Search

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2007.04.004 Byline: Baek-Young Choi (a), Sue Moon (b), Zhi-Li Zhang (c), Konstantina Papagiannaki (d), Christophe Diot (e) Keywords: Delay; ECMP; Operational network Abstract: In this paper, we perform a detailed analysis of point-to-point packet delay in an operational tier-1 network. The point-to-point delay is the time experienced by a packet from an ingress to an egress point in an ISP, and it provides the most basic information regarding the delay performance of the ISP's network. Using packet traces captured in the operational network, we obtain precise point-to-point packet delay measurements and analyze the various factors affecting them. Through a simple, step-by-step, systematic methodology and careful data analysis, we identify the major network factors that contribute to point-to-point packet delay and characterize their effect on the network delay performance. Our findings are: (1) delay distributions vary greatly in shape, depending on the path and link utilization; (2) after constant factors dependent only on the path and packet size are removed, the 99th percentile variable delay remains under 1ms over several hops and under link utilization below 90% on a bottleneck; (3) a very small number of packets experience very large delay in short bursts. Author Affiliation: (a) University of Missouri, Kansas City, MO, United States (b) Korea Advanced Institute of Science and Technology, Daejeon, Republic of Korea (c) University of Minnesota, Twin Cities, MN, United States (d) Intel Research, Cambridge, United Kingdom (e) Thomson Research, Paris, France Article History: Received 1 April 2006; Revised 29 November 2006; Accepted 4 April 2007 Article Note: (footnote) [star] An earlier version of this paper was presented in the proceedings of Infocom'04.

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2006.11.023 Byline: Baek-Young Choi (a), Sue Moon (b), Rene Cruz (c), Zhi-Li Zhang (d), Christophe Diot (e) Keywords: Delay; Performance monitoring; Active probing Abstract: Point-to-point delay is an important network performance measure as it captures service degradations caused by various events. We study how to measure and report delay in a concise and meaningful way for an ISP, and how to monitor it efficiently. We analyze various measurement intervals and potential metric definitions. We find that reporting high quantiles (between 0.95 and 0.99) every 10-30min as the most effective way to summarize the delay in an ISP. We then propose an active probing scheme to estimate a high quantile with bounded error. We show that only a small number of probes are sufficient to provide an accurate estimate. We validate the proposed delay monitoring technique on real data collected on the Sprint IP backbone network. To make our work complete, we lastly compare the overhead of our active probing technique with a passive sampling scheme and show that for delay measurement, active probing is more practical. Author Affiliation: (a) Department of Computer Science and Electrical Engineering, University of Missouri, 5100 Rockhill Road, Kansas City, MO 64110, United States (b) Korea Advanced Institute of Science and Technology, Daejeon, Republic of Korea (c) University of California, San Diego, CA, United States (d) University of Minnesota, Twin Cities, MN, United States (e) Thomson Research, Paris, France Article History: Received 30 June 2006; Revised 30 October 2006; Accepted 23 November 2006 Article Note: (miscellaneous) Responsible Editor: Gunnar Karlsson

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2006.03.003 Byline: Yingfei Dong (a), Changho Choi (b), Zhi-Li Zhang (b) Keywords: Network security; Unwanted traffic; IP spoofing; Packet authentication Abstract: One of key security issues on the current Internet is unwanted traffic, the forerunner of unauthorized accesses, scans, and attacks. It is vitally important but extremely challenging to fight such unwanted traffic. We need a series of defensive mechanisms to identify unwanted packets, filter them out, and further defeat their associated attacks. In this paper, we propose a lightweight, scalable packet authentication mechanism, named Lightweight Internet Permit System (LIPS), as a first line of defense to effectively filter out the most common forms of unwanted traffic, spoofed and unsolicited packets, such that in-depth security schemes can take care of the remaining issues more efficiently. LIPS is a simple extension of IP, in which each packet carries an access permit issued by its destination host or gateway, and the destination verifies the access permit to determine to accept or drop the packet. LIPS provides preliminary traffic-origin accountability that supports two salient features to confine unwanted traffic: (1) filter out the most common forms of unwanted packets and defeat associated attacks; (2) help us identify compromised hosts/domains such that we are able to build active defense schemes to deal with various attacks through real-time inter-domain collaboration. In this paper, we first present the design and prototype implementation of LIPS on Linux 2.4 kernel, and then use analysis, simulations, and experiments to demonstrate the efficacy of LIPS in protecting critical resources with light overheads. Author Affiliation: (a) Department of Electrical and Computer Engineering, University of Hawaii, Honolulu, HI 96822, United States (b) Department of Computer Science, University of Minnesota, Minneapolis, MN 55455, United States Article History: Received 13 June 2005; Revised 20 December 2005; Accepted 3 March 2006 Article Note: (footnote) [star] This work was supported in part by the National Science Foundation under the grants ANI-0073819, ITR-0085824, CNS 0435444, and CAREER Award NCR-9734428. Any opinions, findings, and conclusions or recommendations expressed in this paper are those of the authors and do not necessarily reflect the views of NSF.

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2004.11.012 Byline: Vinay J. Ribeiro (a), Zhi-Li Zhang (b), Sue Moon (c), Christophe Diot (d) Abstract: We perform an extensive wavelet analysis of Internet backbone traffic traces to observe and understand the causes of small-time scaling phenomena present in them. We observe that for a majority of the traces, the second-order scaling exponents at small time scales (1-100ms) are fairly close to 0.5, indicating that traffic fluctuations at these time scales are nearly uncorrelated. Some traces, however, do exhibit moderately large scaling exponents ([approximately equal to]0.7) at small time scales. In addition, the traces manifest mostly monofractal behaviors at small time scales. To identify the network causes of the observed scaling behavior, we analyze the flow composition of the traffic along two dimensions -- flow byte contribution and flow density. Our study points to the dense flows (i.e., flows with densely clustered packets) as the correlation-causing factor in small time scales, and reveals that the traffic composition in terms of proportions of dense vs. sparse flows plays a major role in influencing the small-time scalings of aggregate traffic. Since queuing inside routers is influenced by traffic fluctuations at small time-scales, our observations and results have important implications for networking modeling, service provisioning and traffic engineering. Author Affiliation: (a) Department of Electrical and Computer Engineering, Rice University, 6100 Main Street, Houston, TX 77005, USA (b) Department of Computer Science, University of Minnesota, 200 Union Street S.E., Minneapolis, MN 55455-0159, USA (c) Department of Computer Science, KAIST, Guseong-Dong, Yuseong-Gu, Daejeon 305-701, South Korea (d) Intel Research, 15 JJ Thomson Av., Cambridge CB3 0FD, UK Article Note: (footnote) [star] The majority of this work was conducted while the authors were at Sprint Advanced Technologies Laboratories.