Merging Logical Topologies Using End-to-end Measurements

Transcription

1 Merging Logicl Topologie Uing End-to-end Meurement Mrk ote Deprtment of E..E. McGill Univerity Montrel, Quebec, nd Michel Rbbt Deprtment of E..E. Rice Univerity Houton, Tex Robert Nowk Deprtment of E..E. Rice Univerity Houton, Tex BSTRT Knowledge of network topology i ueful for undertnding the tructure of the Internet, for developing nd teting new protocol, nd prior informtion to network tomogrphy lgorithm. Building on exiting technique for inferring ingle-ource tree topology uing end-to-end meurement, we ddre the problem of merging multiple tree topologie. We develop multiple ource ctive probing methodology nd ttiticl frmework for teting whether the pth from two ource to two receiver brnch t common internl node. Thi informtion cn then be ued to determine where portion of the tree topology from one ource to et of receiver overlp with the tree topology from different ource to the me et of receiver. The lgorithm ue novel rndom probing tructure nd eily mde meurement of pcket rrivl order. reult, we do not require precie time ynchroniztion mong the prticipting hot. Succeful experiment performed over univerity LN nd over the Internet verify tht our methodology i vertile nd robut. tegorie nd Subject Decriptor. [Performnce of Sytem]: Meurement Technique;.. [omputer-ommuniction Network]: Network rchitecture nd Deign network topology Generl Term lgorithm, Meurement, Theory Keyword Network tomogrphy, Topology dicovery, End-to-end meurement, Multiple-ource network tomogrphy, Pcket rrivl order Permiion to mke digitl or hrd copie of ll or prt of thi work for peronl or clroom ue i grnted without fee provided tht copie re not mde or ditributed for profit or commercil dvntge nd tht copie ber thi notice nd the full cittion on the firt pge. To copy otherwie, to republih, to pot on erver or to reditribute to lit, require prior pecific permiion nd/or fee. IM 0, October 7 9, 00, Mimi Bech, Florid, US. opyright 00 M /0/000...$ INTRODUTION The phyicl topology of network decribe the connectivity of the element which comprie the network, including witche, router, hub nd hot. Knowledge of the phyicl topology of network i extremely importnt for the ucceful execution of mny network mngement tk uch fult monitoring nd ioltion, erver plcement nd reource hring. The phyicl topology cn be depicted grph, with internl node repreenting witching element nd edge node repreenting hot (ee the exmple in Figure ). The routing topology of network i relted to the phyicl topology, nd cn be repreented directed lbelled grph. Over period of routing tbility the routing topology decribe the pth trvered by pcket ent from one end-hot to nother. debte h begun within the reerch community to propertie of network topology grph [, 5]. Further undertnding of thee network propertie will led to improvement in the deign nd teting of network protocol. Much work h been done in the re of identifying routing topologie uing technique bed on informtion from the network BGP tble, nd bed on the trceroute progrm. Such work include the Internet Mpping Project [7], the Merctor project [], id kitter project [], nd Rocketfuel [9]. Thee technique hinge on eliciting pecil repone from internl network device. onequently, thee technique fil when the internl device do not behve expected. Internl device uch router, witche, nd hub my not elicit repone expected either becue they hve thi feture turned off (IMP TTL Exceeded repone re optionl) or becue they re not cpble of eliciting uch repone (i.e. lyer- device). Brford et l. report tht in experiment conducted in 00, % of the internl node they encountered did not repond []. We conjecture tht thi number will only incree ytem dminitrtor dible thi feture in router due to riing network ecurity concern. Technique bed only on end-to-end meurement void the problem experienced by trceroute-like technique, they do not rely on internl network device to do nything more thn route pcket. However, end-to-end technique re only ble to infer ubet of the phyicl routing topology clled the logicl topology. Node in the phyicl topology only pper prt of the logicl topology if they repreent point in the network where the pth from two ource to receiver join (joining point), or if they repreent point where the pth from ource to two receiver

2 B B B b c f d i b c e f d h g i d = g b c = e i h = f () (b) (c) Figure : Phyicl nd logicl topologie of n exmple network. () The phyicl network howing routing pth. ircle indicte internl network element (witche nd router), qure - re ource, nd qure - re receiver. Dot-dh line re route from ource, dhed line route from ource B, nd olid line route from ource. (b) The three logicl tree topologie tht cn be determined from the individul ource ( might be etimted by the lgorithm of [, 8, 9]). Thi et of three topologie doe not reflect the equivlence, or even reltive poition, of the node. In thi ce, node c i equivlent to node e, node d to node g, nd node f to node h. The unlbelled node in the phyicl topology do not pper in the logicl topologie. (c) The generlized logicl topology of the multi-ource network, howing the correpondence between brnching node in the logicl tree topologie. Thi topology clerly indicte how ech ource-detintion pth relte to ll other pth. brnch (brnching point). ingle logicl link i ued to connect two uch node if there i (trvered) phyicl pth between them. Logicl link my encpulte multiple phyicl link nd node which re trvered conecutively. Figure (b) depict logicl topologie from the perpective of ech ource in Figure (), nd Figure (c) depict the logicl topology for the multiple ource network. While the logicl topology doe not decribe the complete routing topology, it my till be ueful for the purpoe of network mpping when trceroute-bed technique fil. dditionlly, the logicl topology i relevnt to network tomogrphy, where end-to-end meurement re ued to infer network internl propertie uch dely ditribution or pcket drop rte. ombining topology nd performnce informtion i extremely ueful for the evlution of the reource hring cpbility