INTERNET MEASUREMENT INTERNET MAPPING OVERHEAD MINIMIZATION Intra- and inter-monitor redundancy reduction IBRAHIM ETHEM COSKUN University of Nevada,

INTERNET MEASUREMENT

INTERNET MAPPING OVERHEAD MINIMIZATION

Intra- and inter-monitor redundancy reduction

IBRAHIM ETHEM COSKUNUniversity of Nevada, RenoM.Sc.

Detect ingress points of a target AS Announced IP Subnets (routeviews) Find which ingress point is passed through to

reach an IP Subnet in the target AS Directly start probing from ingresses Analyze VPs to efficiently probe a target AS

IDEA

traceroute to 223.253.8.1 (223.253.8.1), 30 hops max, 60 byte packets 1 134.197.43.254 [AS3851/AS22911] 0.500 ms 0.964 ms 1.205 ms 2 10.252.1.245 [AS65534] 0.203 ms 0.434 ms 10.251.1.245 [AS65534] 0.184 ms 3 10.255.2.250 [AS65534] 0.907 ms 0.890 ms 10.255.1.250 [AS65534] 0.879 ms 4 134.197.0.9 [AS3851/AS22911] 1.118 ms 1.099 ms 1.090 ms 5 207.197.33.69 [AS3851] 1.082 ms 1.471 ms 1.461 ms 6 137.164.23.37 [AS2152] 4.360 ms 4.267 ms 4.261 ms 7 137.164.46.80 [AS2152] 4.289 ms 4.262 ms 4.303 ms 8 137.164.47.22 [AS2152] 6.807 ms 8.088 ms 6.773 ms 9 137.164.47.18 [AS2152] 7.586 ms 7.571 ms 7.562 ms10 198.32.176.43 [AS4637] 22.041 ms 22.030 ms 22.014 ms11 1.208.104.201 [AS55831] 22.007 ms 203.255.234.133 [AS3786] 21.561 ms 203.255.234.145 [AS3786] 21.547 ms12 203.233.37.73 [AS3786] 166.076 ms 203.233.52.33 [AS3786] 165.376 ms 1.208.104.93 [AS55831] 166.261 ms13 210.120.105.214 [AS3786] 167.341 ms 167.319 ms 1.208.107.218 [AS55831] 167.291 ms14 211.53.168.214 [AS3786] 163.802 ms 168.335 ms 169.086 ms15 124.243.3.221 [AS9842] 168.662 ms 168.297 ms 163.744 ms16 223.253.3.29 [AS9842] 162.751 ms 157.928 ms 157.629 ms17 223.253.3.6 [AS9842] 173.304 ms 173.295 ms 169.098 ms18 223.253.8.1 [AS9842] 171.442 ms 177.999 ms 166.311 ms

IGRESS POINT IDENTIFICATION

Pick 12 ASes Based on:

Sizes (#IPs), #Ingresses, #Peers, Ranks 1 small, 1 medium, 1 large Probe these ASes from each VP

AS ingress analysis

SIZE (#IPs) SMALL, ASN: 65222, SIZE: 32SIZE (#IPs) MID, ASN: 1301, SIZE: 9728SIZE (#IPs) LARGE, ASN: 4134, SIZE: 120.840.448

INGRESS SMALL, ASN: 610, #Ingresses: 1INGRESS MID, ASN: 4366, #Ingresses: 71INGRESS LARGE, ASN: 701, #Ingresses: 2510

RANK SMALL, ASN: 9989, RANK: 9088RANK MID, ASN: 9207, RANK: 8714RANK LARGE, ASN: 3356, RANK: 1

PEER SMALL, ASN: 9253, #Peers: 1PEER MID, ASN: 8697, #Peers: 34PEER LARGE, ASN: 174, #Peers: 35737

AS ingress analysis

Ingress point analysis VP analysis

How to reduce redundant probing?

Pick 2 IPs from each prefix First IP, Last IP 1.0.4.0/24

Ingress Analysis - Probing Mechanism

1.0.4.1 1.0.4.254Probe these IPs • If they enter the AS from the same ingress, then that means all IPs in this /24 subnet belongs tothe same ingress.• If they reveal different ingress points, then divide the subnet in two and continue probing each subnet.


