Topology Maps of the Internet

1
Topology Maps of the Internet
2
Cichlid a visualization tool for network
analysis related data

• J. Brown, A. McGregor, and H. W. Braun, Network
  Performance Visualization Insight Through
  Animation, Proceedings PAM2000 Passive and
  Active Measurement Workshop, Hamilton, New
  Zealand, pp. 33-41, Apr. 2000.

3
Origin of Cichlid

• Developed by the National Laboratory for Applied
  Network Research (NLANR, located at the San Diego
  Supercomputer Center (SDSC) , University of
  California, San Diego (UCSD))
• The funding for the NLANR project expired June
  30, 2006
• Starting July 2006, the Cooperative Association
  for Internet Data Analysis (CAIDA) took over the
  operation of all NLANR machines and data

4
Purpose of Cichlid

• The National Laboratory for Applied Network
  Research (NLANR) has a number of network
  measurement projects that produce large volumes
  of data
• It is not humanly possible for users to scan all
  of the data or web pages for interesting
  artifacts
• Need a tool for visualizing and animating data
  sets

5
Functionality of Cichlid

• 3-D bar charts -- for displaying numeric
  quantities
• Vertex/edge graphs -- for representing topology
• Data sets are animated in time by repeatedly
  supplying data from successive measurements at
  real-time intervals

6
Cichlid Components
7
Cichlid Output Gallery

• http//moat.nlanr.net/Software/Cichlid/gallery/gal
  lery.html

8
The Walrus Visualization Tool

• http//www.caida.org/tools/visualization/walrus/

9
About Walrus

• Developed by Young Hyun at the Cooperative
  Association for Internet Data Analysis (CAIDA)
• A tool for interactively visualizing large
  directed graphs in three-dimensional space
• The underlying data on the topological structure
  of the Internet is gathered by skitter, a CAIDA
  tool for large-scale collection and analysis of
  Internet traffic path data

10
Features of Walrus

• Compute layout based on a user-supplied spanning
  tree
• Use 3D hyperbolic geometry to display graphs
  under a fisheye-like distortion
• Graphs are rendered inside a sphere that contains
  the Euclidean projection of 3D hyperbolic space

11
Applicability of Walrus

• Only directed graphs are supported
• Only connected graphs with reachable nodes are
  supported
• All nodes must be reachable from all other nodes
  if the direction of links is disregarded
• Multiple links are not supported
• There cannot be more than one link connecting
  together any given pair of nodes
• Dynamically changing graphs are not supported
• Only one graph may be loaded at any time

12
Walrus Output Gallery

• Walrus visualizations of round-trip time
  measurements made by CAIDA's macroscopic Internet
  topology monitor located in Herndon, VA, USA

(63,631 nodes and 63,630 links)
13
Walrus Output Gallery

• Walrus visualization of the number of hosts
  infected by the CodeRed worm in the IPv4 prefix
  24.0.0.0/8, broken down by announced BGP prefix,
  on July 19, 2001.

(321,986 nodes and 321,985 links)
14
Walrus Output Gallery
15
skitter

• http//www.caida.org/tools/measurement/skitter/

16
skitter

• A tool for actively probing the Internet in order
  to analyze topology and performance
• One of the projects of the Cooperative
  Association for Internet Data Analysis (CAIDA)
• Use ICMP Echo request/reply messages with
  incrementing TTL
• Features
• Measure Forward IP Paths
• Measure Round Trip Time
• Track Persistent Routing Changes
• Visualize Network Connectivity

17
Topology monitor using skitter

• CAIDA maintains a set of active monitors
  distributed around the globe
• Each monitor uses skitter to collect topology and
  Round Trip Time (RTT) information for a set of IP
  addresses found in the monitor's destination list
  
• The primary criterion in selecting destinations
  for monitoring is their responsiveness
• The pool of replying destinations is constantly
  decreasing due to proliferation of firewalls,
  changing IP addresses and other reasons
• The list of destination addresses is refreshed
  every 8 to 12 months

18
skitter vizualization gallery

• a macroscopic snapshot of the Internet for two
  weeks 4 April 2005 - 17 April 2005

• 926,201 IP addresses and 2,000,796 IP links
• The link color reflects outdegree, from lowest
  (blue) to highest (yellow).

