Measurement and Classification of Out-of-Sequence Packets in a Tier-1 IP Backbone

We present a classification methodology and a measurement study for out-of-sequence packets in TCP connections going over the Sprint IP backbone. Out-of-sequence packets can result from many events including loss, looping, reordering, or duplication in the network. It is important to quantify and understand the causes of such out-of-sequence packets since it is an indicator of the performance of a TCP connection, and the quality of its end-end path. Our study is based on passively observed packets from a point inside a large backbone network-as opposed to actively sending and measuring end-end probe traffic at the sender or receiver. A new methodology is thus required to infer the causes of a connection's out-of-sequence packets using only measurements taken in the "middle" of the connection's end-end path. We describe techniques that classify observed out-of-sequence behavior based only on the previously and subsequently-observed packets within a connection and knowledge of how TCP behaves. We analyze numerous several-hour packet-level traces from a set of OC-12 and OC-48 links for tens of millions connections generated in nearly 7600 unique ASes. We show that using our techniques, it is possible to classify almost all out-of-sequence packets in our traces and that we can quantify the uncertainty in our classification. Our measurements show a relatively consistent rate of out-of-sequence packets of approximately 4%. We observe that a majority of out-of-sequence packets are retransmissions, with a smaller percentage resulting from in-network reordering     

Cross-layer speculative architecture for end systems and gateways in computer networks with lossy links

The throughput degradation of Transport Control Protocol (TCP)/Internet Protocol (IP) networks over lossy links due to the coexistence of congestion losses and link corruption losses is very similar to the degradation of processor performance (i.e., cycle per instruction) due to control hazards in computer design. First, two types of loss events in networks with lossy links are analogous to two possibilities of a branching result in computers (taken vs. not taken). Secondly, both problems result in performance degradations in their applications, i.e., penalties (in clock cycles) in a processor, and throughput degradation (in bits per second) in a TCP/IP network. This has motivated us to apply speculative techniques (i.e., speculating on the outcome of branch predictions), used to overcome control dependencies in a processor, for throughput improvements when lossy links are involved in TCP/IP connections. The objective of this paper is to propose a cross-layer network architecture to improve the network throughput over lossy links. The system consists of protocol-level speculation based algorithms at transport layer, and protocol enhancements at middleware and network layers that provide control and performance parameters to transport layer functions. Simulation results show that, compared with prior research, our proposed system is effective in improving network throughput over lossy links, capable of handling incorrect speculations, fair for other competing flows, backward compatible with legacy networks, and relatively easy to implement.     

Characterizing user‐perceived impairment events using end‐to‐end measurements

Measures of quality of service (QoS) must correlate to end‐user experience. For multimedia services, these metrics should focus on the phenomena that are observable by the end‐user. Metrics such as delay and loss may have little direct meaning to the end‐user because knowledge of specific coding and/or adaptive techniques is required to translate delay and loss to the user‐perceived performance. Impairment events, as defined in this paper, are observable by the end‐users independent of coding, adaptive playout or packet loss concealment techniques employed by their multimedia applications. Time between impairments and duration of impairments are metrics that are easily understandable by a network user. Methods to detect these impairment events using end‐to‐end measurements are developed here. In addition, techniques to identify Layer 2 route changes and congestion events using end‐to‐end measurements are also developed. These are useful in determining what caused the impairments. End‐to‐end measurements were conducted for about 26 days on 9 different node pairs to evaluate the developed techniques. Impairments occurred at a high rate on the two paths on which congestion events were detected. On these two paths, congestion occurred for 6–8 hours during the day on weekdays. Impairments caused by route changes were rare but lasted for several minutes. Copyright © 2005 John Wiley & Sons, Ltd.     

Packet reordering is not pathological network behavior

It is a widely held belief that packet reordering in the Internet is a pathological behavior, or more precisely, that it is an uncommon behavior caused by incorrect or malfunctioning network components. Some studies of Internet traffic have reported seeing occasional packet reordering events and ascribed these events to “route fluttering”, router “pauses” or simply to broken equipment. We have found, however, that parallelism in Internet components and links is causing packet reordering under normal operation and that the incidence of packet reordering appears to be substantially higher than previously reported. More importantly, we observe that in the presence of massive packet reordering transmission control protocol (TCP) performance can be profoundly effected. Perhaps the most disturbing observation about TCP's behavior is that large scale and largely random reordering on the part of the network can lead to self-reinforcingly poor performance from TCP     

IP网络性能指标体系的研究

网络性能指标是网络测评的基础。本文从网络测评的不同角度对IP网络的性能指标进行了综合分析，指出了一种能系统反映IP网络性能的指标体系，并给出了IP网络性能指标体系的形式描述。在此基础上引入了泛化指标和确定性指标的概念，探讨了确定性指标的内容有及描述框架。该研究突破了目前IP网络性能指标体系研究的简单性、局限性，对IP网络测试和性能评价具有指导意义。     

