Talk Abstract: The DNS is one of the key components of the Internet's infrastructure. Because of its role as a vast distributed directory service for the Internet, studying what is in the DNS reveals a lot about the evolution of the net. We have created an active measurement infrastructure capable of measuring every name in around 50% of the name space (the .com, .net and .org gTLDs) once every 24 hours. For every name, a fixed set of queries is performed, the results of which are stored (together with appropriate meta data, e.g. Geo IP, AS number) in a format suitable for analysis through the Hadoop ecosystem. Our measurement has been running non-stop since February 2015 and we collect over 250GB of results each day. The data we collect is suited for three types of analysis: 1) one-shot analysis, for an at-a-glance view on the state of the name space for a single day, 2) time series, showing developments in the name space over time and 3) anomaly detection where time series show unexpected jumps between two different dates.

The talk will address our motivation for setting up this infrastructure, discuss how it relates to existing efforts such as Passive DNS and illustrate the value of the data we collect by means of a number of examples.

Interested in Discussing: When collecting large quantities of data through active measurements (such as the infrastructure I will present in my talk), what are acceptable metrics for gauging the quality of the data collected?

Related URLs:

• OpenINTEL Open Access
• John's DNS workshop thing after IMC

Talk Abstract: In this talk, I will summarize opportunities and challenges for creating a unified platform for active network measurements. This talk synthesizes two days of discussions at a recent Dagstuhl seminar and the resulting output: CAMP (Common Active Measurement Platform). A key observation in our discussions was that in spite of the challenges of getting all platforms (e.g., RIPE Atlas, Ark, ICLab, etc.) running on common hardware, it is still possible to make concrete progress by encouraging platforms to adopt a common code base. This has the benefit of ensuring measurements are comparable between platforms and can facilitate interacting with the data, managing versions (and related measurement artifacts), and reduce redundant effort when new platforms arise. This work is currently very early and we are looking for folks interested in helping out in terms of contributing ideas and code.

Interested in Discussing: incentives/strategies for getting deployment, measurement baselines/common measurements that could run for long periods of time.

Talk Abstract: Service providers and users increasingly care about QoE instead of QoS, requiring a shift to focus on how network performance impacts application performance. I will discuss how we are working toward identifying how different ISPs enact policies for different traffic classes, and the impact of such policies on QoE.

Talk Title: New Reverse Traceroute API

Talk Abstract: Reverse Traceroute is being rebuilt from scratch with better measurement efficiency, robustness, and scalability. I will discuss some of the useful features of the measurement service that backs Reverse Traceroute, and plans for (finally) opening the system to public.

Interested in Discussing: Can we converge on any standard metrics/tools for QoE measurements?

Reated URLs

• Detecting Differentiation
• Reversing Traceroute
• MobiData Workshop CfP

Talk Abstract: This talk will overview our experiences developing Cipollino an AS-aware Tor client. This client considers adversaries that may surveil connections on both forward and reverse paths as well as adversaries that may perform hijacks or interceptions of network traffic. To achieve these goals Cipollino requires access to a variety of network measurement data: traceroutes to infer reverse paths that cannot be measured directly and real time feeds of anomalous routing behavior. Our work on Cipollino exposes challenges and opportunities for developing interfaces to measurement data for security applications. We will present one such interface we developed as part of this project: PathCache. This interface allows researchers to access network paths compiled from publicly available traceroute measurements already being run on the RIPE Atlas platform. In addition to on-demand queries, PathCache also supports downloading of efficient representations of the data for Tor clients since they must compute paths locally to preserve anonymity.

Interested in Discussing: Connectivity of the Internet AS graph, graph theoretic reasoning of the ground truth in the global AS graph.

Talk Abstract: This is intended to be an overview presentation of the work at APNIC to use online ads to measurement aspects of the Internet. I don't think I've ever reported this to an AIMS workshop before, so in this presentation I'd like to expose some of the workings of the measurement system and some of the measurement outcomes from this work so far.

