internet measurement internet mapping overhead minimization intra- and inter-monitor redundancy...
TRANSCRIPT
INTERNET MEASUREMENT
INTERNET MAPPING OVERHEAD MINIMIZATION
Intra- and inter-monitor redundancy reduction
IBRAHIM ETHEM COSKUNUniversity of Nevada, RenoM.Sc.
Detect ingress points of a target AS Announced IP Subnets (routeviews) Find which ingress point is passed through to
reach an IP Subnet in the target AS Directly start probing from ingresses Analyze VPs to efficiently probe a target AS
IDEA
traceroute to 223.253.8.1 (223.253.8.1), 30 hops max, 60 byte packets 1 134.197.43.254 [AS3851/AS22911] 0.500 ms 0.964 ms 1.205 ms 2 10.252.1.245 [AS65534] 0.203 ms 0.434 ms 10.251.1.245 [AS65534] 0.184 ms 3 10.255.2.250 [AS65534] 0.907 ms 0.890 ms 10.255.1.250 [AS65534] 0.879 ms 4 134.197.0.9 [AS3851/AS22911] 1.118 ms 1.099 ms 1.090 ms 5 207.197.33.69 [AS3851] 1.082 ms 1.471 ms 1.461 ms 6 137.164.23.37 [AS2152] 4.360 ms 4.267 ms 4.261 ms 7 137.164.46.80 [AS2152] 4.289 ms 4.262 ms 4.303 ms 8 137.164.47.22 [AS2152] 6.807 ms 8.088 ms 6.773 ms 9 137.164.47.18 [AS2152] 7.586 ms 7.571 ms 7.562 ms10 198.32.176.43 [AS4637] 22.041 ms 22.030 ms 22.014 ms11 1.208.104.201 [AS55831] 22.007 ms 203.255.234.133 [AS3786] 21.561 ms 203.255.234.145 [AS3786] 21.547 ms12 203.233.37.73 [AS3786] 166.076 ms 203.233.52.33 [AS3786] 165.376 ms 1.208.104.93 [AS55831] 166.261 ms13 210.120.105.214 [AS3786] 167.341 ms 167.319 ms 1.208.107.218 [AS55831] 167.291 ms14 211.53.168.214 [AS3786] 163.802 ms 168.335 ms 169.086 ms15 124.243.3.221 [AS9842] 168.662 ms 168.297 ms 163.744 ms16 223.253.3.29 [AS9842] 162.751 ms 157.928 ms 157.629 ms17 223.253.3.6 [AS9842] 173.304 ms 173.295 ms 169.098 ms18 223.253.8.1 [AS9842] 171.442 ms 177.999 ms 166.311 ms
IGRESS POINT IDENTIFICATION
Pick 12 ASes Based on:
Sizes (#IPs), #Ingresses, #Peers, Ranks 1 small, 1 medium, 1 large Probe these ASes from each VP
AS ingress analysis
SIZE (#IPs) SMALL, ASN: 65222, SIZE: 32SIZE (#IPs) MID, ASN: 1301, SIZE: 9728SIZE (#IPs) LARGE, ASN: 4134, SIZE: 120.840.448
INGRESS SMALL, ASN: 610, #Ingresses: 1INGRESS MID, ASN: 4366, #Ingresses: 71INGRESS LARGE, ASN: 701, #Ingresses: 2510
RANK SMALL, ASN: 9989, RANK: 9088RANK MID, ASN: 9207, RANK: 8714RANK LARGE, ASN: 3356, RANK: 1
PEER SMALL, ASN: 9253, #Peers: 1PEER MID, ASN: 8697, #Peers: 34PEER LARGE, ASN: 174, #Peers: 35737
AS ingress analysis
Ingress point analysis VP analysis
How to reduce redundant probing?
Pick 2 IPs from each prefix First IP, Last IP 1.0.4.0/24
Ingress Analysis - Probing Mechanism
1.0.4.1 1.0.4.254Probe these IPs • If they enter the AS from the same ingress, then that means all IPs in this /24 subnet belongs tothe same ingress.• If they reveal different ingress points, then divide the subnet in two and continue probing each subnet.
Ingress Analysis - Probing Mechanism
1.0.4.0
First IP: 1.0.4.1
Last IP: 1.0.4.254
First IP:1.0.4.1
Last IP:1.0.4.126
First IP:1.0.4.129
Last IP:1.0.4.254
/24
Divide: 1.0.4.0 /25 || 1.0.4.128 /25
Ingress AIngress A Done!