Traffic monitoring and analysis for the optimization of a 3G network

Recent years have recorded a surge of research activities on IP traffic monitoring, enabled by the availability of monitoring hardware and large-scale storage at accessible costs. More recently, passive monitoring has been applied to operational 3G networks. The passive observation of network traffic, coupled with advanced traffic-analysis methods, can be a powerful and cost-effective means to infer the network status and localize points of performance degradation without requiring complete access to all network elements. Furthermore, the availability of high-quality traces can be exploited to predict the load of the network under hypothetical conditions, variations of the actual network configuration at the capturing time. Both approaches can be useful for some engineering and reoptimization tasks that are commonly encountered in the lifetime of an operational 3G network. In abstract terms, the availability of high-quality traces can greatly empower the measurement-based optimization cycle, with human experts in the loop, thus driving an already operational 3G network toward improved performances. In this article we discuss the contribution that traffic monitoring and analysis (TMA) can provide to the optimization of an operational 3G network     

IP网络性能特征模型分析

以Internet为代表的IP网络正日益成为一种重要的通信基础设施,但在当前的Internet上支持实时媒体应用仍然是一个难点。为了能够在尽力而为的IP网络上支持多媒体的应用,需要深入地理解网络性能特征。网络性能特征的研究包括对网络进行测量、建模和分析,定量或定性地得出网络的性能指标,从而有效地对网络进行预测、控制和使用。本文对已有的网络性能方面的研究成果进行归纳、总结和验证,得出了IP网络通信平台的基本性能特征模型。     

Metrics for packet reordering—A comparative analysis

Packet reordering is an inevitable phenomenon on the Internet. An ideal metric for packet reordering should capture reordering accurately, provide insight into the nature of reordering, and help in the evaluation and analysis of reordering leading to mitigation of its adverse effects. Proposed metrics for packet reordering, namely, reorder density, reorder buffer‐occupancy density, reordering extent, and n‐reordering, overcome to various degrees the deficiencies of percentage reordering in capturing the nature and extent of reordering. These metrics vary widely in areas such as evaluation complexity, measurement technique, usage, and in the definition used for packet reordering itself. Metrics for reordering are evaluated using a framework consisting of a set of both essential and desirable attributes of reorder metrics. The attributes include the ability to capture reordering, sensitivity to lost and duplicate packets in reorder measurements, usefulness, simplicity, and evaluation complexity. Finally, the characterization of packet reordering using these metrics is discussed, using sets of measurements carried over the Internet. Copyright © 2007 John Wiley & Sons, Ltd.     

Sequence-based detection of sleeping cell failures in mobile networks

This article presents an automatic malfunction detection framework based on data mining approach to analysis of network event sequences. The considered environment is long term evolution (LTE) of Universal Mobile Telecommunications System with sleeping cell caused by random access channel failure. Sleeping cell problem means unavailability of network service without triggered alarm. The proposed detection framework uses N-gram analysis for identification of abnormal behavior in sequences of network events. These events are collected with minimization of drive tests functionality standardized in LTE. Further processing applies dimensionality reduction, anomaly detection with K-Nearest Neighbors, cross-validation, postprocessing techniques and efficiency evaluation. Different anomaly detection approaches proposed in this paper are compared against each other with both classic data mining metrics, such as F-score and receiver operating characteristic curves, and a newly proposed heuristic approach. Achieved results demonstrate that the suggested method can be used in modern performance monitoring systems for reliable, timely and automatic detection of random access channel sleeping cells.     

信息网络运维监控系统的应用

随着油田的信息网络及应用系统建设的发展,越来越多的业务系统需要依托于信息技术环境进行日常办公管理和业务管理。在简要阐述信息网络运维监控系统关键技术的基础上,进行网络性能、网络架构和网络安全的监控管理等应用,通过系统实现节点状态、活动告警、最近事件等信息的及时快速提取,使网络管理人员能够及时监测、发现网络中存在的问题,提高运维工作效率,辅助实现信息网络的自动化管理。     

Active networks for efficient distributed network management

The emerging next generation of routers exhibit both high performance and rich functionality, such as support for virtual private networks and QoS. To achieve this, per-flow queuing and fast IP filtering are incorporated into the router hardware. The management of a network comprising such devices and efficient use of the new functionality introduce new challenges. A truly distributed network management system is an attractive candidate to address these challenges. We describe how active network techniques can be used to allow fast and easy deployment of distributed network management applications in IP networks. We describe a prototype system where legacy routers are enhanced with an adjunct active engine, which enables the safe execution and rapid deployment of new distributed management applications in the network layer. This system can gradually be integrated in today's IP network, and allows smooth migration from IP to programmable networks. This is done with an emphasis on efficient use of network resources, which is somewhat obscure by many of today's high-level solutions     

