RoadmapSlide 2Network MeasurementMotivationActive measurementspingtracerouteExample: traceroutetraceroute examplePassive measurementsExample from tcpdumpPassive IP flow measurementNetflow: exampleChallengesWireless network measurementWLAN measurementMy wish-listFrom wish-list to measurement studyThe Changing Usage of a Mature Campus-wide Wireless NetworkCampus-wide usage studyExtensive data set collectionsData decomposition and analysisDefinitionsDefining mobilityClient usage trends from 2001 to 2004AP utilization trendsTraffic trends from 2001 to 2004Application changesSpecific applications: VoIP trendsSpecific applications: P2P trendsSpecific applications: streaming trendsMobilityPrevalencePersistenceSummary1RoadmapSo far, basics of wireless networksPhysical layer characteristics•What happens at source, receiver, in airMAC•MAC for 802.11 WLAN•MAC for sensor networksRouting•For ad-hoc networks•Optimization-based approach•For DTNs2RoadmapAdvanced topics in wireless networksMeasurementManagementSecurity issuesFault tolerance issues (or mobility issues?)3Network Measurementmotivationmeasurement strategiesactivepassivesampling4Motivationservice providers, service usersmonitoringanomaly detectiondebuggingtraffic engineeringpricing, peering, service level agreementsresearchers, designers, software developersarchitecture designapplication design5Active measurementsactive probe tools send stimulus (packets) into network; measure responsenetwork, transport, application layer probescan measure many thingsdelay/losstopology/routing behaviorbandwidth/throughputearliest tools use Internet Control Message Protocol (ICMP)6pinguses ICMP Echo capabilityC:\WINDOWS\Desktop>ping www.soi.wide.ad.jpReply from 203.178.137.88: bytes=32 time=253ms TTL=240Reply from 203.178.137.88: bytes=32 time=231ms TTL=240Reply from 203.178.137.88: bytes=32 time=225ms TTL=240Reply from 203.178.137.88: bytes=32 time=214ms TTL=240Ping statistics for 203.178.137.88:packets: Sent = 4, Received = 4, Lost = 0 (0% loss),approximate round trip times in milliseconds:Minimum = 214ms, Maximum = 253ms, Average = 230ms7traceroute diagnostic tool in widespread use by users and providersfinds outward path to given host, round trip times along path8Example: traceroute for n=1,2,…,nmaxsend pkt with TTL = npkt dies at nth routerrouter returns ICMP pkt with router addresstraceroute to mafalda.inria.fr (128.93.52.46), 30 hops max, 38 byte packets 1 cs-gw (128.119.240.254) 0.924 ms 0.842 ms 0.847 ms 2 lgrc-rt-106-8.gw.umass.edu (128.119.3.154) 1.089 ms 0.633 ms 0.499 ms 3 border4-rt-gi-7-1.gw.umass.edu (128.119.2.194) 0.914 ms 0.589 ms 0.647 ms12 inria-g3-1.cssi.renater.fr (193.51.180.174) 85.851 ms 85.930 ms 85.677 m13 royal-inria.cssi.renater.fr (193.51.182.73) 86.818 ms 86.395 ms 86.326 m14 193.48.202.2 (193.48.202.2) 87.635 ms 86.293 ms 86.495 ms15 rocq-gw-bb.inria.fr (192.93.1.100) 89.157 ms 88.419 ms 87.811 ms9traceroute example10Passive measurementsCapture packet data as it passes bypacket capture applications on hosts use packet capture filters (tcpdump) •requires access to the wire•promiscuous mode network ports to see other trafficflow-level, packet-level data on routers•SNMP MIBs•Cisco NetFlowhardware-based solutions•Endace, Inc.’s DAG cards – OC12/48/19211Example from tcpdump04:47:00.410393 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: S 1616942532:1616942532(0) win 512 (ttl 64,id 47959) 04:47:03.409692 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: S 1616942532:1616942532(0) win32120 (ttl 64, id 47963) 04:47:03.489652 newbury.bu.edu.http > sunlight.cs.du.edu.4882: S3389387880:3389387880(0) ack 1616942533 win 31744 (ttl 52, id 27319)04:47:03.489652 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: . ack 1 win 32120 (DF) (ttl 64, id 47964)04:47:03.489652 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: P 1:67(66) ack 1 win 32120 (DF) (ttl 64, id47965) 04:47:03.579607 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . ack 67 win 31744 (DF) (ttl 52, id27469)04:47:04.249539 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . 1:1461(1460) ack 67 win 31744 (DF) (ttl 52, id28879) 04:47:04.249539 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . 1461:2921(1460) ack 67 win 31744(DF) (ttl 52, id 28880)04:47:04.259534 sunlight.cs.du.edu.4882 > newbury.bu.edu.http: . ack 2921 win 32120 (DF) (ttl 64, id 47968)04:47:04.349489 newbury.bu.edu.http > sunlight.cs.du.edu.4882: P 2921:4097(1176) ack 67 win 31744 (DF) (ttl52, id 29032)04:47:04.349489 newbury.bu.edu.http > sunlight.cs.du.edu.4882: . 4097:5557(1460) ack 67 win 31744 (ttl 52, id29033)12Passive IP flow measurementIP Flow defined as “unidirectional series of packets between source/dest IP/port pair over period of time”Identified by (IP protcol, src address, src port, dst address, dst port) exported by applications such as Cisco’s NetFlow13Netflow: exampleaddincourtesy, D. Plonka14Challengesflow observations are memory/processor intensivehow to do flow observations at high speeds use samplingPacket-level samplingFlow-level sampling15Wireless network measurementWe’ll look at three papersWireless LAN (WLAN) measurement•at Dartmouth collegeMultihop wireless network measurement•RoofNetSensor network measurement•Medium-size sensor networks16WLAN measurementWhat do you want to know?Take UConn wireless LAN as an example: •500 APs, covering 26 buildingsWhat and how to measure?17My wish-listUnderstanding usershow many users?what applications do they use? usage pattern for an application?how long do they stay connected?are they mobile?are they happy w/ the service?Understanding the networkUtilization of the APs?Load distribution of the APs?Data in and out at APs?…18From wish-list to measurement studyRefine your wish-list describe more formallyExpand on it (any other things interesting?)•Main purpose of the network•Striking feature of this networkRelate it to measurement equipment & techniques19The Changing Usage of a Mature Campus-wide Wireless NetworkTristan Henderson, David Kotz, Ilya AbyzovDartmouth College20Campus-wide usage studyExtensive data collection at Dartmouth college over 17 weeksNovember 2003 – February 2004190 buildings on 200 acres5500 students / 1200 faculty•3200 – 3300