Locating Congested Segments over the Internet Based on Multiple End-to-End Path Measurements

Shigehiro Ano* 　 Atsuo Tachibana* Toru Hasegawa*

Masato Tsuru** Yuji Oie**

* KDDI R&D Laboratories Inc.** Kyusyu Institute of Technology

2

Contents

IntroductionCongestion occur in the Internet (social infrastructure)

Inference MethodsInference by Packet Loss MeasurementInference by Packet Delay Variation Measurement

Measurement Infrastructure & Conditions Analysis and results

Measurement SnapshotsAnalysis Based on the Internet LocationCorrelation between Each Inference Methods (Loss

Rate & Delay Variation)Conclusion

Introduction Internet is serving as a communication infrastructure. But, congestion is very likely to occur in the Internet (best effort). Network administrator must take actions to mitigate the congestion. ・ route management ・ traffic engineering

How can we locate congested segments ? SNMP 　 not scalable 　 networks are operated independently (in the Internet) Bottleneck identification tool 　 difficult to use all over the networks continuously due to extraordinary test packts

We propose　 Network tomographic approach based on end-to-end packet loss & delay measurement with low rate probing packet

4

Yj : non-loss rate on Pｊ

Xi : non-loss rate on Si

An Inference Method Using Loss Measurement (1)

S2S1

o2o1

S3

d3

P2P1

Detect path performance degradationcharacterize path performance ・ Yj 　≧ h ⇒ good, ・ Yj 　＜ l ⇒ bad, ・ otherwise ⇒ medium

Infer bad segments rule(1) Pi is ｇ ood but Pj is bad 　

⇒ Sj is bad (Xi ＜ h) if l ≤ 　 h2 < h, this rule is held ． 　　

rule(2) both Pi and Pj are bad ⇒ S3 is likely bad (X3 ＜ h)

　 Assumptions ・ X1 , X2 and X3 are independent.•　 X1 , X2 and X3 are likely to be good ⇔ bad is uncommon ．•　 X3 (along P1 ) and X’3 (along P2 ) are nearly same.

We adopt 0.99 and 0.995We adopt 0.99 and 0.995 as as ll and and hh ．．

5

Rule(1)

O DS1 S2 S3 S4 S5 S6 S7 S8 S9

D1D2

D3

O1O3

O2 O4

ISP1 ISP2

S10

D4

(a) (b)

S1 S2 S3 S4 S5 S6 S7 S8 S9 S101 O -> D bad bad bad bad bad bad bad bad bad bad2 O -> D1 bad bad3 O -> D2 bad bad4 O -> D3 bad bad bad5 O -> D4 good - - - good6 O1 -> D good - - good7 O2 -> D good good8 O3 ->D good good9 O4 -> D good good

good (bad) ND ND good ND good ND good good

Path

Inference

Rule(2)

mapping table

An example of the path topology

An Inference Method Using Loss Measurement (2)

6

OK

　　　　　　 0 non-congested path

OK

congested paths

congested paths

Procedure(1) Assign each monitored path to its own specific cluster(2) Calculate the distance for each pair of two different paths(3) Merge the closest pair of clusters(4) Calculate the distance between the new merged cluster and each of the old cluster

Adopt Ward’s Method[1]

(5) Repeat (3) and (4) until all paths are clustered into a single cluster(6) Determine a partition by cutting the dendrogram recursively(7) Infer bad segments using rule (2) of the inference method using loss measurement

heavy congestion may hide mild congestion Recursive Cutting⇒

[1] Ward, J. H, "Hierarchical Grouping to Optimize an Objective Function." Journal of the American Statistical Association, 58, pp. 236-244, 1963.

An Inference Method Using Delay Measurement (1)

10ms is the threshold to detect congestion. 10ms is the threshold to detect congestion.

7

Define “distance”“distance” based on the non-similarity of the time series of packet delay variation Utilizing TWD (Time Warping Distance)[2]

　 - TWD tries to find the optimal alignment between two time series　　 the sum of differences resulting from the alignment is minimized.

the larger difference between the two packet delay variations pi and qj

d(wk)＝

K

kkwd

KQPdist

1)(

1),(

),(

)( 2

ji

ji

qpaverage

qp

pseudo packet pair

An Inference Method Using Delay Measurement (2)

8

Measurement Infrastructure & Conditions

ISP1

ISP2

ISP3

Access NW BAccess NW A

Location A Location B

Location B

Location A

about 1000 km

Subscribing to 3 ISP networks via FTTH access NW (max.100Mbps) at each location Measure non-loss packet rate every 15 second and 99%tile of delay variation every 5 second actively on 30 paths. Test packets: 64byte UDP, uniformed distributed interval: 10-90ms (about 10Kbps) traceroute is issued every 1 minute

9

about 90% (67202 / 73622 periods) of the clustering results were consistentwith route information

pac

ket

loss

rat

e

cO DS1 S2 S3 S4 S5 S6 S7 S8 S9

D1D2

D3

O1O3

O2 O4

ISP1 ISP2

S10

D4

(a) (b)

from ISP1 at Location A to ISP2 at Location B

The paths’ states that are classified into the same cluster are synchronized

Our method infer S1 is bad. S2 and S5 does not become bad simultaneously.

Result (1) Loss Rate & Delay Variation Snapshots

Loss Rate SnapshotLoss Rate Snapshot

Dea

ly V

aria

tio

n (

ms)

Delay Variation SnapshotDelay Variation Snapshot

10

Result (2) Analysis Based on Location

　Congestion tends to occur on specific segments The total number of 5-second periods in which 5 segments are

congested represents about 81% of the total number of congested results

　　⇒　 Our method should be assistance to ISPs by helping them to allocate their 　　　 investment resources efficiently

delay variationloss rate

11

Result(3) Correlation Between the Inference Results Based on Loss Rate and Delay Variation

Inference based on loss rate• congested segment: packet loss rate > 0.01• measurement period: 15 second

Both results are the same in 84% of the periods of simultaneous inference

inferencemethod

inferencesame segments

are inferedsimultaneous

inferencesame

segmentsLoss 6242 4021Delay 8184 6605

2580 2167

Comparison• We chose a path on which segments are inferred by both methods frequently.• To compare simply, we summarized both results every minute.

Inference Results over One Minute Periods

12

Conclusion

■Method of locating congested segments　 by actively measuring end-to-end packet loss rate & delay variation

s on multiple paths　　 - based on a network tomographic approach & clustering techniq

ue　　 - allows us to find multiple deteriorated segments even when mul

tiple congestion occurs at different places on either the same path or different respective paths.

■Measurement on 30 paths for 10 weeks - about 90% of the clustering results were consistent with route information