Active Probing

1
Active Probing

• Using Packet-Pair Probing to Estimate Packet Size
  and Arrival Rate

PhD Student Ana Novak Supervisors Prof Peter
Taylor Dr Darryl Veitch Melbourne University
2
IntroductionConcept of a Packet
NAME Billy Bob
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
Billy Bob
Sarah Jo
3
IntroductionConcept of a Packet
NAME Billy Bob
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
DEPO
NAME Billy Bob
Billy Bob
Sarah Jo
NAME Billy Bob
4
IntroductionConcept of a Packet
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
DEPO
EMAIL billybob_at_hotmail.com
Billy Bob
Sarah Jo
NAME Billy Bob
EMAIL billybob_at_hotmail.com
5
IntroductionConcept of a Packet
MESSAGE How are you today Sarah Jo?
DEPO
MESSAGE How are yo today Sara
Billy Bob
Sarah Jo
NAME Billy Bob
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
6
Fundamental Approaches to Measurement

• Passive measurement
• Monitoring
• Typically at a point
• Non-invasive
• Network authority

• Active measurement
• Injecting artificial traffic stream
• End-to-End
• Fundamentally invasive
• Non-privileged users

7
Active Probing Infrastructure
8
Timestamps

• Sender Monitor timestamps probe arrivals to the
  network.
• Receiver Monitor timestamps probe departures from
  the network.

Sender
Receiver
Sender Monitor
Receiver Monitor
9
Timestamps

• As the clocks on the sender and receiver monitors
  may not be
• synchronized we use inter-arrival and
  inter-departure times, rather
• then the end-to-end delays.

10
Single Hop Model

• Description of the 1-hop system
• Service is offered in a FIFO order.
• The server processes at rate .

11
Probe Traffic Cross Traffic

• Definitions
• Probe Traffic (PT) is an artificial stream of
  traffic, all of whose properties are known
  and can be modified and controlled.
• Cross Traffic (CT) is any traffic in the Internet
  that is not Probe Traffic.

12
Types of CT Arrivals

• Single Channel (M/D/1 output)
• Multi Channel (Poisson)

13
Types of Probe Traffic
Packet-Pair Pairs of probes are sent
periodically with period T, intra-pair spacing
r and packet service time xp.
14
Estimating Cross Traffic Size
Single Channel (M/D/1 output)

• Lets construct the following experiment
• Inject a packet-pair probe stream into the
  network s.t. probes are back-to-back and
  , where xc is the CT service time.
• Output of the experiment
• Probes capture 1 or 0 CT packets.

15
Estimating Cross Traffic Size
Single Channel (M/D/1 output)

• Cross Traffic packet size estimate

where is the i-th inter-departure time,
is the probe service time and
is the link rate.
16
Estimating CT SizeExample
Single Channel (M/D/1 output)

• Cross Traffic sizes 100B, 500B, 1000B, 1500B
• Respective arrival rates 600pkt/s, 100pkt/s,
  300pkt/s, 800pkt/s
• Other parameters Link rate 2MBps Cross
  Traffic packet size 1000B Probes packet size
  40B Probe rate 10pkt/s Probe separation 10ms

17
Estimating CT SizeExample
Single Channel (M/D/1 output)

• Cross Traffic sizes 100B, 500B, 1000B, 1500B
• Respective arrival rates 600pkt/s, 100pkt/s,
  300pkt/s, 800pkt/s
• Other parameters Link rate 2MBps Cross
  Traffic packet size 1000B Probes packet size
  40B Probe rate 10pkt/s Probe separation
  0.0001s

18
Estimating CT Arrival Rate(Assumption Single CT
size)
Method 1 Back-to-back probes M/D/1 Method 2
Back-to-back probes Poisson Method 3 Not
back-to-back probes Poisson
19
Method 1 Back-to-back probes
Single Channel (M/D/1 output)
Incentive Exploit the same probe stream used for
estimating Cross Traffic size. Recap. Experiment
Inject a stream of n packet-pairs into the
network with back-to-back probes (array of
inter-arrival times) Recap. Outcome Array of
inter-departure times corresponding to catching 1
CT packet (success) or 0 CT packets
(failure). Model Numerical outcome of the
experiment is a r.v. Y with a Binomial
distribution, B(n,p)
20
Method 1 Back-to-back probes
Single Channel (M/D/1 output)

• Cross Traffic arrival rate estimate in pkt/s

• For large values of n, if experimental value of Y
  is y, the 95.4 confidence interval for arrival
  rate estimate is

21
Method 1 Back-to-back probes
Single Channel (M/D/1 output)
Predicted confidence interval

• Example
• xc 0.9ms
• CT a.r. 1000 pkt/s
• n 1000 p-p
• best c.i /- 10

22
Method 2 Back-to-back probes
Multi Channel (Poisson)
Mathematical Incentive Rectify the problem of
obtaining very low probabilities of packet
capture, which result in a large confidence
interval for arrival rate estimate (eliminate the
upper bound ). Physical
Incentive CT Traffic can be better approximated
with a multi-channel (Poisson) arrivals. Experimen
t Inject a stream of n packet-pairs into the
network with back-to-back probes (array of
inter-arrival times).
23
Method 2 Back-to-back probes
Multi Channel (Poisson)
Outcome Array of inter-departure times
corresponding to capturing m packets in an
interval of length r.
Model Numerical outcome of the experiment is a
r.v. Y with a Poisson distribution, .
24
Method 2 Back-to-back probes
Multi Channel (Poisson)

• The probability of capturing m packets in an
  interval of length r

• The sample average is the MLE of
• where

25
Method 2 Back-to-back probes
Multi Channel (Poisson)

• Respective exact 95 confidence interval is
• where is the inverse of the chi-square
  cumulative distribution function.