19
Internet Mapping Project

• http//www.cheswick.com/ches/map/index.html

20
About the project

• The Internet Mapping Project was started at Bell
  Labs in the summer of 1998
• Use traceroute-style path probes
• This data has been used in the study of routing
  problems and changes, DDoS attacks, and graph
  theory.

21
Internet Mapping Project Map gallery
A layout showing the major ISPs in 1999
22
Internet Mapping Project Map gallery

• The effects of war on the Yugoslavian Network.-
  Steven Branigan Bill Cheswick. 1999.
• It changed drastically
• May 1st until May 10, 1999

23
Spamdemic Map

• http//www.cluelessmailers.org/index.html

24
What is Spamdemic Map?

• Spammers sell e-mail addresses to each other
• Fees ranging from a few cents to almost 1 per
  name are paid by some direct marketers for every
  e-mail address submitted to their databases
• Spamdemic traces how West's e-mail addresses are
  being passed around from database to database
• The Spamdemic Map is just a tiny portion of the
  overall picture

25
Spamdemic Map
26
Netscan

• http//netscan.research.microsoft.com/

27
Social structure of Usenet newsgroups

• The Crosspost Visualization tool
• Analyse the connections between newsgroups
• http//netscan.research.microsoft.com/Tech/crossp
  ostVz.aspx

28
Cobot

• http//www.iai.gatech.edu/projects/cobot/

29
What is Cobot

• Cobot was developed by Charles Isbell and Michael
  Kearns
• A software that measure conversations between
  players in the MUD LambaMOO
• MUD -- Multi-User Dungeon, Multi-User Dimension,
  or Multiple User Dialogue
• Each node in the graph is a single player
• The colour coding shows their style of
  communications in terms of speech and actions
• The links show which other player they are most
  connected to in terms of observed interactions

30
Graph representation of some of the social
relationships
31
Color codes

• Red-purple colors tend to be players who are
  average interactors, and who interact mainly
  through speaking
• Yellow, a normal interactors, but through
  non-speech acts
• Blue, heavy interactors through speaking
• Green heavy non-speaking interactors

32
Properties of the graph

• There are very few hubs (ie nodes with many out
  connections)
• The average number of out connections is 1.3
• There are a few key authorities (ie nodes with
  many in connections)
• The most "popular" players tend to interact with
  each other a great deal

33
Google Browser

• http//www.touchgraph.com/TGGoogleBrowser.html

34
What is Google Browser?

• The Google Browser, created by TouchGraph,
  reveals the network of connectivity between
  websites
• The GoogleBrowser uses the 'what's related' data
  from Google to construct the graph.

35
Google Browser samples

• Websites related to insurance
• TouchGraph's clustering algorithm automatically
  divides insurance sites into car insurance
  (blue), life insurance (orange), financial
  insurance (green), and health insurance (purple).

36
Google Browser samples

• Websites related to food and grocers

37
Google Browser

• Try it.
• http//www.touchgraph.com/TGGoogleBrowser.htmlins
  tructions
• Click Graph it!

38
Minitasking - a visual gnutella client

• A. Pascual, M. Hauer, Minitasking - a visual
  Gnutella client, Proceedings of the Seventh
  International Conference on Information
  Visualization, 16-18 July 2003, pp. 115 - 118

39
A sample map of the gnutella network

• Nodes in the network are shown by the coloured
  bubbles
• The size of the bubbles depending on how much
  content they contain

40
MBone topology
41
MBone topology in August 1996

• Produced by Elan Amir, Computer Science Division,
  University of California at Berkeley, USA