CAIDA : tools : measurement : skitter

Utilizing skitter Data

skitter data results in a spanning tree structure originating at the polling host and extending into the infrastructure toward the destination hosts in the polling set. We then aggregate data into a centralized database for correlation and depiction as a top-down, macroscopic view of a cross-section of the Internet from at least a small set of sources. Juxtaposition of such data sets has been a remarkably unattended area given its potential utility in Internet engineering and modelling. Analysis of real-world trends in routing behavior across the Internet has direct implications for next generation networking hardware, software and operational policies. Observations of macro-level traffic patterns provide insights into:

Mapping Dynamic Changes in Internet Topologies
by comparing collapsed skitter graphs across time
Tracking Related Performance Effects in Real-Time
using skitter's RTT data to indicate regions of the infrastructure experiencing abnormal delay.
Identifying Critical Paths
in the infrastructure, i.g., routers or exchange points that might be sources of significant network vulnerability
Performance Testing of Fielded Internet Hardware
e.g., initial skitter data identified statistically significant problems on certain routers using network route cache technology.

Skitter also offers promise in potential correlation to BGP data, to allow engineers to discern who is announcing what to whom over specific paths. Although such information will not answer why given events occur or if such traffic behavior is optimal, it will provide real-world inputs to traffic models/simulations designed to answer such questions. We hope to eventually integrate Skitter data with a comprehensive database of physical topologies (e.g., prototypes are CAIDA's java-based topology mapping tools for ISP backbones, the Mbone and caching hierarchy topologies). These data can also help pinpoint routing instabilities and other anomalies, and track their secondary, downstream effects, e.g. on round trip times, availability, packet loss across specific paths. A repository of these data/analyses will significantly enhance our predictive capabilities on the Internet, and holds promise for insights into the infrastructure as a whole.

Infrastructural Application: Root DNS Server Placement

RSSAC, the DNS root server technical advisory committee to ICANN includes existing root server operators, institutional representatives (from IESG, IANA, DOC, etc.) and technical measurement experts (CAIDA). One of the committee's responsibilities is to provide ICANN with recommendations regarding optimal locations for root name servers. There are currently 13 root name servers. RSSAC has asked CAIDA for assistance gathering data to help determine such architecturally strategic locations for planned root name servers within the Internet. Also available online are WIA's list from 1998 and Internic's list from 1997 of root name servers.

CAIDA's skitter project will support RSSAC as follows. Since August 1999, a skitter host co-located with the F root name server, maintained by Paul Vixie at the Digital Palo Alto Internet Exchange, has measured connectivity and round trip latency to a target list of hosts taken from F's DNS query logs (hereafter called the F root client set). We hope to expand to other current or proposed root server locations as we refine the analysis process. In addition to ensuring that the measurements do not impact the operation of F, we are still investigating how much data we need to gather in order to analyze and interpret it in useful ways. In October 1999 we provided preliminary sample graphs to the root server operators.

The primary goal of the measurement effort is to assess two metrics of connectivity: round trip time and hop count from the root name server to the hosts in the target set. We will specifically explore three possible topological results:

Clusters of hosts that are particularly far, measured by latency, from all of the roots, and that might thus suggest a region that merits a new root server.
Insufficient redundancy in the root server architecture might be reflected in skitter topologies from multiple roots that suggest that the failure of a strategic intermediate router or sub-path would render many end hosts unable to reach any root.
Conversely, excessive redundancy in the infrastructure might be reflected in a set of skitter topologies from different roots where a large set of destination hosts are quite close to several of these roots.

Note that the methodology used here will be relevant beyond the DNS system, and is applicable to location research for any type data server of strategic infrastructural relevance. Since we will not have that many root name server locations instrumented before January 2000, we may do some comparisons to our current skitter sources using the F root client set.

Current skitter Sources

CAIDA currently maintains 19 skitter hosts all over the world. However, not all Skitter monitors are running the full destination set at all times. See the current monitors list page for details.

If you are receiving 52-byte ICMP echo request packets from one of these source addresses, they are from skitter (assuming they're not from someone spoofing the source address). We would like sites to be receptive to skitter measurements at low frequency. CAIDA's measurement efforts are intended to help users, providers and researchers understand the complexities in the current and future Internet. skitter research will provide the community with insight into the complexity of a large, heterogeneous, and dynamic worldwide topology.

If you are receiving skitter measurement traffic and would like the measurements to be discontinued to your site, please send mail to skitter-configs@caida.org. We will discontinue the measurements to your site We would appreciate a reason for the request, but it's certainly not necessary However, please include the IP addresses of the hosts that you wish to have removed from the Skitter database. Note that if your site is not measured, it will not show up in any of the pictures we provide nor any of the routing change measurements and plots.

Next Steps

Our short-term future plans for the skitter project include:

3D visualizations of skitter measurements
enhancement and porting of the Arts++ binary file format library that is used to store active, passive, and routing data
deployment of additional active and passive measurement hosts throughout the global infrastrastructure
spectral analysis of delay data to identify periodicity in specific routers or paths
correlation of active skitter data with passive measurements from Coral (OCxmon) monitors and flow statistics
analysis of trends and identification of further measurement and analysis requirements

Acknowledgements

Many thanks to Bill Cheswick and Hal Burch (Lucent/Bell Laboratories) for providing us with their 2D graph layout code; http://www.cs.bell-labs.com/~ches/map/ has information on Lucent's activities in this area.

CAIDA's skitter project is partially funded by DARPA NGI Cooperative Agreement N66001-98-2-8922, NSF ANIR grant NCR-9711092 (CAIDA), and with equipment support from both Sun Microsystems and Digital Equipment. There are currently 16 skitter sources; we expect to have 25 by January 2000. Countries with sources include Korea, Japan, Great Britain, Canada, Singapore, New Zealand, and the United States. ISPs sponsoring skitter boxes include MCI/Worldcom (at Mae-West), AboveNet, Qwest, Canarie, and APAN.