26
Method 2 Back-to-back probes
Multi Channel (Poisson)
Predicted confidence interval

• Example
• xc 0.01s
• CT a.r. 1000 pkt/s
• n 1000 p-p
• best c.i /- 1

27
Method 3 Not back-to-back probes
Multi Channel (Poisson)

• Incentive Reduce invasiveness. In a multi-hop
  this is the inevitable effect.
• Experiment Inject a stream of n probe-pairs into
  the network with intra-pair separation r, such
  that we can capture at least kceil(r/xc) CT
  packets (i.e. array of inter-arrival times).
• Outcome Array of inter-departure times, of which
  some correspond to capturing m packets in an
  interval of length r.
• Model It will become apparent later

28
Busy and Idle Periods

• System passes through alternating cycles of busy
  and idle periods.
• Busy period is when queue is never empty.
• Idle period is when queue is always empty.

29
Why do we care about busy and idle periods?

• If the probes share the same busy period the
  inter-departure times let us know how many
  packets arrived in time interval r.
• If probes are in different busy periods then the
  inter-departure times dont give us any
  conclusive information.

30
Peaks vs. Noise
If two probes within a packet-pair

• Share the same busy period then the
  corresponding inter-departure time will
  contribute to a formation of a peak .
• Dont share the same busy period then the
  corresponding inter-departure time will
  contribute to a formation of noise .

31
Filtering-out noise

• As it stands, it looks like we could model the
  numerical outcomes from the set B as a Poisson
  distribution. But, that is not quite true. Why?

32
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Answer Let us look at the following
example. Experiment Inject a stream of n
probe-pairs into the network with intra-pair
separation r 5xc.
33
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Answer Let us look at the following
example. Experiment Inject a stream of n
probe-pairs into the network with intra-pair
separation r 5xc. Outcome Array of
inter-departure times.
34
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Answer Let us look at the following
example. Experiment Inject a stream of n
probe-pairs into the network with intra-pair
separation r 5xcæ , where 0ltæltxc. Outcome
Array of inter-departure times containing only
the peaks.
35
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Problem If then one of
the following happened

• First probe saw the busy period and was delayed,
  as a result we caught an integer number of
  packets klt5.
• We cannot tell from the inter-departure time that
  4 consecutive packets have arrived.

36
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Therefore if probes are not back-to-back then the
outcome that two probe-packets occur in the same
busy period is dependent on how many packets were
caught.

• In our example, if a number of CT packets we
  caught is greater then 5, then the two probe
  packets must necessarily be in the same busy
  period.
• The converse does not hold.

37
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Conclusion If an inter-departure time
, then we filter it out.
38
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Answer Let us look at the following
example. Experiment Inject a stream of n
probe-pairs into the network with intra-pair
separation r 5xc. Outcome Array of
inter-departure times containing only the peaks.
39
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Answer Let us look at the following
example. Experiment Inject a stream of n
probe-pairs into the network with intra-pair
separation r 5xc. Outcome Array of
inter-departure times containing only the peaks,
less the inter-departure times smaller then or
equal 5xc.
40
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Answer Let us look at the following
example. Model The numerical outcome of the
experiment can be modelled with a truncated
Poisson distribution.
41
Method 3 Not back-to-back probes
Multi Channel (Poisson)

• Probability of capturing k CT packets in the
  interval of length r if we exclude the events of
  capturing 0,1,,m CT packets is
• The corresponding mean is

42
Method 3 Not back-to-back probes
Multi Channel (Poisson)

• The second moment is
• The variance is

43
Mixed Truncated Poisson Distribution
Multi Channel (Poisson)

• After each filtration, number of valid
  experiments (i.e. successful probe-pairs)
  reduces.
• Can we preserve the valid data s.t.
  ?
• Yes. The answer is the Mixed Truncated Poisson
  Distribution .
• where and is the weight of
  the i-th factor.

44
Busy Period
Multi Channel (Poisson)

• Problem After filtration the pool of valid data
  n reduces.

w width of confidence interval r
intra-pair spacing n number of probes after
filtration
45
Busy Period
Multi Channel (Poisson)

• Question How do we find the minimal confidence
  interval?
• How do we find the balance between r
  and n?
• Answer Can we estimate n? Yes!
• n nPprobes share the same busy
  period
• What is the probability two probes share the same
  busy period?

46
Future Work

• Complete the algorithm for finding an optimal
  intra-pair separation.
• Extend Methods for the traffic that comprises of
  multiple CT sizes.
• Use Takacs integrodifferential equation to
  determine if probes are in the same busy period
  for an M/G/1 queue.
• Solve the problem for a multiple hop case.