PingER: Research Opportunities and Trends

R. Les Cottrell, SLAC University of Malaya

2Insert Presentation Title in Slide Master

PingER project and publications etc.

Originally:• Research project funded from 1995-2000 by DoE• Aimed at High Energy Physics collaborationsJournal publications e.g.: IEEE Comm paper 2000Popular magazine articles e.g.: IEEE Spectrum 2013Yearly reports going back to1998Papers at conferences e.g.: Passive & Active MeasurementsNumerous presentations in over 20 countries

3Insert Presentation Title in Slide Master

Potential Projectshttps://confluence.slac.stanford.edu/display/IEPM/Future+Projects

Two layers:1. Development of the infrastructure2. Research using the PingER data and infrastructure

4Insert Presentation Title in Slide Master

1: Development of PingER

Set up, extend and maintain Malaysian end-to-end active performance monitoring mesh

Enable use of VMs, Raspberry Pis etc., ID challengesImprove management tools:

• Installation make easier, e.g. Ubuntu distribution with PingER installed• detecting/resolving problems

- Hosts not responding, automate notifying contact- Replacing non-working hosts

New vizualization/analysis/mining• Publication of PingER data via Open Linked Data (OLD) access

- Brazilian team working on this• Improved Google map access

Improve analysis tools:• Extend for IPv6 (Measurements have been IPv6 capable since 2002)

5Insert Presentation Title in Slide Master

2: Research Opportunities using the PingER data

6Insert Presentation Title in Slide Master

Case studies

Case study of Malaysian internet performance• Using existing measurement infrastructure data• How does Malaysia compare to the rest of the

world, to other S.E. Asian nations, is it getting better etc.

• Compare MYREN with university edges• Where are there problems?

• Un-reliable and causes • Noisy (jitter & loss)• Very indirect connections• Work with site contacts, MYREN or ISPs to

notify them of problems

7Insert Presentation Title in Slide Master

Case study - 2

What applications will work• Expected data transfer rates

- Ok for email, web surfing, streaming video, online gaming, web hosting, online TV, downloading movies

• Where will VoIP work well?• Would Haptic surgery work?

- Based on RTT, loss and jitter?

8Insert Presentation Title in Slide Master

Publication of analyzed PingER data in Open Link data formathttps://confluence.slac.stanford.edu/display/IEPM/PingER+Linked+Open+Data

• Have made a start • Enables correlation of PingER data and mashups

- Versus economic indicators, happiness, corruption…- Is there a correlation between Network performance and the

Faculty/student ratio, do private universities have better connectivity than public, etc.?

9Insert Presentation Title in Slide Master

Anomaly detectionhttp://slac.stanford.edu/pubs/slacpubs/13250/slac-pub-13399.pdf

Looking at time series, detect anomalous changes in performanceMultiple metrics, choice of data setStatistical analysis of time periods, training period: • plateau algorithm, Holt-Winters (filtering out seasonal effects),

Kalman filters, Klomogorov-Smirnov …• Compare & contrast methodsTie into traceroutesCorrelate monitor/remote pairs to find shared links with problems• E.g. Principal Component AnalysisMeasure success by high true positives (i.e. low false positives, low false negatives), speed of detection …

10Insert Presentation Title in Slide Master

Problem reporting

Reporting to identified appropriate contactSome hysteresis so do not report one event multiple timesAlso report when fixed.

11Insert Presentation Title in Slide Master

IPv6

Extend PingER data gathering, archiving, analysis to support IPv6Use PingER to make IPv6 measurements of IPv6 hostsCompare to IPv4 hosts at similar locationsMake PingER IPv6 measurements with QoS to compare without QoS measurements

12Insert Presentation Title in Slide Master

GeoLocation of specified Internet hosthttp://www.slac.stanford.edu/comp/net/wan-mon/tulip/

Location of nodes (especially routers) using trilateration• Routers usually report they are located at the corporate HQ and not their

physical locationUse PingER monitors (plus other ping servers such as PlanetLab & perfSONAR) as landmarks to:Ping target with unknown location to get minimum RTTKnowing speed of light in fibre get an estimate of minimum distanceCorrect for estimated indirectivity to get improved distance estimate• Research problem estimating indirectivityUsing 2 distances get doughnut of distance of target from landmark• Constrained Using smallest doughnuts trilaterate to find location of target

13Insert Presentation Title in Slide Master

Geo Location challenges

Make it fast enough to use in realtime from a web form• Multi-step

• Using a few well chosen landmarks first find region target is in,• Use all the landmarks in that region to get distance estimates

and trilaterate How to estimate directivity correction factor?

• By region …Security concerns (DDOS)?Target may block pings• Extend to enable TCP ping without root access • Compare/contrast TCP ping with ICMP…

14Insert Presentation Title in Slide Master

Geolocation: Landmarks

Managing landmarks that are working well • disable non responding landmarks, recover now working

disabled landmarksFinding landmarks in all regions of interestWhere does it work? How does accuracy relate to landmark density?

15Insert Presentation Title in Slide Master

Geo Location

When does it fail & whyComparison to other methods such as databases• Whois, GeoIPtools/MaxMind etc. How does performance relate to number of landmarks?What is it useful for:• Targeted marketing• Valuable for routers and hence visual traceroutes• Find proxies• Which server to use (e.g. HotMail)

16Insert Presentation Title in Slide Master

Geolocation visualization

Using Google maps

17Insert Presentation Title in Slide Master

Going forward

One year Internships at SLACProposals to apply for grantsCoordination between UM, UMT, UNIMAS, SLAC. NUST