of the network under the current configurtion, nd lo cn guide the deciion of ource-bed routing lgorithm. Thu, technique which identify logicl routing topologie uing only end-to-end meurement re ueful both for filling in the hole where other network mpping technique fil nd n initil tep in network tomogrphy lgorithm. In thi pper we build upon exiting technique which infer the logicl tree topology by ctively mking end-to-end meurement from ingle ource. Specificlly, we invetigte the problem of merging two ingle-ource tree from different ource to given et of receiver in order to obtin the multiple-ource, multiple receiver topology. We refer to uch topologie generl topologie, following [6], thereby ditinguihing them from the tree topologie tht hve been the focu of much of the logicl network topology dicovery literture [, 8, 9,, 0,, 8]. The pecil repone elicited by technique bed on trceroute contin n IP ddre which cn be ued to identify internl node. However, becue end-to-end meurement do not depend on thee pecil repone there i no ey wy to lbel internl node in n inferred logicl topology uch tht the internl node inferred by one ource cn be relted to the node in the logicl topology inferred by nother ource when uing end-to-end meurement. onequently, merging two logicl topologie i not trivil tk. We develop multiple ource ctive probing procedure nd ttiticl frmework for identifying where the pth from one ource to et of receiver enter different ource tree topology. Thi informtion cn then be ued to relte internl node in the two tree thereby merging the ingle-ource topologie. The ctive meurement procedure we preent utilize emi-rndomized probing t the ource, nd pcket rrivl order meurement mde t the receiver. reult, no precie clock ynchroniztion i necery, ignificntly enhncing the pplicbility nd robutne of the cheme. Bed on the rrivl order of pcket ent from multiple hot, the procedure mke deciion bout the loction where the pth from one ource to the receiver join the tree topology of nother ource. Implementtion of the lgorithm i eily ccomplihed uing either unict or multict pcket. dditionlly, becue our cheme only ue end-to-end meurement, it cn identify both lyer- nd lyer- network device. We hve explored the efficcy of the lgorithm through experiment in LN environment nd over the Internet, uing hot locted t univeritie in North meric nd Europe.. Relted Work number of uthor hve identified technique tht rely olely on edge-bed meurement to etimte the logicl network topologie tht rie when ingle ource communicte with multiple receiver. The pper [, 0,, 8] focu on topologie reflecting the route tken by multict pcket, where the pper [, 8, 9] invetigte unict topology identifiction. ll of the technique ume tht, from the ource point of view, the logicl topology of ingle-ource, multiple-receiver network i tree nd i tble over the meurement period. Thi umption cn be violted by lod blncing trtegie nd route chnge. The tree-oriented topology identifiction cheme tht uti-

3 lize olely end-to-end meurement involve three min tep. Firtly, end-to-end meurement re mde (e.g., end-to-end lo, dely, nd dely difference). Secondly, et of endto-end metric re etimted bed on the meurement. Exmple of previouly ued metric include count of joint lo event, dely covrince, nd hred lo rte. In the third tep of the topology identifiction cheme, inference lgorithm ue the etimted metric to identify the topology. men of extending thee tree identifiction technique to the multiple-ender ce i not cler. The cheme cn obviouly be ued to etimte the individul tree topologie oberved from ech ource in multi-ource tree, but the meurement do not provide enough informtion to enble recontruction of the correpondence between the tree. In no technique i there logicl extenion from the ingleource probe to multiple-ource probe tht would provide dditionl informtion. In thi pper, we develop meurement frmework nd inference cheme tht permit etimtion of the connection between the ingle-ource tree. There re everl technique tht re cpble of mpping multiple-ource lyer- phyicl topologie, but they require tht internl router repond to IMP requet nd identify themelve uing their IP ddree. The Merctor project [], id kitter project [], nd the technique decribed in [, 7] ll ue trceroute [] in ome form to determine the pth from ource to receiver. In contrt to the work preented here, thee pproche focu on phyicl topology identifiction, combining trceroute meurement collected over very long time frme. much more importnt ditinction between thee technique nd our propoed procedure i tht the trceroute-bed method fil when ubtntil portion of the topology i compried of lyer- element (bridge nd witche) or when router do not repond to IMP requet. In ddition to the procedure in [,,, 7] tht rely only on IMP repone, there re other pproche tht ue SNMP informtion to generte network topology mp. Mny network mngement tool include feture tht ue SNMP informtion to mp lyer- phyicl topologie, e.g., IBM Tivoli Netview ( Other tool uch ico Dicovery Protocol ( rely on vendorpecific extenion to SNMP MIB (Mngement Informtion Be) to incorporte lyer- element; reult they re pplicble only in homogeneou network (where ll element re upplied by the me vendor). Breitbrt et l. [5] nd Lowekmp et l. [6] decribe procedure for determining phyicl topologie tht include lyer- element for more heterogeneou network. Thee procedure rely only on univerlly upported SNMP MIB informtion. Peregrine Sytem Infrtool Network Dicovery ( i commercil tool tht ddree the me tk. Thee ltter tool focu primrily on phyicl topology, but it i poible to derive logicl topologie uing them. However, ll of the SNMP-bed technique require dminitrtive cce, which i typiclly only vilble to mchine on the locl network. The technique cn therefore only generte topology informtion for the component of the network where the uer h dminitrtive privilege.. PROBLEM STTEMENT Two key tk comprie the problem of identifying the unict logicl topology of network compried of multiple ource nd multiple receiver. The firt tk i the dicovery of the tree topologie perceived by