Active Probing

1
Active Probing

• Using Packet-Pair Probing to Estimate Packet Size
  and Packet Arrival Rate

PhD Student Ana Novak Supervisors Prof Peter
Taylor Dr Darryl Veitch
Department of Mathematics Statistics Melbourne
University
2
IntroductionConcept of a Packet
NAME Billy Bob
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
Billy Bob
Sarah Jo
3
IntroductionConcept of a Packet
NAME Billy Bob
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
DEPO
NAME Billy Bob
Billy Bob
Sarah Jo
NAME Billy Bob
4
IntroductionConcept of a Packet
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
DEPO
EMAIL billybob_at_hotmail.com
Billy Bob
Sarah Jo
NAME Billy Bob
EMAIL billybob_at_hotmail.com
5
IntroductionConcept of a Packet
MESSAGE How are you today Sarah Jo?
DEPO
MESSAGE How are yo today Sara
Billy Bob
Sarah Jo
NAME Billy Bob
EMAIL billybob_at_hotmail.com
MESSAGE How are you today Sarah Jo?
6
Fundamental Approaches to Measurement

• Passive measurement
• Monitoring
• Typically at a point
• Non-invasive
• Network authority

• Active measurement
• Injecting artificial traffic stream
• End-to-End
• Fundamentally invasive
• Non-privileged users

7
Active Probing Infrastructure
8
Timestamps

• Sender Monitor timestamps probe arrivals to the
  network.
• Receiver Monitor timestamps probe departures from
  the network.

Sender
Receiver
Sender Monitor
Receiver Monitor
9
Timestamps

• As the clocks on the sender and receiver monitors
  may not be
• synchronized we use inter-arrival and
  inter-departure times, rather
• then the end-to-end delays.

10
Single Hop Model

• Description of the 1-hop system
• Service is offered in a FIFO order.
• The server processes at rate .

11
Probe Traffic Cross Traffic

• Definitions
• Probe Traffic (PT) is an artificial stream of
  traffic, all of whose properties are known
  and can be modified and controlled.
• Cross Traffic (CT) is any traffic in the Internet
  that is not Probe Traffic.

12
Types of CT Arrivals

• Single Channel (M/D/1 output)
• Multi Channel (Poisson)

13
Types of Probe Traffic
Packet-Pair Pairs of probes are sent
periodically with period T, intra-pair spacing
r and packet service time xp.
14
Estimating Cross Traffic Size
Single Channel (M/D/1 output)

• Lets construct the following experiment
• Inject a packet-pair probe stream into the
  network s.t. probes are back-to-back and
  , where xc is the CT service time.
• Output of the experiment
• Probes capture 1 or 0 CT packets.

15
Estimating Cross Traffic Size
Single Channel (M/D/1 output)

• Cross Traffic packet size estimate

where is the i-th inter-departure time,
is the probe service time and
is the link rate.
16
Estimating CT SizeExample
Single Channel (M/D/1 output)

• Cross Traffic sizes 100B, 500B, 1000B, 1500B
• Respective arrival rates 600pkt/s, 100pkt/s,
  300pkt/s, 800pkt/s
• Other parameters Link rate 2MBps Cross
  Traffic packet size 1000B Probes packet size
  40B Probe rate 10pkt/s Probe separation 10ms

17
Estimating CT SizeExample
Single Channel (M/D/1 output)

• Cross Traffic sizes 100B, 500B, 1000B, 1500B
• Respective arrival rates 600pkt/s, 100pkt/s,
  300pkt/s, 800pkt/s
• Other parameters Link rate 2MBps Cross
  Traffic packet size 1000B Probes packet size
  40B Probe rate 10pkt/s Probe separation
  0.0001s

18
Estimating CT Arrival Rate(Assumption Single CT
size)
Method 1 Back-to-back probes M/D/1 Method 2
Back-to-back probes Poisson Method 3 Not
back-to-back probes Poisson
19
Method 1 Back-to-back probes
Single Channel (M/D/1 output)
Incentive Exploit the same probe stream used for
estimating Cross Traffic size. Recap. Experiment
Inject a stream of n packet-pairs into the
network with back-to-back probes (array of
inter-arrival times) Recap. Outcome Array of
inter-departure times corresponding to catching 1
CT packet (success) or 0 CT packets
(failure). Model Numerical outcome of the
experiment is a r.v. Y with a Binomial
distribution, B(n,p)
20
Method 1 Back-to-back probes
Single Channel (M/D/1 output)

• Cross Traffic arrival rate estimate in pkt/s

• For large values of n, if experimental value of Y
  is y, the 95.4 confidence interval for arrival
  rate estimate is