Interested in Discussing: DNS measurement, IPv6 and fragmentation handling

Talk Abstract:

Interested in Discussing: Experimental design, data sharing, reproducible research

Talk Abstract: Mobile Internet availability, performance and reliability have remained stubbornly opaque since the rise of cellular data access. Conducting network measurements can give us insight into userperceived network conditions, but doing so requires careful consideration of device state and efficient use of scarce resources. Existing approaches address these concerns in ad-hoc ways. In this work we propose Mobilyzer, a platform for conducting mobile network measurement experiments in a principled manner. Our system is designed around three key principles: network measurements from mobile devices require tightly controlled access to the network interface to provide isolation; these measurements can be performed efficiently using a global view of available device resources and experiments; and distributing the platform as a library to existing apps provides the incentives and low barrier to adoption necessary for large-scale deployments. We describe our current design and implementation, and illustrate how it provides measurement isolation for applications, efficiently manages measurement experiments and enables a new class of experiments for the mobile environment.

Interested in Discussing: Mobile Internet QoE, Traffic differentiation, Network neutrality, security and privacy of measurement

Talk Abstract: Network operators measure Internet routes to troubleshoot problems, and researchers use route measurements to characterize the Internet. However, they still rely on decades-old tools like traceroute, BGP route collectors, and Looking Glasses, all of which permit only a single query about Internet routes---what is the path from here to there? This limited interface complicates the task of gathering routing measurements necessary to satisfy higher-level tasks such as ``identify routes that traverse a particular inter-AS (autonomous system) link in Chicago on the way to a particular destination AS.''

In this talk, we present Sibyl, a system that takes rich queries that researchers and operators express as regular expressions, then issues and returns traceroutes that match even if it has never measured a matching path in the past. Sibyl achieves this goal in three steps. First, to maximize its coverage of Internet routing, Sibyl integrates together diverse sets of traceroute vantage points that provide complementary views of Internet routing, with measurements from thousands of ASes in total. Second, because users may not know which measurements will traverse paths of interest, and because probing resource constraints keep Sibyl from tracing to all destinations from all sources, Sibyl decides which measurements to issue by using historical measurements to intelligently predict which are most likely to match a given query. Finally, Sibyl optimizes across concurrent queries to decide which measurements to issue given rate-limit constraints. We show that, compared to existing approaches, Sibyl provides more accurate and timely access to the routing information that researchers and operators need--in fact, it matches 81\% of the queries that it could match if an oracle told it which measurements to issue.

Interested in Discussing: fostering long-running and open measurement systems/tools/studies, instead of projects dying after one-off studies for papers.

Talk Abstract: I am coming along with Roland van Rijswijk. My initial thought was to give a separate presentation on the big data analysis side of our work [1]. This would include technical details of data design decisions, and operational examples of analyses with a variety of tools in the Hadoop ecosystem. Since presentation spots are limited we will integrate it in his presentation.

[1] The Internet of Names: A DNS Big Dataset

Interested in Discussing: An issue I would like to discuss is how to incentivize (meta)data sharing in a multi-organization setting for security purposes. Taking DDoS attacks as an example, often the best place to diagnose and mitigate the attack are far from the actual target target. Examples of remote data that could potentially allow for more effective mitigation are flow data and hijacked BGP routes.

Talk Abstract: This talk describes the design and implementation of our storage back-end for network measurements, NNTSC. A key feature of NNTSC is that it is designed to be flexible and can be easily extended to add support for new metrics and data sources. NNTSC is used as the back-end for the current incarnation of the Active Measurement Project, but has also been used to store measurements from Smokeping, Munin and Libprotoident.

This talk will also discuss some of the challenges that we've faced (and continue to face) throughout the development of NNTSC and the lessons we have learned as a result. We hope that by sharing this knowledge, we can prevent other researchers from making the same mistakes that we did.

Finally, if time permits, I will demonstrate some of the measurement tools that we have developed that use the data stored in NNTSC to provide people with better insight into their networks.

Interested in Discussing: Bridging the gap between the data that measurement systems collect and the level of expertise needed to interpret that data, i.e. how can we convert the data we collect into simple statements that can tell a person what is happening on the network?

Related URLs:

• Active Measurement Project

Interested in Discussing: Source IP address spoofing, routing security, Internet "health" metrics

Interested in Discussing: I have two specific areas of interest: - unlocking operator measurements. In the course of our work on world IPv6 launch (with measurements ongoing) we've had access to a lot of inside information from operators and websites. Through v6launch we were able to unlock part of those and make them available through making those measurements less precise but anonymous. Are approaches like this broadly useful, and are there other keys to get network operators to make their data more accessible. - We are starting a new effort to try to unlock measurements in that manner, and that effort is tied to perspectives on Internet Health. Our interest is in having broad assessments of the Internet Health that have some grounding in reality. The work is nascent so there isn't a lot to say about it just yet, but I'm interested in related discussions.