ech ource. Thi i followed by the merger of the et of tree. Rther thn developing cheme tht jointly ddree both tk, we leverge exiting technique for identifying ingle-ource topologie [, 8, 9] nd focu on the merging problem. For the ke of clrity, we ditill the generlized merging tk into the following impler problem nd decribe n pproch to it olution throughout the reminder of the pper. ume tht we know (or hve etimted) the logicl tree topology from ource to multiple receiver. n we determine (uing end-to-end meurement) where the pth from nother ource to ech receiver enter the ource tree topology? Thi imple problem lie t the hert of the merging exercie; if we cn ccomplih thi, then we cn develop procedure tht merge multiple tree. e d b Figure : Nine receiver exmple network illutrting entry point. The olid line nd hollow circle depict the tree topology from the perpective of ource. The dhed line nd olid circle indicte where the pth from ource to the receiver join the topology (note tht they do not depict the ource topology). Figure provide n illutrtion of the deired reult, depicting nine receiver network. The logicl tree topology from the perpective of ource i hown by the olid line nd hollow circle. Our tk i to identify where the pth from ource to ech receiver join thi tree, reltive to the hollow, lbelled, node. Thee entry point re hown by the olid circle. exmple, the pth from to receiver enter t point between node d nd e, where the pth to receiver 7 enter bove node. Oberve tht internl node i the brnching point for pth originting from ource or nd going to receiver nd 7. We cll uch node hred brnching point ince it mut be in the logicl tree topologie for both ource nd, nd thu it i hred by both topologie. By knowing tht i hred brnching point, we know tht the pth from to nd 7 join ource tree topology bove node. Our lgorithm eek to identify hred brnching point. Two tree topologie cn then be merged ccordingly. Note tht in thi figure, the f c g

4 internl node hve been lbelled only to fcilitte in the problem decription here nd tht meningful lbel do not reult from ny end-to-end ingle-ource topology identifiction lgorithm. Our inference technique ume: () Interior witche or router cnnot be relied upon to repond to querie. If portion of the network (for exmple the IP router) do repond, then it i trightforwrd to incorporte the informtion in the dicovery procedure. () The topology perceived from ech ource i tree. Thi require tht ny lod blncing or routing chnge over the meurement period do not ffect the logicl multiple-ource topology. In order to mke thi umption more reonble, we eek to limit probing nd keep the meurement period hort poible. () The router nd witche in the topology obey firt-in firtout policy for pcket of the me cl. Thi i necery to enure tht probe pcket do not frequently experience reordering when trvering the me route.. Orgniztion In Section of the pper, we decribe the meurement methodology, commencing with decription nd idelized nlyi of implified two-receiver cenrio. The ection proceed to conduct more detiled nlyi with more relitic umption, nd extend the frmework to multiple receiver network. Potentil extenion to the methodology re lo decribed. Section preent reult from n experiment conducted on LN nd n experiment over the Internet, two cenrio tht preent very different type of chllenge. Section 5 dicue ome limittion of the procedure nd include concluding remrk.. METHODOLOGY ND MESUREMENT FRMEWORK. Simplified Decription nd nlyi In thi firt decription of the frmework, we will perform nlyi uming no cro-trffic nd clock ynchroniztion between the ource, in order to motivte the technique nd highlight the intuition behind it. In Section., we will relx thee umption nd conduct more creful nlyi with cro-trffic effect included. We begin by exploring the imple ce of two-ender, two-receiver network. In uch network, under the umption outlined bove, there re four poible entry cenrio, depicted in Figure. Our meurement frmework in thi imple ce proceed follow (in tree with more receiver, the frmework i trightforwrd extenion). To mke the n-th meurement, we end two pcket from ource, pced ome mll time difference t prt, with the firt pcket being ent t time t n. The firt pcket, which we lbel p,, i detined for receiver ; the econd, p,, for receiver. We lo end two pcket from ource, gin pced by t. The firt pcket of thi pir i ent t time t n +v n, where v n i n offet time. The firt pcket, p,, i ent to receiver nd the econd, p,, to receiver. Figure () depict thi etup for the cenrio in which the brnching point i common to both ource (we will cll thi the hred cenrio). Denote the fixed portion of the dely (trnmiion nd propgtion) of pcket p, from ource to the joining point d,, nd tht of pcket p, from ource by d,. Denote the correponding quntitie () (c) (b) (d) Figure : The four poible entry ce for twoender, two-receiver network. The blck circle indicte entry point. lthough depicted lying in the middle of link in the -topology, thee entry point cn coincide with the children node. For exmple, in (), the entry point cn be the node, but it mut lie below the node. The dhed line re ued to indicte entry pth only, o the topology of the ource tree i not depicted except in (). e () h common brnching point for the two ource; in ce (b), (c) nd (d), the brnching point differ. for the econd pcket ent by ech ource by d, nd d,, repectively. Since the joining point i the me in the hred cenrio, d, = d, = d nd d, = d, = d. The rrivl time of pcket p, t the joining point i t n + d,, where tht of pcket p, i t n + v n + d,. The rrivl time of pcket p, nd p, re t n+ t+d, nd t n+v n+ t + d,. If we now exmine the rrivl order of pcket t the two receiver, we ee tht p, rrive before p, if v n > (d, d,). Similrly pcket p, rrive before p, if v n > (d, d,). We y tht meurement record revere-ordering event if the order of pcket rrivl (compring the pcket from to the pcket from ) i not the me t the two receiver. In the hred brnching point cenrio, ince d, = d, nd d, = d,, the order of rrivl t the two receiver will be exctly the me, irrepective of the offet v n. There will be no occurrence of revere-ordering event. Now conider one of the unhred cenrio in which the brnching i not common (ce (b) in Figure ). In thi ce, the joining point differ, o the fixed dely re (lmot lwy) not equl, i.e., d, d, nd d, d, (ee Figure (b)). If the probe re ent t the me time

5 t n + t n t d, = d, = d () t n + v n + t n + v n d = d, = d, Figure : The meurement proce. () Meurement for topology in which the brnching point i common. The pcket next to ech ource re lbelled with end time. The d nd d lbel correpond to the fixed dely component (trnmiion nd propgtion) of the indicted pth. (b) In thi ce the brnching point re not common, the joining point differ, o the fixed dely component d, nd d, re unlikely to be equl. bove, then pcket p, rrive t it joining point t t n + d,, nd pcket p, rrive t time t n + v n + d,. Pcket p, rrive t it joining point t time t n + t + d, nd pcket p, t time t n+v n+ t+d,. Let d = (d, d,) nd d = (d, d,). If we compre the rrivl ordering t the two receiver, we ee tht the ordering differ when d < v n < d if d < d, or when d < v n < d if d < d. In either ce, there i n offet region of mgnitude d d where different ordering rie t the two receiver. The reult i the me for the entry cenrio depicted in Figure (c) nd (d). The meurement proce conit of repeting the meurement decribed bove mny time for n =,..., N, with v n drwn from uniform ditribution over the rnge [ D, D] (with D choen to be much lrger thn ny meured round-trip-time). In the idel world nlyzed thu fr, we oberve no revere-ordering event in the hred entry cenrio depicted in Figure ()). In the unhred cenrio of Figure (b)-(d), the frction of revere-ordering event pproche d d /D for lrge N. To be more precie, the number of uch event obey binomil ditribution Bi(N, d d /D). In prctice, we implement thi meurement procedure by hving one ource end it ( t-eprted) pcket-pir t tedy rte. The rte mut be ufficiently low to void network flooding nd probe interference. The econd ource end it pir t the me rte, but dd rndom offet time (drwn from uniform ditribution over D,..., D). The two receiver record the ordering of pcket, nd end the reult bck to the ource. The motivtion for the pcing t between the two pcket from ech ource i to enure tht they do not bunch up becue of trnmiion dely. If thi bunching occur, pcket p, experience dditionl dely reltive to p, in it trverl to the joining point, o tht even in the hred ce d, d,. Similrly, d, d,. The dicrepncie here re determined by the bottleneck bndwidth from the ource to the joining point; if thee re not equl, then t d, d, (b) d, d, d d even in the hred ce, nd revere-ordering event will occur. The vlue t hould thu be ufficiently lrge to enure tht bunching doe not occur in the bence of cro trffic. We need t > p/(min(b, B )), where p i the probe ize, nd B nd B re the bottleneck bndwidth of the pth from the repective ource to the joining point. n exmple, for p = 0 byte nd B = Mbp, we hve t > 0 microecond. In prctice, we et t ubtntilly lrger thn thi to void much poible the bunching effect of cro-trffic. The procedure jut decribed enble u to ditinguih between entry cenrio () nd entry cenrio (b)-(d) (referring to Figure ). However, we cnnot determine from thee meurement exctly which of (b)-(d) i in effect. In Section.5, we will ee tht when there re more receiver in the network, it i often poible to combine the reult of pirwie tet to reolve the uncertinty. We etblih condition for identifibility (locliztion to ingle link) of the entry point.. Timing iue The two min timing tk involve performing n pproximte ynchroniztion of the ource t the beginning of the experiment nd in keeping them on trck during the experiment. Timing i not n iue t the receiver, becue they imply record pcket ordering. Unle ome form of ynchroniztion i performed, the ending time of the ource will be offet from one nother reult of clock difference [7]. There will be contnt offet c (in ddition to the rndom offet v ) between the ending time of the very firt probe due to the offet between the clock of the two ource. In turn, the effective rnge of the totl rndom offet ditribution become D + c,..., D + c rther thn D,..., D. If we chooe D uch tht thi rnge till encompe the much mller offet region where revere-ordering event potentilly occur then the reult of the experiment re unffected by the contnt offet. If the end time re clculted nively from ytem clock, then network timing protocol cn induce lrge, unexpected hift in reltive offet when reclibrtion occur. lock kew lo rie from the phyicl mchine hving different internl ytem clock rte. The technique decribed in [7] cn eliminte thee problem, but yet our procedure doe not incorporte it. Over n experiment lting few minute, clock drift cn men tht the n-th probe re (pproximtely) eprted by v n + c + c n, nd for the finl (N-th) probe, c N i of the order of everl hundred microecond. The drift men tht the true offet ditribution i not completely uniform, but for izeble D, it i ufficient pproximtion. In fct, the ue of uniform ditribution i not criticl to the nlyi; ditribution uffice if it tifie the property tht the rtio of the denity t ny two point in the rnge i ufficiently cloe to one. ide from the initil contnt offet c, nd the drift offet c dditionl (nd quite ubtntil) offet cn be incurred if the operting ytem wp out the ource proce during n experiment. We overcome thi by igning ech probe equence number bed on the difference between the time when the experiment begn nd when the probe i being ent. We find tht the mount of time necery to perform ome ytem tk i not necerily determinitic, but lwy within mll rnge (on the order of microec-

