{"title":"Implementation and Evaluation of a Protocol for Detecting Network-Wide Threshold Crossing Alerts","authors":"F. Wuhib, R. Stadler, A. Clemm","doi":"10.1109/E2EMON.2006.1651278","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651278","url":null,"abstract":"Threshold crossing alerts (TCAs) indicate to a management system that a management variable, associated with the state, performance or health of the network, has crossed a certain threshold. In this paper, we report on implementing and evaluating TCA-GAP, a distributed protocol for detecting network-wide TCAs, which reports threshold crossings on aggregates, such as SUM, AVERAGE, or MAX of device counters. We present a concept for assessing the quality of detecting network-wide TCAs, which we apply to evaluate TCA-GAP on a lab testbed. First, we evaluate the correctness of the protocol by determining the correctly detected threshold crossings, the false positives and the false negatives. Second, for the correctly detected threshold crossings, we measure the delays between the time a crossing was reported by the protocol and the time of its actual occurrence. Finally, we demonstrate that the fundamental tradeoff between the quality of TCA detection and the management overhead can be controlled in TCA-GAP by modifying the maximum message rate on the management overlay.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"19 7","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120814372","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Object-Relational DBMS for Packet-Level Traffic Analysis: Case Study on Performance Optimization","authors":"M. Siekkinen, E. Biersack, V. Goebel","doi":"10.1109/E2EMON.2006.1651274","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651274","url":null,"abstract":"Analyzing Internet traffic at packet level involves generally large amounts of raw data, derived data, and results from various analysis tasks. In addition, the analysis often proceeds in an iterative manner and is done using ad-hoc methods and many specialized software tools. These facts together lead to severe management problems that we propose to address using a DBMS-based approach, called In TraBase. The challenge that we address in this paper is to have such a database system (DBS) that allows to perform analysis efficiently. Off-the-shelf DBMSs are often considered too heavy and slow for such usage because of their complex transaction management properties that are crucial for the usage that they were originally designed for. We describe in this paper the design choices for a generic DBS for packet-level traffic analysis that enable good performance and describe how we implement them in the case of the InTraBase. Furthermore, we demonstrate their importance through performance measurements on the InTraBase. These results provide valuable insights for researchers who intend to utilize a DBMS for packet-level traffic analysis.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116749070","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Active Probing Approach for Fault Localization in Computer Networks","authors":"M. Natu, A. Sethi","doi":"10.1109/E2EMON.2006.1651276","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651276","url":null,"abstract":"Active probing is an active network monitoring technique that has potential for developing effective solutions for fault localization. In this paper we use active probing to present an approach to develop tools for performing fault localization. We discuss various design issues involved and propose architecture for building such a tool. We describe an algorithm for probe set selection for problem detection and present simulation results to show its effectiveness. We demonstrate through analysis and experiments that active probing has the potential to greatly reduce the probe traffic and the fault diagnosis time.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129969473","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Y. Won, Byungchul Park, Hong-Taek Ju, Myung-Sup Kim, J. W. Hong
{"title":"A Hybrid Approach for Accurate Application Traffic Identification","authors":"Y. Won, Byungchul Park, Hong-Taek Ju, Myung-Sup Kim, J. W. Hong","doi":"10.1109/E2EMON.2006.1651273","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651273","url":null,"abstract":"The traffic dynamics of the Internet's dominant applications, such as peer-to-peer and multimedia, worsen the accuracy of the existing application traffic identification. There is a strong need for both practical and reliable identification methods with proof of accuracy. This paper proposes a hybrid approach of signature matching and session behavior mapping methods for accurate application traffic identification. In particular, the paper explores a priority-based signature matching scheme on early packet samples to replace conventional signature matching. It then uses session relationships to identify application traffic from the remaining, unidentified traffic. In validation, we present the accuracy analysis of applications using the Port Dependency Ratio (PDR) method for simulated traffic as well as real traffic.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133396675","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Classification Scheme for Evaluating Management Instrumentation in Distributed Middleware Infrastructure","authors":"F. Karim, Harish Thanneer","doi":"10.1109/E2EMON.2006.1651279","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651279","url":null,"abstract":"Management instrumentation is an integrated capability of a software system that enables an external observer to monitor the system's availability, performance, and reliability during operation. It is highly useful for taking both proactive and reactive actions to keep a software system operational in mission-critical environments where tolerance for an unavailable or poor-performing system is very low. Middleware infrastructure components have taken important positions in distributed software systems due to various benefits related to the development, deployment, and runtime operations. Keeping these components highly available and up to the expected performance requires integrated capabilities that allow regular monitoring of critical functionality, measurement of Quality of Service (QoS), debugging and troubleshooting, and health-checks in the context of actual business processes.. Yet, currently there is no approach that enables systematic evaluation of the relative strengths and weaknesses of a middleware component's management instrumentation. In this paper, we will present an approach to evaluating management instrumentation of middleware infrastructure components. We use a classification-based scheme that has a functional dimension called Capability and two main quality dimensions called Usability and Precision. We further categorize each dimension into smaller, more precise instrumentation features, such as Tracing, Distributed Correlation and Granularity. In presenting our approach, we hope to achieve the following: i) educate middleware users on how to systematically assess or compare the overall manageability of a MidIn component using the classification scheme, and ii) share with middleware researchers on the importance of good integrated manageability in middleware infrastructure.