Talk Abstract: AMP is a system designed to continuously perform active network measurements (similar to Ark or Atlas) between specialist monitor machines, as well as to other targets of interest. These measurements are used to provide both a view of long-term network performance as well as to detect notable network events when they happen. WAND runs a mesh of monitors hosted by ISPs around New Zealand that test to each other, various CDNs, DNS servers and other infrastructure targets.

This talk will describe our experiences with writing tests to perform measurements, scheduling them to be run, robustly reporting results and dealing with test failure.

Interested in Discussing: Approaches to validating measurements, proving correctness

Talk Abstract: As a society we have come to rely upon our mobile phones for myriad daily tasks. It is striking how little insight we, as mobile users and researchers, have into the operation and performance of our devices and network, into how (or whether) they protect the information we entrust to them, and with whom they share it. Researchers?including ourselves?have used a variety of approaches to gain some understanding of the mobile device/network ecosystem; however, these techniques have had to make tradeoffs that affect either the scale or granularity of measurements. To overcome the limitations of the approaches listed above, we envisioned the ICSI Haystack, a handset-, traffic-, and user-centric measurements platform capable of illuminating high-fidelity app and network activity at scale from the mobile terminal. HayStack platform captures traffic locally in userspace without requiring root permissions, thereby we enhance user reach by distributing it via Google Play. This feature will allow us to pursue a wide range of research topics from privacy and security measurements to QoS, performance evaluations, censorship detection as well as novel reactive measurements (REM). In this talk, we will briefly present Haystack's technology, its potential applications, its limitations, as well as its challenges including user engagement, ethical considerations, and usability.

This project is a collaborative effort with Abbas Razaghpanah, Phillipa Gill, Srikanth Sundaresan, Christian Kreibich, Mark Allman and Vern Paxson. More information

Interested in Discussing: Usability feedback, deployment strategies, supported features and measurements, and potential collaborations and contributions

Talk Abstract: The last years have seen an explosion of open platforms for experiments and measurement over the Internet. Yet despite effort sharing measurement, seamlessly run (or cross-validating) the same experiment from multiple platforms remains quite challenging. This is especially true whenever experiments need to acces vaste amount of data (e.g., results of Internet censuses, that change unfrequently and thus were time is not critical), or when they need to access such data in streaming mode (e.g., process BGP announces as they are received) to trigger further measurement (e.g., latency measurement or traceroute in the data plane on the changed prefixes, where timing is thus very critical).

In this talk we list challenges that arise in one particular use-case, namely BGP hijack detection via distributed data-plane latency (and, limitedly, path) meaurements. Building over our system able to perform an IPv4 census in few hours [1,2], we started building a system capable of lightweight and fast scans -- in the same timescale of BGP hijacks, which last possibly few minutes. Timing becomes of course critical so that a reactive method based on BGP announces introduces possibly large delay, while a proactive method scanning the full IPv4 address ranges (possibly with opt-in/opt-out) is challenging. Throughout this process, we find several challenges, and discuss possible solutions, related to cross-validation of results (e.g., data plane vs control plane measurement; annotation of BGP hijack events), infrastructure sharing (leveraging our experience on PlanetLab and RIPE in the context of mPlane), data access and sharing (e.g., possible to some extent at some loose level of temporal and spatial granularity) and analysis (post mortem if using general purpose big data tools, or near real-time which however requires breweing highly-specialized custom tools).

[1] Anycast census and geolocation . In 7th Workshop on Active Internet Measurements (AIMS 2015), San Diego, CA, Mar 2015.
[2] Characterizing IPv4 Anycast Adoption and Deployment . In ACM CoNEXT, Heidelberg, December 2015.

Interested in Discussing: How could we achieve "near" real time data sharing,especially for experiments using both control plane and data plane measurements?

Related URLs:

• Anycast Project

Talk Abstract: Existing testbeds, vantage points, and datasets provide researchers with limited visibility into the topology, routing, and policies employed by the thousands of networks that comprise the Internet, as well as the challenges network operators face. As a result, researchers face a barrier to conducting research relevant to Internet operations and standardization.

PEERING is a community testbed that allows researchers to overcome this barrier. With PEERING, researchers can emulate an autonomous system (AS) and then establish BGP peerings between the emulated AS and real ASes around the world. Via these peerings, experiments can announce and select Internet routes as well as exchange Internet traffic with hundreds of networks, including upstream providers at universities and peers at large Internet exchange points (IXPs).