Ingress A
Ingress B
Continue
Done!
Ingress A
Done!
Ingress B
1.0.4.0 /25 Ingress B
1.0.4.128 /25 Ingress A
Program probes every subnet that each AS announces
Program selects a subnet from the target AS's list randomly and probes first and last IPs of that subnet.
If the actual entrance point of the target AS cannot be identified, then the entrance point for the target AS is predicted.
Ingress Analysis - Probing Mechanism
Predicted Entrance Routers: 1.If the trace ends before revealing the target AS, and if there are some unresponsive hops:
traceroute [(134.197.43.77:33456) -> (4.0.0.1:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 0.721 ms 0.701 ms 0.743 ms 2 10.251.1.245 0.481 ms 0.274 ms 0.274 ms 3 10.255.2.250 0.808 ms 0.787 ms 0.809 ms 4 134.197.0.9 1.874 ms 6.838 ms 4.437 ms 5 207.197.33.69 2.549 ms 1.121 ms 1.022 ms 6 137.164.23.37 3.993 ms 4.036 ms 7.202 ms 7 137.164.46.80 4.090 ms 4.057 ms 4.068 ms 8 137.164.47.22 6.578 ms 6.448 ms 6.471 ms 9 137.164.46.145 8.149 ms 7.953 ms 7.913 ms ---> predicted entrance router10 * * *11 * * *12 * * *
Ingress Analysis - Probing Mechanism
If the target AS is revealed, however some number of hops before the target did not respond then the entrance is predicted as the last responsive hop before the target:traceroute [(134.197.43.77:33456) -> (38.98.47.254:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 18.613 ms 0.793 ms 0.683 ms 2 10.251.1.245 0.276 ms 0.268 ms 0.274 ms 3 10.255.2.250 0.724 ms 0.737 ms 0.769 ms 4 134.197.0.9 0.922 ms 0.883 ms 0.879 ms 5 207.197.33.69 1.054 ms 1.082 ms 1.030 ms 6 207.197.17.101 19.446 ms 19.260 ms 19.430 ms 7 199.189.117.17 19.789 ms 19.985 ms 19.814 ms 8 199.189.116.249 20.514 ms 20.244 ms 20.492 ms 9 38.104.170.97 20.723 ms 20.730 ms 20.404 ms 10 154.24.35.245 21.409 ms 21.017 ms 21.208 ms 11 154.54.82.25 28.404 ms 30.726 ms 28.339 ms 12 154.54.47.166 27.910 ms 28.304 ms 27.947 ms ----> (ASN X) predicted entrance router13 * * *14 * * *15 * * *16 38.104.77.118 29.261 ms 28.980 ms 29.130 ms --- > (ASN T) Target AS revealed
Ingress Analysis - Probing Mechanism
If the trace ends before revealing the target AS, and if there is no unresponsive hops at the end, then this is considered as "NO_ENTRANCE_INFO":traceroute [(134.197.43.77:33456) -> (206.192.120.3:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 0.730 ms 12.861 ms 0.677 ms 2 10.251.1.245 0.273 ms 0.272 ms 0.459 ms 3 10.255.2.250 0.822 ms 0.796 ms 0.764 ms 4 134.197.0.9 0.882 ms 0.963 ms 0.862 ms 5 207.197.33.69 1.073 ms 0.976 ms 1.051 ms 6 137.164.23.37 3.981 ms 4.002 ms 3.914 ms 7 137.164.46.80 4.073 ms 4.023 ms 4.161 ms 8 137.164.47.22 6.560 ms 6.477 ms 6.396 ms 9 137.164.47.174 7.340 ms 7.087 ms 7.276 ms 10 198.32.251.70 21.652 ms 21.820 ms 21.717 ms 11 184.105.213.178 90.337 ms 90.639 ms 140.444 ms 12 209.51.161.82 88.132 ms 88.042 ms 87.983 ms 13 216.235.224.6 88.029 ms 87.763 ms 88.084 ms 14 216.235.224.6 3096.839 ms !H 3046.738 ms !H 2996.631 ms !H
Ingress Analysis - Probing Mechanism
Tried to use 550 Planetlab Nodes 350 of the nodes are usable Got results from only 225 Nodes Utilized from Paris-traceroute
Ingress Analysis - Probing MechanismIngress Analysis - Probing Mechanism
Some nodes do not allow users to use ‘sudo’ command through ssh connection
Nodes are not consistent SSH connection to nodes was interrupted while
getting the results Nodes cannot SSH to our servers in UNR Need to use a server outside the firewall of the
UNR Campus
PROBLEMS!