Adaptive Neural Network for Nuclear Medicine Image Restoration

A novel adaptive neural network is proposed for image restoration using a nuclear medicine gamma camera based on the point spread function of measured system. The objective is to restore image degradation due to photon scattering and collimator photon penetration with the gamma camera and allow improved quantitative external measurements of radionuclides in-vivo. The specific clinical model proposed is the imaging of bremsstrahlung radiation using ³²P and ⁹⁰Y because of the enhanced image degradation effects of photon scattering, photon penetration and poor signal/noise ratio in measurements of this type with the gamma camera. This algorithm model avoids the common inverse problem associated with other image restoration filters such as the Wiener filter. The relative performance of the adaptive NN for image restoration is compared to a previously reported order statistic neural network hybrid (OSNNH) filter by these investigators, a traditional Weiner filter and a modified Hopfield neural network using simulated degraded images with different noise levels. Quantitative metrics such as the change of signal to noise ratio (SNR) are used to compare filter performance. The adaptive NN yields comparable results for image restoration with a slightly better performance for the images with higher noise level as often encountered in bremsstrahlung detection with the gamma camera. Experimental attenuation measurements were also performed in a water tank using two radionuclides, ³²P and ⁹⁰Y, typically used for antibody therapy. Similar values for an effective attenuation coefficient was observed for the restored images using the OSNNH filters and adaptive NN which demonstrate that the restoration filters preserves the total counts in the image as required for quantitative in-vivo measurements. The adaptive NN was computationally more efficient by a factor 4–6 compared to the OSNNH filter. The filter architecture, in turn, is also optimum for parallel processing or VLSI implementation as required for planar and particularly for tomographic mode of detection using the gamma camera. The proposed adaptive NN method should also prove to be useful for quantitative imaging of single photon emitters for other nuclear medicine tomographic imaging applications using positron emitters and direct X-ray photon detection.     

基于被动测量的网络故障诊断

A new passive method for automatic discovery and location of network failure is proposed. This method employs a passive measurement to collect information and events from network traffic, and employs a model-based reasoning system to detect and locate network faults.Measurement points are deployed in a backbone network to capture the traffic and then evaluate the Quality of Service (QoS) metrics of end-to-end IP conversations. A routing model is also established for the observed network to simulate the attributes and activities of routers and links. This routing model also deduces the routing path for each IP conversation, and thus the QoS metrics of IP conversations are mapped into the metrics of paths. With the information of shared links of overlapping paths and network tomography technique, the QoS metrics of links can also be estimated, and the poorly rated links are picked out as failure points. This method is implemented in a tool named Fault-Man, which is deployed in a campus network. Test results have shown its availability in middle-scale networks.     

Packet filter optimization techniques for high-speed network monitoring

Effective network monitoring is vital for a growing number of control and management applications typically found in present-day networks. The ever-increasing link speeds and the complexity of monitoring applications’ needs have exposed severe limitations of existing monitoring techniques. A majority of the current monitoring tasks require only a small subset of all observed packets, which share some common properties such as identical header fields or similar patterns in their data. In order to capture only these useful packets, a large set of expressions needs to be evaluated. This evaluation should be done as efficiently as possible when monitoring multi-gigabit networks. To speed up this packet classification process, this article presents different packet filter optimization techniques. Complementary to existing approaches, we propose an adaptive optimization algorithm which dynamically reconfigures the filter expressions based on the currently observed traffic pattern. The performance of the algorithms is validated both analytically and by means of the implementation in a network monitoring framework. The various characteristics of the algorithms are investigated, including their performance in an operational network intrusion detection system.     

How a large ATM MTU causes deadlocks in TCP data transfers

The implementation of protocols, such as TCP/IP, and their integration into the operating system environment is crucial for protocol performance. Putting TCP on high-speed networks, e.g., ATM, with large maximum transmission units causes the TCP maximum segment size to be relatively large. What Nagle's algorithm considers a “small” segment is no longer small, which affects the TCP performance. The authors report on TCP/IP throughput and RPC response time performance measurements for various sizes of send and receive socket buffers, using the Sparc10 architecture machines Axil 311/5.1 running SunOS 4.1.3 connected to a FORE System's ATM network. For some common combinations of socket buffer sizes the authors observe a dramatic performance degradation to less than 1% of expected throughput and to one order-of-magnitude longer response time than expected. The performance degradation is caused by a deadlock situation in the TCP connection which is resolved by the 200 ms spaced timer generated TCP delayed acknowledgment. The authors explain the causes of the deadlock situations, and discuss means to avoid or prevent them     

A probabilistic approach to statistical QoS provision of event detection in sensor networks

It is of significant importance to provide network-wide Quality of Service (QoS) for a wide range of event detection applications in wireless sensor networks. This paper investigates the important problem of QoS provision to abnormal event detection. For event detection applications, there are two key performance metrics, i.e., detection probability and detection latency. This paper considers both metrics, aiming to provide statistical QoS for abnormal event detection. It is, however, a challenging issue because of stringent resource constraints of sensor nodes and unpredictable randomness of physical events. We propose a probabilistic approach to statistical QoS provision for event detection in sensor networks. We propose a distributed algorithm that iteratively determines the active probability of each sensor node. The probability is kept small for energy efficiency but sufficiently large to provide the required detection QoS. Our approach is flexible and can detection QoS customized by applications. Comprehensive simulation experiments have been conducted, which demonstrate that our approach is able to provide the required detection QoS for event detection and achieves considerably longer the system lifetime compared with other competing schemes.     

Robust load balancing under traffic uncertainty��tractable models and efficient algorithms

Routing configurations that have been optimized for a nominal traffic scenario often display significant performance degradation when they are subjected to real network traffic. These degradations are due to the inherent sensitivity of classical optimization techniques to changes in model parameters combined with the significant traffic variations caused by demand fluctuations, component failures and network reconfigurations. In this paper, we review important sources for traffic variations in data networks and describe tractable models for capturing the associated traffic uncertainty. We demonstrate how robust routing settings with guaranteed performance for all foreseen traffic variations can be effectively computed via memory efficient iterative techniques and polynomial-time algorithms. The techniques are illustrated on real data from operational IP networks.     

Exploiting Reactive Mobility for Collaborative Target Detection in Wireless Sensor Networks

Recent years have witnessed the deployments of wireless sensor networks in a class of mission-critical applications such as object detection and tracking. These applications often impose stringent Quality-of-Service requirements including high detection probability, low false alarm rate, and bounded detection delay. Although a dense all-static network may initially meet these Quality-of-Service requirements, it does not adapt to unpredictable dynamics in network conditions (e.g., coverage holes caused by death of nodes) or physical environments (e.g., changed spatial distribution of events). This paper exploits reactive mobility to improve the target detection performance of wireless sensor networks. In our approach, mobile sensors collaborate with static sensors and move reactively to achieve the required detection performance. Specifically, mobile sensors initially remain stationary and are directed to move toward a possible target only when a detection consensus is reached by a group of sensors. The accuracy of final detection result is then improved as the measurements of mobile sensors have higher Signal-to-Noise Ratios after the movement. We develop a sensor movement scheduling algorithm that achieves near-optimal system detection performance under a given detection delay bound. The effectiveness of our approach is validated by extensive simulations using the real data traces collected by 23 sensor nodes.     

Analysis of adaptive bandwidth allocation in wireless networks with multilevel degradable quality of service

A wireless/mobile network supporting multilevel quality of service (QoS) is considered. In such a network, users or applications can tolerate a certain degree of QoS degradation. Bandwidth allocation to users can, therefore, be adjusted dynamically according to the underlying network condition so as to increase bandwidth utilization and service provider's revenue. However, arbitrary QoS degradation may be unsatisfactory or unacceptable to the users, hence resulting in their subsequent defection. Instead of only focusing on bandwidth utilization or blocking/dropping probability, two new user-perceived QoS metrics, degradation ratio and upgrade/degrade frequency, are proposed. A Markov model is then provided to derive these QoS metrics. Using this model, we evaluate the effects of adaptive bandwidth allocation on user-perceived QoS and show the existence of trade offs between system performance and user-perceived QoS. We also show how to exploit adaptive bandwidth allocation to increase system utilization (for the system administrator) with controlled QoS degradation (for the users). By considering various mobility patterns, the simulation results are shown to match our analytical results, demonstrating the applicability of our analytical model to more general cases.     

Design of key technologies for intranet dynamic gateway based on DPDK

Aiming at the problems of high packet processing delay and high overhead caused by IP hopping,active defense gateway system with multi-layer network deployment structure was designed and implemented based on the data plane development kit (DPDK).Firstly,based on the DPDK fast forwarding framework,forwarding and processing performance of the system were optimized.Secondly,for the dynamic random mapping gateway with three different types of IP addresses,an efficient IP address allocation algorithm and an unpredictable IP address conversion algorithm were designed.The experimental results show that the designed system can effectively reduce the rate of information acquisition of sniffing attack,while greatly improving the processing delay caused by dynamic hopping.