To date, PEERING has primarily served as a routing measurement platform: by making BGP announcements with PEERING, researchers have been able to uncover the routing policies of other networks and evaluate approaches to sidestepping such policies when they impair Internet connectivity. We'll discuss how ongoing improvements to the testbed are making it easier to conduct measurement experiments, including new interfaces that enable measurement as a service and integration with Reverse Traceroute and Sibyl.

In addition, we'll discuss how PEERING is evolving to support our vision of allowing researchers to instantiate a network of their choice on the actual Internet. For example, researchers could use PEERING to build a cloud provider similar to Amazon, including data centers, a wide area network between them, and peering routers around the world interconnecting the provider to client networks. This rich environment could be a playground for researchers conducting experiments that require representative connectivity, including research on intelligent intra and interdomain traffic engineering.

To achieve this vision, we're adding connectivity at Internet exchange points around the world, increasing PEERING's points of presence into the dozens and number of peers into the thousands. In addition, we're federating PEERING with other testbeds to make it easier for researchers to evaluate systems in qualitatively representative environments. For instance, we are federating with Internet2 and other networks to build a virtual backbone that interconnects PEERING's points of presence, similar to the backbone network that a large network provider would have. We are also federating PEERING and the new CloudLab testbed to allow researchers to build clouds with rich intra and interdomain connectivity.

By allowing researchers to become active participants in the Internet ecosystem, PEERING provides unprecedented visibility into the operation of Internet networks, enabling numerous measurement and evaluation studies to-date. Whereas traditional studies measure what are the existing Internet routes, PEERING will enable researchers to perform their own what if experiments and serve as a launching pad for improvements to the Internet.

Interested in Discussing: long-term maintenance of testbed infrastructure, prioritizing infrastructure to build (how do we ensure we're building infrastructure that's useful to other researchers?), coordinating federated testbeds

Related URLs:

• PEERING Testbed

Talk Abstract: Sibyl is a system that allows users to specify their queries for Internet paths in regular expressions. It supports much richer query types than traceroute, which only allows users to choose sources and destinations. For example, Sibyl accepts queries such as "search for all paths that went through the link between Comcast and Level3 in Los Angeles." Sibyl achieves so by predicting paths that a traceroute could potentially go through in advance. If such prediction is accurate, then Sibyl can easily pick out correct traceroutes that match queries to issue, and such traceroute will have high probability to really match queries.

Sibyl is built upon combining several existing measurement platforms, including RIPE Atlas and PlanetLab. We define a unified interface for these platforms to specify their own resource constraints, such as rate limit to issue from a specific source. Sibyl respects such constraints when trying to satisfy queries. Also, we found that incorporating more platforms could improve our path prediction accuracy, and that different measurement platforms compensate with each other in AS coverage. I will mainly focus on the benefit we got from integrating different platforms instead of introducing the system itself.

Interested in Discussing: Constraints and interface for different measurement platforms

Talk Abstract: Short analysis of hosting of web resources, that could be attributed as "russian". Local/abroad, size of hosters, content filtering.

Interested in Discussing: Measurement infrastructure development

Talk Abstract: Network operators measure Internet routes to troubleshoot problems, and researchers use route measurements to characterize the Internet. However, they still rely on decades-old tools like traceroute, BGP route collectors, and Looking Glasses, all of which permit only a single query about Internet routes---what is the path from here to there? This limited interface complicates the task of gathering routing measurements necessary to satisfy higher-level tasks such as "identify routes that traverse a particular inter-AS (autonomous system) link on the way to a particular destination AS."

In this talk, we present Sibyl, a system that takes rich queries that researchers and operators express as regular expressions, then issues and returns traceroutes that match even if it has never measured a matching path in the past. Sibyl achieves this goal in three steps. First, to maximize its coverage of Internet routing, Sibyl integrates together diverse sets of traceroute vantage points that provide complementary views of Internet routing, with measurements from thousands of ASes in total. Second, because users may not know which measurements will traverse paths of interest, and because probing resource constraints keep Sibyl from tracing to all destinations from all sources, Sibyl decides which measurements to issue by using historical measurements to intelligently predict which are most likely to match a given query. Finally, Sibyl optimizes across concurrent queries to decide which measurements to issue given rate-limit constraints. We show that, compared to existing approaches, Sibyl provides more accurate and timely access to the routing information that researchers and operators need.