21
Method 1 Back-to-back probes
Single Channel (M/D/1 output)
Predicted confidence interval

• Example
• xc 0.9ms
• CT a.r. 1000 pkt/s
• n 1000 p-p
• best c.i /- 10

22
Method 2 Back-to-back probes
Multi Channel (Poisson)
Mathematical Incentive Rectify the problem of
obtaining very low probabilities of packet
capture, which result in a large confidence
interval for arrival rate estimate (eliminate the
upper bound ). Physical
Incentive CT Traffic can be better approximated
with a multi-channel (Poisson) arrivals. Experimen
t Inject a stream of n packet-pairs into the
network with back-to-back probes (array of
inter-arrival times).
23
Method 2 Back-to-back probes
Multi Channel (Poisson)
Outcome Array of inter-departure times
corresponding to capturing m packets in an
interval of length r.
Model Numerical outcome of the experiment is a
r.v. Y with a Poisson distribution, .
24
Method 2 Back-to-back probes
Multi Channel (Poisson)

• The probability of capturing m packets in an
  interval of length r

• The sample average is the MLE of
• where

25
Method 2 Back-to-back probes
Multi Channel (Poisson)

• Respective exact 95 confidence interval is
• where is the inverse of the chi-square
  cumulative distribution function.

26
Method 2 Back-to-back probes
Multi Channel (Poisson)
Predicted confidence interval

• Example
• xc 0.01s
• CT a.r. 1000 pkt/s
• n 1000 p-p
• best c.i /- 1

27
Method 3 Not back-to-back probes
Multi Channel (Poisson)

• Incentive Reduce invasiveness. In a multi-hop
  this is the inevitable effect.
• Experiment Inject a stream of n probe-pairs into
  the network with intra-pair separation r, such
  that we can capture at least kceil(r/xc) CT
  packets (i.e. array of inter-arrival times).
• Outcome Array of inter-departure times, of which
  some correspond to capturing m packets in an
  interval of length r.
• Model It will become apparent later

28
Busy and Idle Periods

• System passes through alternating cycles of busy
  and idle periods.
• Busy period is when queue is never empty.
• Idle period is when queue is always empty.

29
Why do we care about busy and idle periods?

• If the probes share the same busy period the
  inter-departure times let us know how many
  packets arrived in time interval r.
• If probes are in different busy periods then the
  inter-departure times dont give us any
  conclusive information.

30
Peaks vs. Noise
If two probes within a packet-pair

• Share the same busy period then the
  corresponding inter-departure time will
  contribute to a formation of a peak .
• Dont share the same busy period then the
  corresponding inter-departure time will
  contribute to a formation of noise .

31
Filtering-out noise

• As it stands, it looks like we could model the
  numerical outcomes from the set B as a Poisson
  distribution. But, that is not quite true. Why?

32
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Problem If then one of
the following happened

• First probe saw the busy period and was delayed,
  as a result we caught an integer number of
  packets.
• We cannot tell from the inter-departure time that
  4 consecutive packets have arrived.

33
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Therefore if probes are not back-to-back then the
outcome that two probe-packets occur in the same
busy period is dependent on how many packets were
caught.

• If a number of CT packets we caught is greater
  then k, then the two probe packets must
  necessarily be in the same busy period.
• The converse does not hold.

34
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Conclusion If an inter-departure time
, then we filter it out.
35
Method 3 Not back-to-back probes
Multi Channel (Poisson)
Model Numerical outcome of the filtered
experiment is a r.v. Y with a Truncated-Poisson
distribution.

• Probability of capturing k CT packets in the
  interval of length r if we exclude the events of
  capturing 0,1,,m CT packets is

36
Method 3 Not back-to-back probes
Multi Channel (Poisson)

• The mean is
• The second moment is
• The variance is

37
Mixed Truncated Poisson Distribution
Multi Channel (Poisson)

• After each filtration, number of valid
  experiments (i.e. successful probe-pairs)
  reduces.
• Can we preserve the valid data i.e.
  ?
• Yes. The answer is the Mixed Truncated Poisson
  Distribution .
• where and is the weight of
  the i-th factor.

38
Future Work

• Complete the algorithm for finding an optimal
  intra-pair separation.
• Extend Methods for the traffic that comprises of
  multiple CT sizes.
• Find the exact distribution for the Method 3.
• Use Takacs integrodifferential equation to
  determine if probes are in the same busy period
  for an M/G/1 queue (continuous case).
• Solve the problem for a multiple hop case.