1.0.4.0

First IP: 1.0.4.1

Last IP: 1.0.4.254

First IP:1.0.4.1

Last IP:1.0.4.126

First IP:1.0.4.129

Last IP:1.0.4.254

/24

Divide: 1.0.4.0 /25 || 1.0.4.128 /25

Ingress AIngress A Done!

Ingress A

Ingress B

Continue

Done!

Ingress A

Done!

Ingress B

1.0.4.0 /25 Ingress B

1.0.4.128 /25 Ingress A

Program probes every subnet that each AS announces

Program selects a subnet from the target AS's list randomly and probes first and last IPs of that subnet.

If the actual entrance point of the target AS cannot be identified, then the entrance point for the target AS is predicted.


Predicted Entrance Routers: 1.If the trace ends before revealing the target AS, and if there are some unresponsive hops:

traceroute [(134.197.43.77:33456) -> (4.0.0.1:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 0.721 ms 0.701 ms 0.743 ms 2 10.251.1.245 0.481 ms 0.274 ms 0.274 ms 3 10.255.2.250 0.808 ms 0.787 ms 0.809 ms 4 134.197.0.9 1.874 ms 6.838 ms 4.437 ms 5 207.197.33.69 2.549 ms 1.121 ms 1.022 ms 6 137.164.23.37 3.993 ms 4.036 ms 7.202 ms 7 137.164.46.80 4.090 ms 4.057 ms 4.068 ms 8 137.164.47.22 6.578 ms 6.448 ms 6.471 ms 9 137.164.46.145 8.149 ms 7.953 ms 7.913 ms ---> predicted entrance router10 * * *11 * * *12 * * *


http://134.197.43.77:33456/

If the target AS is revealed, however some number of hops before the target did not respond then the entrance is predicted as the last responsive hop before the target:traceroute [(134.197.43.77:33456) -> (38.98.47.254:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 18.613 ms 0.793 ms 0.683 ms 2 10.251.1.245 0.276 ms 0.268 ms 0.274 ms 3 10.255.2.250 0.724 ms 0.737 ms 0.769 ms 4 134.197.0.9 0.922 ms 0.883 ms 0.879 ms 5 207.197.33.69 1.054 ms 1.082 ms 1.030 ms 6 207.197.17.101 19.446 ms 19.260 ms 19.430 ms 7 199.189.117.17 19.789 ms 19.985 ms 19.814 ms 8 199.189.116.249 20.514 ms 20.244 ms 20.492 ms 9 38.104.170.97 20.723 ms 20.730 ms 20.404 ms 10 154.24.35.245 21.409 ms 21.017 ms 21.208 ms 11 154.54.82.25 28.404 ms 30.726 ms 28.339 ms 12 154.54.47.166 27.910 ms 28.304 ms 27.947 ms ----> (ASN X) predicted entrance router13 * * *14 * * *15 * * *16 38.104.77.118 29.261 ms 28.980 ms 29.130 ms --- > (ASN T) Target AS revealed


http://134.197.43.77:33456/

If the trace ends before revealing the target AS, and if there is no unresponsive hops at the end, then this is considered as "NO_ENTRANCE_INFO":traceroute [(134.197.43.77:33456) -> (206.192.120.3:33457)], protocol icmp, algo hopbyhop 1 134.197.43.254 0.730 ms 12.861 ms 0.677 ms 2 10.251.1.245 0.273 ms 0.272 ms 0.459 ms 3 10.255.2.250 0.822 ms 0.796 ms 0.764 ms 4 134.197.0.9 0.882 ms 0.963 ms 0.862 ms 5 207.197.33.69 1.073 ms 0.976 ms 1.051 ms 6 137.164.23.37 3.981 ms 4.002 ms 3.914 ms 7 137.164.46.80 4.073 ms 4.023 ms 4.161 ms 8 137.164.47.22 6.560 ms 6.477 ms 6.396 ms 9 137.164.47.174 7.340 ms 7.087 ms 7.276 ms 10 198.32.251.70 21.652 ms 21.820 ms 21.717 ms 11 184.105.213.178 90.337 ms 90.639 ms 140.444 ms 12 209.51.161.82 88.132 ms 88.042 ms 87.983 ms 13 216.235.224.6 88.029 ms 87.763 ms 88.084 ms 14 216.235.224.6 3096.839 ms !H 3046.738 ms !H 2996.631 ms !H


http://134.197.43.77:33456/

Tried to use 550 Planetlab Nodes 350 of the nodes are usable Got results from only 225 Nodes Utilized from Paris-traceroute

Ingress Analysis - Probing MechanismIngress Analysis - Probing Mechanism

Some nodes do not allow users to use ‘sudo’ command through ssh connection

Nodes are not consistent SSH connection to nodes was interrupted while

getting the results Nodes cannot SSH to our servers in UNR Need to use a server outside the firewall of the

UNR Campus

PROBLEMS!