VP Node Name: 75-130-96-13.static.oxfr.ma.charter.com
Target AS: 174 ENTR: 75.130.96.1 ENTR_AS: 20115
ENTR: 4.35.114.187 ENTR_AS: 3356 (Divided Subnet: 38.101.40.4/30)
ENTR: 81.95.15.62 ENTR_AS: 33891
Target AS: 3356 ENTR: 204.70.196.234 ENTR_AS: 3561 very small amount
ENTR: 130.215.7.242 ENTR_AS: 10326
Target AS: 701 ENTR: 154.54.12.46 ENTR_AS: 174
VP Node Name: ampelos.ipv6.lip6.fr
Target AS: 3356 ENTR: 195.2.9.46 ENTR_AS: 1273
ENTR: 88.151.80.187 ENTR_AS: 39449
PRE_ENTR: 66.218.182.5 ENTR_AS: 33227
PRE_ENTR: 207.93.98.69 ENTR_AS: 33227
PRE_ENTR: 146.82.34.246 ENTR_AS: 3549
Target AS: 174 ENTR: 195.10.62.25 ENTR_AS: 1273
ENTR: 195.2.22.138 ENTR_AS: 1273
PARTIAL RESULTS
VP Node Name: planetlab1.net.in.tum.de
Target AS: 701 ENTR: 4.68.62.138 ENTR_AS: 3356
ENTR: 64.215.195.114 ENTR_AS: 3549 very small amount
VP Node Name: planetlab2.informatik.uni-erlangen.de
Target AS: 174 ENTR: 188.1.144.185 ENTR_AS: 680
Target AS: 4134 ENTR: 4.53.210.210 ENTR_AS: 3356
ENTR: 4.71.136.102 ENTR_AS: 3356
VP Node Name: 75-130-96-12.static.oxfr.ma.charter.com
Target AS: 4134 ENTR: 137.164.130.130 ENTR_AS: 11164
ENTR: 64.57.20.90 ENTR_AS: 11164 small amount
PRE_ENTR: 219.158.100.197 ENTR_AS: 4837
PARTIAL RESULTS
Probe target AS IPs starting from the entrance router of the target AS.
-f option of paris-traceroute allows to set the TTL value of the first packet
Reduce the redundant probing through target AS
START PROBING FROM ENTRANCE ROUTER
START PROBING FROM ENTRANCE ROUTER
Target IP
VP 3
VP 2
VP 1
EntrancePoint A
EntrancePoint B
AS X
AS Y AS T
AS RAS Z Directly start probing
from entrance points
Ant Census Data Starting in 2003, researchers at ISI have been
collecting data about the Internet address space. ~80.000.000 IP addresses that response to ping
Parse the data Which IPs belong to which AS Subnets Get the min hop number of the entrance point from the
first probing results Probe the target IP starting from the entrance router
hop number
START PROBING FROM ENTRANCE ROUTER
Entrance Point Hop number: traceroute [(75.130.96.12:33456) -> (1.204.0.1:33457)], protocol icmp, algo hopbyhop 1 75.130.96.1 0.524 ms 0.509 ms 0.551 ms 2 207.210.142.41 2.121 ms 2.453 ms 2.302 ms 3 192.5.89.21 3.704 ms 3.630 ms 3.593 ms 4 198.71.47.57 8.059 ms 8.020 ms 8.075 ms 5 64.57.20.196 14.226 ms 13.917 ms 13.998 ms 6 64.57.20.247 80.246 ms 80.318 ms 80.277 ms 7 137.164.130.130 84.451 ms 82.294 ms 84.126 ms 8 202.97.50.33 84.980 ms 82.220 ms 84.298 ms 9 202.97.58.225 360.122 ms 356.232 ms 349.381 ms 10 202.97.34.69 341.589 ms 343.422 ms 341.274 ms 11 * 202.97.33.193 340.538 ms 342.577 ms 12 202.97.69.98 378.073 ms 375.887 ms 377.994 ms 13 61.189.177.234 366.197 ms 361.223 ms 361.012 ms ------ > Entrance IP(AS -X) Hop Number: 13 14 1.204.0.1 349.854 ms * 349.524 ms --------- > Target IP(AS -T)
START PROBING FROM ENTRANCE ROUTER
VP analysis
TargetAS
Ingress router
VP
Target AS
Other ASes
?QUESTIONS?