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"os-54 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127844357","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"How to Identify the Speed Limiting Factor of a TCP Flow","authors":"Mark Timmer, P. Boer, A. Pras","doi":"10.1109/E2EMON.2006.1651275","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651275","url":null,"abstract":"Despite the end of the Internet bubble, operators continue to increase the capacity of their networks. The question now rises whether these improvements still result in faster communications, or whether most flows are limited by other aspects. In order to answer this question, actual network traffic needs to be analyzed. Therefore, in this paper methods are proposed to identify the factors that limit the speed of TCP flows. Three main categories will be distinguished: the network, the TCP buffers and the application layer. Our proposed methods have been tested on real traces; in many cases it turned out that the network was not the limiting factor.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132007920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"PPrate: A Passive Capacity Estimation Tool","authors":"T. En-Najjary, G. Urvoy-Keller","doi":"10.1109/E2EMON.2006.1651283","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651283","url":null,"abstract":"Knowledge of link capacities is essential, e.g., for ISPs to troubleshoot paths outside the boundaries of their networks. However, the vast majority of capacity measurement tools are based on active probing, which is not suitable for large scale studies of Internet paths characteristics. In this paper we present PPrate, a completely passive tool, that can extract capacity information of a path from the packet trace of a TCP connection. We validate PPrate using synthetic traces and real traces collected on PlanetLab. We compare PPrate with Pathrate, which is very accurate active tool, and show that they perform comparably. We finally apply PPrate on a large publicly available ADSL trace.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117080228","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Implementation and evaluation of an inline network measurement algorithm and its application to TCP-based service","authors":"Tomoaki Tsugawa, G. Hasegawa, M. Murata","doi":"10.1109/E2EMON.2006.1651277","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651277","url":null,"abstract":"In our previous studies, we proposed ImTCP, an inline network measurement technique that can obtain available bandwidth information of the network path between sender and receiver hosts continuously and in an inline fashion. We also introduced ImTCP-bg, a background TCP data transfer mechanism based on the measurement results of ImTCP. In the present paper, we report implementation issues of the proposed mechanisms on a FreeBSD system and evaluate them on an experiment network and in the actual Internet. We investigate the performance through the extensive experiments and verify that ImTCP can measure well the available bandwidth of the network path, independent of the degree of its change, and that ImTCP-bg can utilize the available bandwidth well, without degrading the performance of competing traffic. From these experiment results, we confirm the effectiveness of our concept, which is the inline network measurement technique, in an actual network.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125568597","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Tuning the Temporal Characteristics of a Kalman-Filter Method for End-to-End Bandwidth Estimation","authors":"E. Hartikainen, S. Ekelin","doi":"10.1109/E2EMON.2006.1651280","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651280","url":null,"abstract":"In this paper we present a way of tuning the temporal characteristics of a new available-bandwidth estimation method, BART. The estimation engine in this method is Kalman-filter based. A current estimate of the available bandwidth is maintained, and for each new sequence of probe packet pairs an updated estimate is produced. The main input parameters needed by the Kalman filter are the variance of the measurement noise and the covariance of the process noise. The former is measured by the method, whereas the latter is not in general attainable by analytical or empirical investigation. Instead, it is reasonable to treat this as a tunable parameter. We discuss how the temporal characteristics of the tracking of end-to-end available bandwidth may be tuned.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"167 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130070417","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"ICIM: An Inline Network Measurement Mechanism for Highspeed Networks","authors":"C. Man, G. Hasegawa, M. Murata","doi":"10.1109/E2EMON.2006.1651281","DOIUrl":"https://doi.org/10.1109/E2EMON.2006.1651281","url":null,"abstract":"In high-speed networks, such as 1-Gbps or higher networks, bandwidth measurement algorithms that utilize packet transmission/arrival intervals, such as packet trains and packet pairs, have a number of problems. First, network measurement for large bandwidth requires short packet transmission intervals, which causes a heavy load on the CPU. Second, network interface cards for high-speed networks usually employ Interrupt Coalescence (IC), which rearranges the arrival intervals of packets and causes bursty transmission of packets. In the present study, we introduce ICIM (Interrupt Coalescence-aware inline measurement), a new bandwidth measurement approach that overcomes these two problems. ICIM utilizes the data packets of an active TCP connection for the measurement. In order to determine the available bandwidth, rather than adjusting the packet transmission intervals, the TCP sender instead adjusts the number of packets involved in a burst and checks whether the inter-intervals of the bursts of corresponding ACK packets are increased or not. Simulation results show that ICIM can measure the bandwidth as high as some Gbps while requiring a number of data packets that is only 1/100 of that of the existing stream-based algorithm.","PeriodicalId":143580,"journal":{"name":"2006 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services","volume":"162 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2006-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123262475","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}