Interested in Discussing: Topology mapping, interdomain routing

Related URLs:

• Young's traceroute tools, (off-track) CAIDA's IP-to-AS mapping dataset
• Yarpping: DIRECT Network Mapping
• Reverse Traceroute: https://revtr.ccs.neu.edu/
• Emile's tools
  • Measuring More Internet with RIPE Atlas
  • Infrastructure Geolocation - Plan of Action
• PEERING

Talk Abstract: perfSONAR is an open source framework to simplify the task of network collecting and analyzing network measurement data. Joining together a set of tools designed to actively test network infrastructure, perfSONAR is able to give a overview of performance on a per flow and per network path basis. This framework has seen large deployment in the academic community internationally, and serves as a critical component supporting modern network operation. There are currently over 1600 public perfSONAR hosts worldwide.

This talk will summarize the new additions to perfSONAR v3.5 (released October 2015), and describe where perfSONAR is headed next. The talk will also describe the large collection of perfSONAR data that is available to network researchers, how to access it, and summarize the results from several research projects that are working with perfSONAR data.

Interested in Discussing: Network Monitoring and troubleshooting for Big Data.

Talk Abstract: In the past network measurements were based on the assumption that mainly (over)load and congestion biases network behavior and the observed performance. This is certainly true for stateless copper wire abstractions. But networks have evolved. Nowadays modern access networks deploy new methods like reactive capacity allocation and time-slotted operation to optimize overall network capacity. Even in the absence of competing traffic and when operating below load thresholds, the delay experienced by packets on such links depends significantly on previously irrelevant factors such as instantaneous and recent load and absolute send time.

The Representative Measurement Tool (RDM) uses pre-computed stream definitions and randomness re-generation in intermediate nodes to obtain accurate, represen- tative one-way delay results for such network paths. In the talk RDM measurement results from different access network technologies are presented that show the influence of the reactive network behavior and methods to cope with them.

Interested in Discussing: Measurement infrastructures, standardized ways of performing comparable, repeatable measurements

Related URLs:

• Netsec Lab

Talk Abstract: The ability to measure network and server behaviors from different network vantage points is important for understanding the general health of a network ecosystem. There are various platforms, frameworks, and APIs designed and built to accommodate this need. In this talk we discuss a new DNS looking glass framework designed for low-overhead deployment and great flexibility, and available for use with the DNSViz measurement tool.

Interested in Discussing: DNS, DDoS

Talk Abstract: DNS is central to Internet use today, yet research on DNS today is challenging: many researchers find it challenging to create realistic experiments at scale and representative of the large installed base, and datasets are often short (two days or less) or otherwise limited. Yes DNS evolution presses on: improvements to privacy are needed, and extensions like DANE provide an opportunity for DNS to improve security and support identity management. We exploring how to grow the research community and enable meaningful work on Internet naming. In this talk we will propose new research infrastructure to support to realistic DNS experiments and longitudinal data studies. We are looking for feedback on our proposed approaches and input about your pressing research problems in Internet naming and identification.

Interested in Discussing: DNS, research infrastructure

Talk Abstract: The 'ixp-country-jedi' is an attempt to gather data and gain insight into interconnection in a country. It is a framework that takes a set of RIPE Atlas probes in a given country, or set of countries, performs traceroutes between them and analyses this data, specifically for indicators of the measured paths traversing IXPs and for signs of it leaving the country. In this talk I'll detail the methodology and show a few examples of results. Code is available on github Monthly results

Interested in Discussing: collaborative event analysis

Related URLs:

• http://sg-pub.ripe.net/emile/ixp-country-jedi/, Meta Data
• Measuring More Internet with RIPE Atlas
• Eyeballtrace

Interested in Discussing: Infrastructure for aggregation and analysis of data from multiple measurement systems.

Talk Abstract: In a network with 22+ million broadband customers and many datacenters, reliably measuring customer and inter-datacenter link throughput becomes a difficult task. Traditionally maximum throughput testing between a customer and a provider?s infrastructure has been initiated by the customer. Often this is in response to perceived poor network performance and the results can be influenced by varying conditions on the customer's end.

