Topology Modeling via Cluster Graphs

1
Topology Modeling via Cluster Graphs

• Balachander Krishnamurthy and Jia Wang
• ATT Labs Research

2
Internet Topology graphs

• Understand Internet topology
• Traffic patterns
• Protocol design
• Performance evaluation
• Two levels of granularity
• Inter-domain level AS graphs
• Router level router graphs

3
AS graphs

• Construction
• AS-Path-based BGP routing tables or update
  messages
• Traceroute-based
• Synthetic power laws
• Pros and cons
• Coarse-grained
• Easy to generate
• Incomplete
• Connectivity ? reachability

AS graphs are too coarse-grained!
4
Router graphs

• Construction
• Traceroute-like probing
• Interface collapsing algorithms
• Proc and cons
• Very fine-grained
• Expensive

Router graphs are too fine-grained!
5
Network-aware clusters

• Obtain BGP tables from many places via a script
  and unify them into on big prefix table
• Extract IP addresses from logs
• Perform longest prefix matching on each IP
  address
• Classify all the IP addresses that have the same
  longest matched prefix into a cluster (identified
  by the shared prefix)

6
Cluster graphs

• Intermediate-level of granularity
• Undirected graph
• Node cluster of routers and hosts
• Edge inter-cluster connection

7
Cluster graphs

• Construction
• Hierarchical graphs
• Traceroute-based graphs
• Synthetic graphs

• Extend AS graph by modeling the size/weight of AS
• Use cluster-AS mapping extracted from BGP tables

• Traceroute to sampled IPs in interesting clusters
• Construct a cluster path for each sampled IP
• Merge cluster paths into a cluster graph

• Based on some observed characteristics, e.g.,
  power laws

8
Super-clustering

• Group clusters into super-clusters based on their
  originating AS
• BGP tables May 2001
• Web log a large portal site in March 2001
• of requests 104M
• of unique IPs 7.6M
• of clusters 15,789
• of busy clusters (70 of the total) 3,000
• of super-clusters 1,250
• of super-clusters with size gt1 436
• Avg size of super-clusters 2.4

9
Busy clusters in super-cluster
AS 1221
Cluster prefix Common name suffix
139.130.0.0/16 wnise.com
139.134.0.0/16 tmns.net.au
192.148.160.0/24 telstra.com.au
203.32.0.0/14 ocs.com.au
203.36.0.0/16 tricksoft.com.au
203.38.0.0/16 panorama.net.au
203.0.0.0/10 geelong.netlink.com.au
203.0.0.0/12 iaccess.com.au
ASes are too coarse-grained!
10
Cluster graph

• Top 99 busy clusters
• unique IPs 1.2M
• Sample 99 IPs (1 from each cluster)
• Traceroute to 99 sampled IPs
• Ignore probes returning 17
• Ignore unreachable probes(!N, !H, !P, !X) 0.3

11
Cluster path
12
Cluster graph vs AS graph

• Observations
• Cluster graph has 34 more nodes and 15 more
  edges than AS graph.
• The average node degree in cluster graph is 15
  less than that in AS graph.
• Correlation between cluster hop counts and
  end-to-end hop counts is stronger than that of AS
  hop counts.

13
Cluster graph vs router graph

• Observations
• Constructing cluster graph needs much less
  traceroutes than router graph (99 vs thousands).
• More traceroutes show that cluster graph is more
  stable than router graph.

14
Comparison of three models
Model AS graph Cluster graph Router graph
Granularity Coarse Intermediate Fine
Construction ? ? ?
Stableness ? ? ?
Accuracy ? ? ?
15
Conclusion

• Examine Internet topology models
• Cluster graph
• Compare three models
• Cluster graphs are less complicated and more
  stable than router graphs.
• Cluster graph can be obtained as easy as AS
  graphs while providing more fine-grained
  information that capture the Internet topology.