traffic.

We analyze delays of traceroute probes, i.e. packets that elicit ICMP TimeExceeded messages, for a full range of probe sizes up to 9000 bytes as observed on unloaded high-end routers. Our ultimate motivation is to use traceroute RTTs for Internet mapping of router and PoP (ISP point-of-presence) level nodes, including potentially gleaning information on equipment models, link technologies, capacities, latencies, and spatial positions. To our knowledge it is the first study to examine in a reliable testbed setting the detailed statistics of ICMP response generation.

We find that two fundamental assumptions about ICMP often do not hold in modern routers, namely that ICMP delays are a linear function of packet size and that ICMP generation rate is equal to the capacity of the inteface on which probes are received. The primary causes of these violations appear to be optimizations that suppress size dependence, e.g. buffer carving, and rate-limiting of internal ICMP packet and bit rates. Our results suggest that the linear model of packet delay as a function of packet size merits revisiting for many situations, especially for packets over 1500 bytes. Our findings also suggest possibilities of developing new techniques for bandwidth estimation and router fingerprinting.

With the lack of end-to-end QoS guarantees on existing networks, applications that require certain performance levels resort to periodic measurements of network paths. Typical metrics of interest are latency, bandwidth and loss rates. While the latency metric has been the focus of many research studies, the bandwidth metric has received comparatively little attention. In this paper, we report our bandwidth measurements between PlanetLab nodes and analyze various trends and insights from the data. For this work, we assessed the capabilities of several existing bandwidth measurement tools and describe the difficulties in choosing suitable tools as well as using them on PlanetLab.

In this paper we present results of a series of bandwidth estimation experiments conducted on a high-speed testbed at the San Diego Supercomputer Center and on OC-48 and GigE paths in real world networks. We test and compare publicly available bandwidth estimation tools: , , , and . We also tested which measures achievable TCP throughput. In the lab we used two different sources of known and reproducible cross-traffic in a fully controlled environment. In real world networks we had a complete knowledge of link capacities and had access to SNMP counters for independent cross-traffic verification. We compare the accuracy and other operational characteristics of the tools and analyze factors impacting their performance.

Accurate traffic classification is the keystone of numerous network activities. Our work capitalises on hand-classified network data, used as input to a supervised Bayes estimator. We illustrate the high level of accuracy achieved with a supervised Naïve Bayes estimator; with the simplest estimator we are able to achieve better than 83% accuracy on both a per-byte and a per-packet basis.

A number of key areas in IP network engineering, management and surveillance greatly benefit from the ability to dynamically identify traffic flows according to the applications responsible for their creation. Currently such classifications rely on selected packet header fields (e.g. destination port) or application layer protocol decoding. These methods have a number of shortfalls e.g. many applications can use unpredictable port numbers and protocol decoding requires high resource usage or is simply infeasible in case protocols are unknown or encrypted. We propose a framework for application classification using an unsupervised machine learning (ML) technique. Flows are automatically classified based on their statistical characteristics. We also propose a systematic approach to identify an optimal set of flow attributes to use and evaluate the effectiveness of our approach using captured traffic traces.

This extended abstract present findings on measured TCP performance of a range of network stacks. We have found that there are significant differences between the TCP implementations found in Linux, FreeBSD, OpenBSD and Windows XP.

While several algorithms have been created to actively measure the end-to-end available bandwidth of a network path, they require instrumentation at both ends of the path, and the traffic injected by these algorithms may affect the performance of other applications on the path. Our goal is to apply the self-induced congestion principle to passive traces of existing TCP traffic instead of actively probing the path. The primary challenge is that, unlike active algorithms, we have in the passive TCP traces. As part of the Wren bandwidth monitoring tool, we are developing techniques that use single-sided packet traces of existing application traffic to measure available bandwidth. In this paper, we describe our implementation of available bandwidth analysis using passive traces of TCP traffic and evaluate our approach using bursty traffic on a 100 Mb testbed.

The complexity of network systems and the heterogeneity of end systems will make networks increasingly difficult to manage. To understand the operational details of networks it is imperative that sufficient information on their behavior is available. This can be achieved through network measurement.

We have proposed a new TCP version, called ImTCP (Inline measurement TCP), in [1]. The ImTCP sender adjusts the transmission intervals of data packets, and then utilizes the arrival intervals of ACK packets for the estimation. This type of active measurement in a TCP connection (inline measurement) is preferred because it delivers measurement results that are as accurate as active measurement, even though no extra probe traffic is injected into the network. In the present research, we combine a new measurement function with the currently used measurement method to enable simultaneous measurement of both capacity and available bandwidth in ImTCP. The capacity measurement algorithm is essentially based on the packet pair technique, but also consider the estimated available bandwidth values for data filtering or data calculation, so that this algorithm promises better measurement results than current packet-pair-based measurement algorithms.