6 g v - d p(g, g ) v - d g p(g, g ) v - d v g v - d v g () (b) Figure 5: ro-trffic nd timing effect on ordering obervtion. () n exmple of how the likelihood of n ordering offet i determined for the hred cenrio ccording to (). The contour depict the joint probbility ditribution p(g, g ), which re the dely difference due to cro-trffic nd timing error. For n offet v, the probbility of revere-ordering event r(v) i determined by the frction of the ditribution lying in the hhed region. v vrie, the meeting point of the two ubregion of integrtion trvere the dhed line, which pe through the origin nd h lope. (b) The determintion of the probbility of revere-ordering event in the unhred ce ccording to (). In thi ce, v vrie, the meeting point of the ubregion of integrtion trvere line of lope offet from the origin by d d. ond). While dicrepncie between end-time of the firt pcket in correponding pir re evded by chooing prmeter D to be ufficiently lrge, it i importnt tht the t vlue t the two ource re pproximtely the me. However, ince t i only of the order of few milliecond, clock kew induce mximum dicrepncy of few microecond. In the nlyi tht follow, we borb ll error incurred by ll timing dicrepncie in noie term tht lo include cro-trffic dely. n dditionl fctor to conider in more thorough nlyi i the potentil for reordering of ucceive probe trvering the me pth cn, riing, for exmple, reult of multiple prllel phyicl connection between router. We ume tht thee event re rre, becue they cn only occur when the pcket re very cloely pced, itution tht i common in our meurement frmework for only very mll rnge of offet. Such reordering h the effect of very lightly increing the probbility of revere-ordering event.. More Detiled nlyi We now reviit the nlyi of the rrivl time for the hred cenrio of the two-receiver network, incorporting cro-trffic effect. The rrivl time t the joining point() re: p,(n) : p,(n) : p,(n) : p,(n) : t,(n) = t n + d, + g,(n) t,(n) = t n + v n + d, + g,(n) t,(n) = t n + t + d, + g,(n) t,(n) = t n + t + v n + d, + g,(n) Here g,(n) nd g,(n) repreent the combintion of timing error nd cro-trffic dely experienced by the firt pcket ent from ech ource, nd g,(n) nd g,(n) re the correponding quntitie for the econd pcket. Thee term include only the dely incurred on the pth() to the joining point(). Let u firt conider the hred cenrio. If pcket p,(n) rrive before p,(n) then d, + g,(n) < v n + d, + g,(n). Setting d = d, d, before, nd g (n) = g,(n) g,(n), we hve v n > d + g (n). In order for revere-ordering event to occur, pcket p,(n) mut rrive fter p,(n). With d = d, d, before, nd g (n) = g,(n) g,(n), revere-ordering event occur only when v n < d + g (n), ince d = d in the hred cenrio. By revering the inequlitie, we obtin the expreion for the requirement for revere-ordering event when pcket p, rrive firt. If we conider fixed offet v, the probbility tht revere-ordering event occur i: r(v) = Z v d Z Z v d v d p(g, g ) dg dg + Z v d p(g, g )dg dg. () The nture of thi integrtion i depicted in Figure 5(). t ech offet point v, there i region where n (g, g) combintion cue n revere-ordering event. The totl probbility of revere-ordering event i then: f = D Z D D r(v)dv. () Figure 6() nd (b) diply n etimtion of the integrl for common brnching point in the LN experiment decribed in.. The figure indicte the very mll offet region (reltive to D = m) where revere-ordering cn occur. The probbility of revere-ordering event cn be etimted by numericlly pproximting (). For the depicted cenrio, the etimted probbility i Similr vlue were ob-

7 0. Etimted g + d ( µ ) f(v) Etimted g + d (µ ) () Offet v (µ ) (b) Figure 6: () In the LN experiment decribed in Section., dely difference were meured t common joining point. Bed on thee dely difference, we etimte g (n)+d nd g (n)+d, nd diply them uing ctter plot. Here the hhed region re the re where n ordering difference would occur when the offet v = 80 + d microecond. (b) We etimte f(v) the frction of point lying within the equivlent region for ech v. The etimted function f(v) i diplyed for D = milliecond. In thi experiment, the etimted probbility of revere-ordering event i erved for ll common brnching point encountered during the LN experiment decribed below. In the unhred cenrio, the rrivl time t the joining point remin the me bove, but we mut tke into ccount the fct tht d, d, nd d, d,. Proceeding before, if pcket p,(n) rrive before p,(n) then v n > d + g (n). In order for revere-ordering event to occur, pcket p,(n) mut rrive fter p,(n). Thi require tht v n < d + g (n). By revering the inequlitie, we obtin the expreion for the requirement for revereordering event when pcket p, rrive firt. If we conider fixed offet v, the probbility tht revere-ordering event occur i: r(v) = Z v d Z Z v d v d p(g, g ) dg dg + Z v d p(g, g ) dg dg () The nture of thi integrtion i depicted in Figure 5(b). Define P (t) R t pg (x) dx, where p g i the probbility ditribution of g, nd equivlently, P (t) R t pg (x)dx. If t i ufficiently lrge, then g (n) nd g (n) re pproximtely independent. In the hred ce, the probbility ditribution re the me (uming emi-ttionrity), o p g (x) = p g (x). Under the umption bove we cn write the following expreion for f in the hred brnching point cenrio: f(0) = Z P (t)[ P (t)]dt. () D t In the unhred cenrio, defining d = d d : f(d) = Z [ P (t)]p (t d) + D t P (t)[ P (t d)] dt. (5) Thee expreion demontrte tht the probbility of different ordering event i uully much lrger in the unhred ce compred to the hred ce. Suppoe tht g (n) nd g (n) re zero-men noie nd re well concentrted (in the noie-free ce they re point-m (Dirc delt) function locted t the origin). Then P (t) nd P (t) re pproximtely tep function, being ner zero for t < 0 nd cloe to for t 0. If thi i the ce nd the brnching point i hred, then f(0) 0, ince the integrnd of () i zero except for very mll intervl bout the point t = 0. In the unhred ce, d 0 nd f(d) 0. To ee thi, note tht if 0 < t < d (or d < t < 0), then the integrnd of (5) i equl to on quite lrge intervl (the ize of the intervl depend on the difference d). onequently the totl integrl f(d) i trictly greter thn zero, nd moreover f(d) i monotoniclly increing function of d the lrger the difference d, the more ditinguihble re the hred nd unhred ce. Note tht the mechnim giving rie to g (n) nd g (n) i dely vrition tht occur between pcket which re cloely pced together. In generl pcket dely cn vry ubtntilly (e.g. when burt of trffic rrive t given queue long the pth). However, for pcket pced cloely together the ditribution tend to be much tighter. Thu, in the hred cenrio, vrition in dely hould rrely give rie to erroneou different rrivl order event.. Setting Threhold fter N meurement hve been performed, the number of revere-ordering event in the two receiver network tet i recorded x,. Bed on thi vlue, deciion mut be mde to whether the brnching point i hred or not. Thi deciion would be impler to mke if we knew how mny revere-ordering event we could reonbly expect if the brnching point were hred. We cn obtin n indiction of thi number uing the following procedure. We collect meurement in exctly the me mnner the tworeceiver meurement decribed bove, except tht ll four

8 pcket re ent to the me receiver. We re thu mking meurement cro Y -hped topology. We perform N meurement of thi form to both receiver nd receiver nd record the number of revere-ordering event x nd x, repectively. If the brnching point to the receiver i hred, then the upper brnche of the Y-topologie teted in thee experiment coincide with the pth to the common merging point. In thi ce, the probbility of revere-ordering event hould be the me in ll three experiment, i.e., x, x nd x, re ll drwn from the me binomil ditribution. If the brnching point i not hred, then we expect x, to be drwn from different binomil ditribution thn either x or x, nd moreover, the proportion prmeter of the former ditribution hould be ignificntly lrger thn for either of the ltter ditribution. The deciion to whether brnching point i hred or unhred cn now be formulted hypothei tet. Let x = mx(x, x ). Denote the proportion prmeter of the binomil from which thi meurement w drwn p, nd the proportion prmeter of the binomil from which x, w drwn p,. We wnt to tet whether thee prmeter re equivlent (the ditribution re the me), o the hypothei tet become: H 0 : p, = p H : p, > p (6) For reonbly lrge N, we cn perform thi tet Z-tet, with: dp, bp Z = p. (8) bp( bp)/n where dp, = x,/n, bp = x /N nd bp = (x, + x )/N. For reonbly lrge N, ditribution cn be pproximted norml, nd we cn et threhold for Z uch tht the probbility of declring brnching point unhred when it i in fct hred i equl to pecified level α. In our experiment, we et α = Multiple Receiver Network Thu fr, we hve concentrted on decribing the meurement frmework for two-receiver network. In the two receiver network, ech meurement conit of pir of pcket ent from ech ource. The firt pcket from ech ource i detined for receiver, nd the econd for receiver, nd there i pcing between them of t. The frmework for n r-receiver network i the nturl extenion of thi. For ech meurement, the two ource end trem of r pcket, with pcing of t between ucceive pcket. The i-th pcket in thi trem i detined for the i-th receiver. (7) Ech uch meurement provide `r pirwie meurement of the form decribed bove, nd count of revere-ordering event re collected for ech pir of receiver. We perform the tet decribed bove for ech pir of receiver to determine if there i only one brnching point for both ource. Let (i, j) be binry vlue, indicting whether receiver i nd j hre common brnching point from the two ource (0 indicting no, indicting ye). In the imple two-receiver network, if we determined tht the brnching point w not hred, then it w impoible to ditinguih between the three unhred entry cenrio of Figure (b)-(d). However, when we hve multiple pirwie tet reult, n unhred tet reult cn be ueful informtion when ued in conjunction with nother hred tet reult. We pply the following imple logic lgorithm to combine the reult of the multiple pirwie tet. Merging lgorithm Step The (i, j) = reult re ued to plce initil bound on the deepet point (point cloe poible to the receiver) t which the pth from to i nd j cn join with the pth from. Step ycle through the unhred ce, (i, j) = 0, nd check whether or not the bound determined in Step imply more retrictive bound on the depth for the unhred joining point. Repet thi cycle until the bound do not chnge from one cycle to the next nd declre convergence. The convergence of the lgorithm i gurnteed, provided tht the tet reult do not provide conflicting evidence; ee below for dicuion on how uch contrdiction re reolved. The proof of convergence i very imple bound cn only be tightened, o no ocilltion i poible. However, convergence of the lgorithm doe not men tht joining point will be loclized to ingle logicl link. In generl, the point t which the pth from ource join thoe of ource my only be loclized to within certin equence of conecutive logicl link in the ource tree topology. We y tht the two-ource network i identifible from the meurement if ech point t which pth from ource join pth from ource cn be loclized to certin logicl link in the ource tree topology. ondition for identifibility re tted in the theorem below. The theorem i rther technicl nd lightly difficult to tte, but the key point i tht it demontrte tht there re mny itution (condition on the (i, j) indictor vrible) in which network re identifible. In fct, in our experimentl work decribed in detil in Section., the LN we worked with w identifible. The condition of the theorem do not need to be checked explicitly in prctice; one only need to pply the merging lgorithm bove, nd if the network i identifible, then the lgorithm will converge to the correct network topology. Before tting the theorem, we introduce ome necery nottion. Let R be the et of receiver, nd let D(k) be the decendnt receiver of node k; R/D(k) i then the et of receiver not including D(k). Let be the lbel of the ource for which the (tree) topology i known. Let p(k) be the prent of node k in thi tree, nd let P(i, j) be the pth from node i to one of it decendnt j in thi tree. Let b(i, j) denote the brnching node of the pth from to receiver i nd j. Finlly, denote by b i the firt encountered brnching point on P(,i) for which there i receiver j R with b(i, j) = b i nd (i, j) =. If (i, j) = 0 for ll j R/{i}, then et b i = i. Theorem. two-ource network i identifible if nd only if for ech receiver i R one of the two condition hold: (i) p(b i) = (ii) there i receiver j uch tht p(b i) = b(i, j) nd b j P(,p(b i)).

9 Thee condition imply the requirement tht there i t let one b i with p(b i) =. Proof. Neceity: Suppoe neither condition hold for ome receiver i. Specificlly, there i receiver i uch tht p(b i) nd tht for ll receiver j with b(i, j) = p(b i), b j P(, p(b i)). Thi implie tht (i, j) = 0 for ll uch receiver j. We re now left with two poibilitie for the entry point of the pth to i. Either it cn enter t or bove p(b i), in which ce the pth to ech receiver j mut enter below p(b i) nd t or bove b j, which i poible becue b j P(, p(b i)). lterntively, it cn enter between p(b i) nd b i, in which ce the pth to receiver j cn enter nywhere bove b j. Sufficiency: If condition (i) hold, p(b i) =, then the pth to i enter bove the firt brnching point in the logicl tree o it i loclized to ingle link. If not, then condition (ii) implie tht there i receiver j with b(i, j) = p(b i) whoe pth enter t or bove p(b i). Furthermore, (i, j) i fle (ince b i i below b(i, j)). Thi implie tht the pth to i cnnot enter bove p(b i) (otherwie (i, j) would be equl to ). Therefore, the pth enter on the link from p(b i) to b i. In thi wy, ech entry from ource cn be loclized to ingle link in the tree of ource, nd the network i identifible in the ene defined bove. contrdiction in tet reult will reult in the lgorithm ttempting to mke the upper bound of one of the joining point lower thn the lower bound. We reolve thee difference firtly by mjority vote to eliminte nomlou tet reult. If there re equl number of conflicting reult, then the tet reult re rnked by confidence (determined by Z ttitic)..6 Extenion The methodology nd nlyi preented in thi pper focued on the two-ource topology identifiction problem. Extenion to multiple ource cenrio re trightforwrd. Beginning with ingle-ource tree, econd ource topologicl reltionhip re incorported decribed bove. The topologie of ubequent ource cn be joined to thi topology, one ource t time. For ech new ource, the probing nd merging lgorithm operte in imilr mnner before, but in thi ce probing cn be performed from the new ource nd ny one (or ll) of the other ource in the current topology. The hredne indictor (i, j) tke non-zero vlue if the new ource hre the i, j brnching point with ny one of the other ource, in which ce vlue indicting which ource hre the brnch cn be igned. The merging lgorithm ue the hredne indictor well their non-zero vlue nd employ imilr cycling procedure to loclize ( much poible) the joining point for the new ource. Theorem give condition under which the cquired meurement provide full identifibility. If thee condition re not met, then certin joining point will only be loclized to within equence of two or more conecutive link. It my be poible to employ more informtive probing of the portion of the network in quetion tht cn help to further reolve uch ce. dditionl informtion, reflective of link bndwidth, cn be glened by performing the procedure ued to et the threhold (Y -topology probing) but mking the econd pcket from ource conitently much lrger. When ll the pcket re the me ize, the number of revere-ordering event cn be ued to etimte f(0). When one pcket i much lrger, however, the number of revereordering event cn be ued to form n etimte of metric of the pth from to the joining point. Thi pth metric i the me the pth metric generted by the meurement procedure ued in the identifiction of ingle ource topologie in [9] (it i reflective of the bndwidth of the link on the pth). The meurement frmework in [9] cn be ued to determine the pth metric from the ource to ny brnching point in the ource topology. By imply compring the metric of pth to brnching nd joining point, the reltive poition of ll entry point cn be determined. However, forming ccurte etimte of the metric cn require intenive probing. For thi reon, we enviion tht thee extended meurement could form potentil econdry tep, utilized only fter the ppliction of the imple nd undemnding probing mechnim we hve preented.. EXPERIMENTL RESULTS Our mprobe multiple-ender probing progrm implement the technique dicued bove. There re two ource component nd receiver component. Source end UDP pcket probe to the receiver t regulr period. Source control the experiment nd end t the me period but dd uniform rndom offet to ech ending time. The receiver component imply trck the order in which probe rrive, nd then end the reult bck to ource when the experiment h reched completion. Becue the only importnt metric i pcket rrivl order, no pecil timing infrtructure i required. fter the probe hve been ent the reult re collected nd proceed t ource. Thi ource lo keep trck of the offet ued for ech tril. Thi informtion cn lter be ued, long with the outcome for ech tril, to djut the bound of the ditribution from which the offet re choen. To explore the efficcy of our technique we hve run experiment in two very different networking environment. The firt i deprtmentl LN. The econd conit of hot locted t cdemic nd reerch intitution throughout the United Stte nd Europe. Ech cenrio preent it own et of difficultie. In the LN, the fixed dely difference cn be very mll nd RTT re of the order of hundred of microecond, o timing iue re importnt nd the deciion-mking component of the lgorithm mut perform well. ro-trffic in the LN doe not produce uch extreme dely vrition we oberve in the Internetwide experiment. In the Internet experiment, fixed dely difference re much lrger, nd RTT of the order of ten or hundred of milliecond, o timing nd threhold re not o importnt. However, the dely vrition re much lrger, inducing lrger noie effect due to cro-trffic.. LN Experiment The firt et of experiment were run over US Univerity deprtmentl LN. For thi experiment there were 6 receiver with IP ddree from two different ubnet. Both ubnet reide over the me phyicl network, which conit of ingle lyer- router nd multiple lyer- ethernet witche. Figure 7 depict the logicl network connectivity of the LN. The router i ico model 6509MSF nd witche re om SuperStck model 00 nd 000. Note tht ome of the witche tht interconnect hot re

10 tore-nd-forwrd witche nd other re cut-through. Our technique reolve hred pth regrdle of the witching technology implemented t joining or brnching point Receiver Index Receiver Index Figure 7: The true (nd lo dicovered) logicl topology of the LN network. The hollow interior circle repreent witche or router where the pth from ource to different receiver brnch prt. The filled circle indicte the node (the joining point) where the pth to given receiver from ource nd merge. In thi figure, they re depicted eprte node, but our lgorithm only reolve the loction of thee node to ingle logicl link of the ource- topology. If filled node i poitioned on link in the ource- topology, then the node mut lie below the prent node of tht link but cn either coincide with or lie bove the child node. Ech probe i 68 byte, including pylod, UDP, nd IP heder. We conervtively et pcing prmeter t to be 600 microecond bed on the umption tht the minimum link bndwidth i Mbp. Uing 600 microecond for the rndom offet bound D i ufficient to encomp the rnge of poible dely for the hort pth of the LN. In our experiment on thi topology, ll of the deciion (hred or unhred brnching point) were correct in the ene tht they greed with the known logicl connectivity. The deciion were mde uing the methodology for etting threhold decribed in Section.. Figure 8 grphiclly depict the reult of one experiment. We correctly identify the et of hred pth. In thi ce, the reult re ufficient to completely reolve (to the logicl link level) where the pth from ource to the receiver join thoe from ource.. Internet Experiment In order to explore lgorithm performnce in n environment very different from the LN, we performed nother et of experiment uing Internet hot locted in North meric nd Europe. For thee experiment there were 9 receiving hot locted t 5 different cdemic etblihment. The two ource were both ituted in North meric. Figure 9 how the logicl connectivity between ource nd receiver, identified uing the trceroute progrm. Figure 8: Reult of the LN experiment. The x- nd y-xe correpond to receiver lbelled in Figure 7. The hde of gry of the qure t poition (i, j) indicte the oberved rtio of different ordering event to totl meurement for the receiver pir (i, j). If the qure t (i, j) i lbelled with n, then the pth from the two ource to receiver i nd j hre common brnching point in the true topology. When the detection threhold i et to.00, the vlue determined by the procedure outlined in Section., then ll tet deciion re correct. The mjor network propertie tht ffect prmeter election for our technique re minimum link bndwidth nd mximum end-to-end dely. Becue thee propertie differ gretly between the LN nd Internet cenrio, oftwre prmeter need to be djuted ccordingly. The me 68 byte UDP probe re ued in either ce. To ccount for potentilly lower minimum link bndwidth we incree the pcket pcing prmeter t from 600 microecond to milliecond. Likewie, to djut for the much lrger rnge of poible end-to-end dely the rndom offet i drwn from uniform ditribution pnning 90 milliecond. In thi experiment we re ble to correctly identify pir of receiver with hred pth from the two ource, but not completely reolve entry point. Figure 0 how the reult. In the Internet experiment, the et of reult i inufficient to reolve the entry point of the pth from ource to ingle link. More receiver re required to produce more complete picture. 5. DISUSSION ND ONLUSIONS We hve preented technique for identifying hred pth from multiple ender to receiver uing only end-to-end meurement. Thi informtion cn then be ued to merge two ingle-ource tree topologie. The frmework we propoe revolve round rndomized probing cheme, with receiver only recording pcket rrivl order. Without the need for precie timing meurement, our cheme i very prcticl to implement. Through Internet nd LN experiment we hve demontrted the vertility nd robutne of the technique. The experiment we report involve reltively mll num-

11 Receiver Index Receiver Index Figure 9: True logicl topology of the Internet experiment tetbed. Shred brnching point only occurred when both receiver were phyiclly locted on the me cmpu, i.e. receiver pir (,), (,), (5,6) nd (8,9). In thi ce the network topology i not identifible in the ene we defined bove. In thi experiment, we cnnot completely reolve the entry point of the pth from, but we do correctly identify hred brnching point. ber of receiver hot. dmittedly, technique uing only endto-end meurement do not cle well to lrge number of receiver. For network coniting of M ource nd N receiver, trceroute-bed technique require O(MN) meurement to be mde (one for ech ource-receiver pir). Uing end-to-end multict ««meurement, our technique M require O N meurement. Thu, there i trdeoff between relying on pecil purpoe repone from internl network element nd uing end-to-end technique which require more meurement. However, in itution where the network doe not fcilitte the ue of trceroutebed technique, n lgorithm uing end-to-end meurement to infer the logicl topology my be better thn nothing t ll. dditionlly, while it my not be prcticl to only mke meurement to pir of receiver t time for lrge number of receiver, we believe thi work offer n importnt incite to how lgorithm bed on end-toend meurement, uch our multiple ource lgorithm, cn potentilly be ued to fill in where other meurement methodologie leve off. In future work, we will explore the development of multiple ource probing method imed t chrcterizing network topology nd performnce. We lo pln to invetigte the extent to which meurement mde from multiple ource cn be ued to infer topology without knowledge of ny ingle-ource tree topologie. 6. REFERENES [] Skitter. [] trceroute. Figure 0: Reult of n Internet experiment. Note tht in comprion to the LN experiment, the rtio revere-ordering pn much greter rnge. Thi cn be ttributed to two fctor: () the fixed dely difference d nd d re much lrger in the Internet nd () the rnge of end-to-end dely experienced by pcket on the Internet i much lrger thn in LN. [] P. Brford,. Betvro, J. Byer, nd M. rovell. On the mrginl utility of network topology meurement. In Proc. IEEE/M SIGOMM Internet Meurement Workhop, Sn Frncico,, Nov. 00. []. Betvro, J. Byer, nd K. Hrfouh. Inference nd lbeling of metric-induced network topologie. Technicl Report BUS-00-00, omputer Science Deprtment, Boton Univerity, June 00. [5] Y. Breitbrt, M. Groflki,. Mrtin, R. Rtogi, S. Sehdri, nd. Silberchtz. Topology dicovery in heterogeneou ip network. In Proc. IEEE INFOOM 000, Tel viv, Irel, Mr [6] T. Bu, N. Duffield, F. L. Preti, nd D. Towley. Network tomogrphy on generl topologie. In Proc. M Sigmetric, Mrin Del Rey,, Jun. 00. [7] H. Burch nd B. hewick. Mpping the Internet. IEEE omputer, ():97 98, 999. [8] R. tro, M. ote, nd R. Nowk. Mximum likelihood identifiction of network topology from end-to-end meurement. In DIMS Workhop on Internet nd WWW Meurement, Mpping nd Modeling, Pictwy, NJ, Feb. 00. Extended verion vilble Rice Univerity EE Tech. Rep. TR-009, [9] M. ote, R. tro, M. Gdhiok, R. King, Y. Tng, nd R. Nowk. Mximum likelihood network topology identifiction from edge-bed unict meurement. In Proc. M Sigmetric, Mrin Del Rey,, Jun. 00. [0] N. Duffield, J. Horowitz, nd F. L. Preti. dptive multict topology inference. In Proceeding of IEEE INFOOM 00, nchorge, lk, pril 00.