At Comcast we are developing an automated, proactive measurement platform that will be capable of measuring link throughput between nodes hosted both in customer premises and our own datacenters. The platform will consist of standar- dized probe hardware, backend scheduling and data collection infrastructure as well as a user interface. Currently we are developing methods for scheduling and balancing these potentially disruptive measurements to ensure that we don?t destroy the network which we are trying to measure. The data produced by this platform will be used to help us identify possible problem areas on our customer edge network.

Interested in Discussing: Network measurement, large-scale measurement platforms, internetworking in general.

Related URLs:

• Spoofer

Talk Abstract: We compare and contrast the performance characteristics of peering versus transit paths between content providers and eyeball networks. To circumvent the well-recognized limitations of ICMP measurements, we conduct large-scale, end-to-end active round-trip-time measurements for a commercial content delivery network that peers with multiple eyeball networks. We conduct simultaneous performance measurements to thousands of clients in hundreds of eyeball networks via transit and peering paths. Our measurements indicate that peering paths substantially outperform transit paths for more than 70% of our measurements. We further estimate the propagation and queueing delays on the peering and transit paths by analyzing temporal variations in the round-trip-time measurements. We find out that peering paths always achieve lower propagation delay than transit paths. We further conduct traceroutes to find that peering paths have fewer (IP and AS) hops than transit paths. Specifically, we find that peering paths have on average 5 fewer IP hops as compared to transit paths. While peering paths are always shorter than transit paths, we note that about 9% of peering paths experience significantly higher queueing delays as compared to transit paths, thereby indicating queue build up due to under-provisioning. Our results highlight and quantify the performance benefits of using well-provisioned peering paths over transit paths.

Interested in Discussing: Internet Measurement, Content Delivery, Networking

Talk Abstract: ICMP-based tools such as ping and traceroute are widely used to diagnose network performance issues. Unfortunately, ICMP-based tools alone are not suitable for large-scale and long-term measurements due to router rate-limiting and low priority of ICMP response packets. To complement ICMP measurements, web developers and DevOps practitioners increasingly rely on in-browser JavaScript based end-to-end performance measurements to diagnose performance issues. These in-browser JavaScript based performance measurements are widely used in the industry. For example, "traffic intelligence" companies such as Cedexis, Internap, and Dyn leverage JavaScript based delay and throughput measurements to monitor web performance at large scale. These services are used by thousands of customers (content publishers), which are also provided APIs for easy integration and performance analytics.

In this talk, I'll advocate for an open, community-based web performance analytics platform. It requires contributiors (any web content provider) to embded JavaScript tags in their site pages. The JavaScript tag will conduct client-side performance measurements fromm browser against strategically placed servers (e.g., M-lab, PlanetLab, or even more than 100 Raspberry-Pi Ark monitors). The measurements can then be stored and publicly released after suitable processing and annonymization. The data collected in real-time can then be used to develop analytics APIs that can be used by content providers to monitor and optimize web performance. This data can also used by researchers to better understand Internet performance issues. I'll also briefly talk about our deployment experience of such a performance measurement platform for a commercial content delivery network.

Interested in Discussing: congestion; performance measurements; video QoE

Talk Abstract: RIPE Atlas has recently passed its fifth birthday. With over 9000 active agents in the wild, it is now frequently used by both researchers and operators to answer a wide variety of questions. In this talk we'll explore the what's new and relevant for the measurement community, such as new kinds of data access, user interfaces and APIs, community involvement, supporting tools and libraries and upcoming features and measurement types.

Interested in Discussing: Platform security aspects, future Infrastructure, cross-infrastructure coordination and standardisation.

Related URLs:

• RIPE Atlas Result Streams

Related URLs:

• info@mobilyzer-project.mobi
• Differentiation Detector

Talk Abstract: Network and security researchers rely on production active measurement systems that continually gather and curate Internet topology. We focus on the speed and scale of Internet-wide active topology mapping. Conventional approaches to active topology mapping face two primary speed and scale impediments: i) per-trace state maintenance; and ii) path load. Taking inspiration from prior work utilizing permutation scanning and stateless probing, we develop a new tool, Yarrp (Yelling at Random Routers Progressively). We present initial speed and recall results from Yarrping the Internet.