VP Node Name: 75-130-96-13.static.oxfr.ma.charter.com

Target AS: 174 ENTR: 75.130.96.1 ENTR_AS: 20115

ENTR: 4.35.114.187 ENTR_AS: 3356 (Divided Subnet: 38.101.40.4/30)

ENTR: 81.95.15.62 ENTR_AS: 33891

Target AS: 3356 ENTR: 204.70.196.234 ENTR_AS: 3561 very small amount

ENTR: 130.215.7.242 ENTR_AS: 10326


VP Node Name: ampelos.ipv6.lip6.fr


ENTR: 88.151.80.187 ENTR_AS: 39449

PRE_ENTR: 66.218.182.5 ENTR_AS: 33227

PRE_ENTR: 207.93.98.69 ENTR_AS: 33227

PRE_ENTR: 146.82.34.246 ENTR_AS: 3549


ENTR: 195.2.22.138 ENTR_AS: 1273

PARTIAL RESULTS

VP Node Name: planetlab1.net.in.tum.de


ENTR: 64.215.195.114 ENTR_AS: 3549 very small amount

VP Node Name: planetlab2.informatik.uni-erlangen.de



ENTR: 4.71.136.102 ENTR_AS: 3356

VP Node Name: 75-130-96-12.static.oxfr.ma.charter.com


ENTR: 64.57.20.90 ENTR_AS: 11164 small amount

PRE_ENTR: 219.158.100.197 ENTR_AS: 4837

PARTIAL RESULTS

Probe target AS IPs starting from the entrance router of the target AS.

-f option of paris-traceroute allows to set the TTL value of the first packet

Reduce the redundant probing through target AS

START PROBING FROM ENTRANCE ROUTER


Target IP

VP 3

VP 2

VP 1

EntrancePoint A

EntrancePoint B

AS X

AS Y AS T

AS RAS Z Directly start probing

from entrance points

Ant Census Data Starting in 2003, researchers at ISI have been

collecting data about the Internet address space. ~80.000.000 IP addresses that response to ping

Parse the data Which IPs belong to which AS Subnets Get the min hop number of the entrance point from the

first probing results Probe the target IP starting from the entrance router

hop number


Entrance Point Hop number: traceroute [(75.130.96.12:33456) -> (1.204.0.1:33457)], protocol icmp, algo hopbyhop 1 75.130.96.1 0.524 ms 0.509 ms 0.551 ms 2 207.210.142.41 2.121 ms 2.453 ms 2.302 ms 3 192.5.89.21 3.704 ms 3.630 ms 3.593 ms 4 198.71.47.57 8.059 ms 8.020 ms 8.075 ms 5 64.57.20.196 14.226 ms 13.917 ms 13.998 ms 6 64.57.20.247 80.246 ms 80.318 ms 80.277 ms 7 137.164.130.130 84.451 ms 82.294 ms 84.126 ms 8 202.97.50.33 84.980 ms 82.220 ms 84.298 ms 9 202.97.58.225 360.122 ms 356.232 ms 349.381 ms 10 202.97.34.69 341.589 ms 343.422 ms 341.274 ms 11 * 202.97.33.193 340.538 ms 342.577 ms 12 202.97.69.98 378.073 ms 375.887 ms 377.994 ms 13 61.189.177.234 366.197 ms 361.223 ms 361.012 ms ------ > Entrance IP(AS -X) Hop Number: 13 14 1.204.0.1 349.854 ms * 349.524 ms --------- > Target IP(AS -T)


VP analysis

TargetAS

Ingress router

VP

Target AS

Other ASes

?QUESTIONS?

Documents

INTERNET MEASUREMENT INTERNET MAPPING OVERHEAD MINIMIZATION Intra- and inter-monitor redundancy reduction IBRAHIM ETHEM COSKUN University of Nevada,