Interested in Discussing: big data / distributed computing approaches to storing and processing internet measurements

Talk Abstract: The Internet has revolutionized the way individuals and corporations communicate and use information. Our globally-connected digital civilization increasingly relies on the faultless operation of the Internet. Any disruption has an effect on reliability, capacity, and quality and therefore poses negative externalities on both the economy and society. Failures of Internet systems are frequent and is the norm to be unnoticeable. Occasional, failures in Internet infrastructures such as IXPs and peering facilities impact the operation of potential hundreds of networks. In 2015, a major incident of one of the most respected and largest European IXPs caused a significant decline in traffic volumes at another large IXP. This talk outlines the preliminary findings and the root-cause for this, at first glance, counterintuitive dependency. Active measurements suggest that the observed phenomena of asymmetric routing plays a significant role. Eventually, we sketch related research questions and discuss future work.

Interested in Discussing: What does the research community think about our findings. Can we think of other causes for the dependencies between large IXPs? How can we account for changing end-user behavior because of disrupted connectivity?

Talk Abstract: One of the challenges of integrating measurement infrastructures is researcher overhead in using different tools. Over the past year, I have worked on adding remote control functionality in scamper, allowing scamper to run on resource constrained machines (like BISmark and SamKnows devices) allowing complication measurement drivers (on powerful systems) to interface with remote scamper instances (on resource constrained systems).

Interested in Discussing: Incentives for tool developers.

Talk Abstract: While a large body of work has focused on understanding how user experience for popular applications is affected by the network, we focus our attention on another critical angle: unreachability due to selective server-side blocking. A common exemplar of such blocking manifests for "anonymous users" --- a growing number of websites treat such users in a degraded fashion, or even block access to them. In this talk, I will discuss the challenges in methodically enumerating and characterizing the scale of second-class treatment of select Web citizens.

The talk will cover several aspects of our experience in conducting such an active-measurement study in the context of Tor users: (i) designing Internet-wide scans from control and Tor-exit nodes using the Zmap tool, in particular validating the workings and reporting of Zmap for our experiments, (ii) developing a methodology to distinguish censorship events from incidental failures, such as those caused by packet loss or network outages, and (iii) consideration of endemic churn in web-accessible services over both time and geographic diversity. The methods that we develop to measure Tor-blocking at Internet scale and calibrate our measurements against confounding factors, such as transient failures and endemic churn, have broader applicability in any Internet-wide measurement study.

This work is in collabaration with: Sheharbano Khattak, David Fifield, Sadia Afroz, Srikanth Sundaresan, Vern Paxson, Steven J. Murdoch, and Damon McCoy. A copy of our paper is available here

Interested in Discussing: Characterizing Internet-wide web-server availability and churn. I'm interested in how we can use both data-plane measurements (from Zmap) and control-plane measurements to understand the different causes of web-churn.

Talk Abstract: Researchers have studied how long dynamic addresses are assigned to hosts before changing, but they have not investigated the underlying causes of address-changes. In this study, we identify IP address changes in RIPE Atlas probes in the first six months of 2015 and analyze different causes of IP address-changes. We find that some ISPs periodically trigger an address-change, with 24-hour periodicity being common in German Autonomous Systems. Further, in some ISPs, most reboots on end-hosts trigger address-changes.

Interested in Discussing: DHCP, IP address churn

Talk Abstract: DHS S&T put out a new five year strategic plan, found here. This talk will discuss the Cyber Security Division goals that are part of this plan.

Interested in Discussing: How to you justify measurement infrastructure to government funders?

Related URLs:

• Cyber Security Division Resources
• Cybersecurity
• DHS Science and Technology Directorate Strategic Plan

Talk Abstract: Scalable and reliable QoE measurement for video streaming is a very challenging problem. On the one hand, network path quality measurement cannot easily reveal the subjective factors of the QoE. On the other hand, traditional subjective assessment in a controlled environment using MOS does not scale. The emulated network environment may not be realistic. Recently, crowdsourcing platforms provide opportunities for researchers to conduct both network measurement and QoE in the Internet environment with a more diverse pool of participants.

We propose using user-behavior analytics to improve the video QoE assessments in crowdsourcing platforms. User behavior, such as pause events, mouse click events and cursor trajectory, contains rich information reflecting users??? cognitive processes. We record and analyze these user behaviors while they review videos in customized video players or crowdsourcing platform. In this talk, two applications of user-behavior analytics will be shown. First, we illustrate that these user behavior data can be combined with application layer metrics to improve the QoE inference. The second application is to detect low-quality crowdsourcing workers, who may submit random results and threaten the reliability of the QoE assessment.

Interested in Discussing: