Cooperative Association for Internet Data Analysis Visualization ISMA 9904 survey replies


James Abello
Kevin Almeroth
Hal Burch
Bill Cheswick
Glenn Chisholm
kc claffy
Bryan Christianson
Glenn Denison
Martin Dodge
Stephen Eick
Steve Feldman
Linton Freeman
Arne Frick
Taosong He
John Heidemann
Bradley Huffaker
Greg Johnson
Jerry Jongerius
Linda Leibengood
Stuart Levy
Carl Malamud
Daniel McRobb
Tracie Monk
Tamara Munzner
Rikki Nguyen
Stephen North
Prashant Rajvaidya
Shankar Rao
Rob Rice
Greg Staple
Bill Woodcock


  1. Biosketch - including name, affiliation, title and description of activities/accomplishments (relating to Internet statistics and metrics analysis and/or visualization)

  2. Describe your current activities / future plans in the field of networking/visualization

  3. Identify visualization tools that are or might be suitable for visualization of networking data -- please comment on their strengths and/or weaknesses. (We are especially interested in hearing about tools that are not widely used, but have potential for these applications.)
    [if you are willing to demo or make a presentation on any of these tools, please identify and specify your space/equipment/network requirements]

  4. Identify what you see as the past, present, and future of networking needs relative to visualization.

  5. Identify relevant URLs covering tools or initiatives in this sector


James Abello

  1. Name: James Abello
    Affiliation: AT&T Research
    Title: Member of Technical Staff
    Department: Information Visualization

  2. My current research emphasis is on the development of visual methaphors to aid the navigation of external memory graphs.

    Co-editor of an upcoming book: External Memory Algorithms, DIMACS-AMS special volume (J. Abello, J. Vitter, Eds)

    We plan to have some of our tools available with a software infrastructure for our power wall;

  3. Pad++,Hyperbolic Drawer, Checker-Board, VTK (I may be enticed to speak about the checker-board computational engine. The visual interface is being developed with T. Munzner)

  4. New methaphors, distributed visualization Power-Walls, visualization architectures, New forms of interaction with visual images.

  5. (no URLs supplied)

Kevin Almeroth and Prashant Rajvaidya

  1. Kevin Almeroth
    Assistant Professor
    University of California, Santa Barbara

    Prashant Rajvaidya
    Graduate Research Assistant
    University of California, Santa Barbara

    We have worked on several projects that look at monitoring multicast group membership and traffic statistics. To date, our group has done little formal work in visualization but that is the purpose of attending this workshop.

  2. We have collected RTP/RTCP stats, SAP stats, and Cisco router stats (at FIXW-MBONE). Most of these efforts have been at single locations. Future work will expand this effort to multiple sites. In the case of the SAP stats (collected from SDR), we have a global view but little connectivity information. A key future goal is to add some topology information to our results.

  3. While we are aware that good visualization tools exist, we are unfamiliar with what tools we should use, what data we need, and how best to visualize the data we have.

  4. One direction for multicast visualization will be based on having tools that support easy-to-use and intuitive management interfaces. Our opinion is that visualization will play a key role in these management tools if they can be integrated seemlessly.

  5. Two URLs:

    sdr session monitoring effort:
    multicast router traffic collection:

    I'll give a demo as necessary.

Hal Burch

  1. Hal Burch
    Carnegie Mellon University
    Graduate Student

    I work with Bill Cheswick of Bell Labs on gathering and visualizing networks, especially the Internet, as seen from one host.

  2. My current activities include:
    • extended my work with Cheswick to 3 dimensions, which has yielded only limited success thus far
    • improving the gradiant descent method ches and I came up with this summer to produce better layouts, and faster
    Future plans:
    • interactive exploration of large graphs, based on offline layouts expansion and collapsing of parts of networks think will be especially helpful in 3 dimensions
    • combining data from multiple source machines looking at explosion (how much new information for adding a host?) how many machines necessary to get a `good' cover of most edges/machines?
    • the interesting one: movie of growth of Internet

  3. since the main data set I work with is connectivity of large networks, I can comment only about tools to handle that data set. Basically, these are pretty sparse graphs with around 100,000 nodes. I won't comment on geographic-layout programs, as I view them as a dead-end.

    Tamara Munzner's tool is helpful, although displays only a smaller portion of the network at a time

    Our tool (ches and I) can display fairly good pictures, but must be done off-line, and still not real satisfying

    The rest of the tools I've seen do fairly well on smaller graphs, but not so well on large graphs (CAIDA'a otter, for example).

  4. overall, we need better ways to visualize internet-based data. for network layouts, the graphs are large, and i don't know how good the best possible complete layouts will look, but the more data one can display reasonably, the better. for traffic data, the conglomeration is generally easier, as we understand its structure much better (eg, if it's tcp port 80, it's web traffic). the effect of traffic on network performance is not well-understood, but my impression is that it's more of a problem of testing than visualization.

  5. network layout:
    Jamin has a good hub on this sort of stuff:

    Bell Labs: (well, not really it)



    Tamara's stuff was really designed for web sites:


    traffic data:
    many others

Bill Cheswick

  1. Bill Cheswick, Bell Labs/Lucent Tech. Member of Technical Staff.

    With Hal Burch I have been systematically collecting internet reachability data from a test host to targets on most announced networks. This database probably locates most important routers on the Internet, and maps the topology with regard to our outgoing packets.

    A portion of the Internet is scanned daily, with occasional full scans. Each day's database has been archived, and may become a useful historical resource. The archive includes includes naming information for each node, when available.

    We have used a spring-simulation algorithm to attempt to lay out this data in a pleasing and useful graph. Our recent graphs plot a minimal distance tree, which makes most paths traceable. Though this does not necessarily plot the actual path, it does show connectivity information.

  2. We plan to continue collecting this data routinely for a period of years. We hope to make a movie of the Internet's growth.

    The mapping technology is quite useful on intranets, and we are working on tools to map and monitor intranets.

    We also plan to commercialize the Internet layout as a poster.

  3. Others are working on interactively visualization of these databases, which is clearly a useful goal.

  4. 3D paper would be great. High-pixel displays would be helpful. Both seem remote.


Glenn Chisholm

  1. Glenn Chisholm

    Involved in the development of applications for AARNET (Australian Academic Research Network) to monitor/record and summarise the traffic flows and consumption of the member institutions as well as the performance of the circuts of the providers. Designed to use NNstat and CISCO Netflow data sources.

    Visualisation of BGP routing tables using knowledge modeling tools.

  2. Development of an application to follow on the work of Plankton to visualise the geographical and topological placement of the most popular sites as seen by the NLANR caches.

  3. Noetica a Knowledge Modeling tool, whose primary purpose is to categorise, classfy and retrieve information. It is a generic tool that can be used to visualise information quite easily. Not developed by me, however I can contact my old proffesor and see if she would allow me to demo it if you are interested.

  4. Put the tools in the hands of the networking community.


kc claffy

  1. k claffy
    Internet data analysis and visualization
    are primary research areas


    we're trying to make them more relevant to ISPs but really need feedback from those using them in the field to do so. (Otter, Skitter, cflowd, Coral)

    will give overview of caida viz tools on main agenda

  4. (1) similar to other fields, so need to extract as much wisdom as possible from those who have gone this way before (airline industry, telephone network, electric power grid)

    (2) but very difficult to make them relevant to espeically large/backbone ISPs without feedback on use in field.

    (3) also difficulty scaling up to number of nodes ISPs need to visualize/simulate (tens of thousands)


Bryan Christianson

  1. Bryan Christianson, currently Programming Manager at a large New Zealand ISP, author of Macintosh traceroute/route mapping utility WhatRoute.

  2. Further development/enhancement/bug fixes to WhatRoute. The project has been in stasis for the about 12 months as my day job has taken precedence. Currently adding a database of locations and end user update capability of this database to WhatRoute.

  3. I can demonstrate and talk about WhatRoute. I'll be bringing a Mac laptop so as long as there's somewhere to plug into the 'net, all should be cool.

  4. Data, data, data.


Glenn Denison

  1. My name is Glenn Denison. I work for Verio, Inc as a Senior Software Tools Engineer in the Backbone group. I've been working as a software engineer since 1982. I've worked on a variety of projects over the years, including the design and implementation of several debuggers. I'm new to Verio, (since January of '99), and also new to networking. I'm responsible for supporting the backbone engineers by developing or acquiring tools for analyzing and engineeringi traffic on the backbone.

  2. I'm currently developing some simple tools to display traffic between routers graphically using color to indicate different traffic levels.

  3. I'm not familiar with any visualization tools other than those already documented at CAIDA, but am certainly interested in hearing about them.

  4. Since I am quite new to the subject area, I think I will refrain from making any pronouncements about its past, or future direction.

  5. (no URLs supplied)

Martin Dodge

  1. Martin Dodge
    Researcher, computer support officer and part-time phd student Centre for Advanced Spatial Analysis (CASA), University College London |

    Actively researching the geography of the Internet, the Web and Cyberspace for past three years in a project rather grandly titled "Cyber-Geography Research" and results are presented on the cybergeography web site.

    My background is in human geography and geographical information systems (GIS).

  2. I am involved in various small-scale and ongoing projects to measure, analyse and map the geography of the Internet. Many of which form the basis for my part-time phd in cybergeography which commenced Jan. 1999.

    I am involved in analysing and mapping the geographic patterns of ownership of Internet addresses (IP and domain names) in the UK and Japan with colleagues Naru Shiode and Matt Zook.

    I am beginning a project to analyse and map the content and hyperlink structure of the WWW in the UK, again with Naru Shiode. I am also investigating the social geography of visual MUDs. I am interested in whether multi-user virtual worlds could be used as environments for data visualisation and exploration.

    With geography / urban planning colleagues from UK and US, we are beginning a small project called "Internet Census" ( to work on means to measure the Internet in ways meaningful useful for geographic analysis.

    Lastly, I am very interested in the visual style and metaphors others employ to map the Internet and other parts of Cyberspace. I attempt to catalogue these into an "Atlas of Cyberspaces" and I am writing a book (with a colleague Rob Kitchin) on this.

  3. I guess the most obvious tools that I know something about (and that are likely to be less know in the viz / Internet tech. communities) are geographical information systems, GIS. There is a mature, billion dollar industry in commercial GIS and associated geographic data (like census, demographic, roads, satellite images etc.). The strength of GIS are in the storage, handling and analysis of spatial data. Widely used in utilities for AM/FM of their networks. Could also be useful for analysing ISP networks and data in relation to other geographic data such as census demographics.

    Weaknesses include constraints of planar, map storage and representation inherent in most systems, are well as costs and proprietary nature of many GIS.

  4. As an end-user of the networks who does not really understand the full technicalities of the network I would argue for metric and visualisations of them that are meaningful to the wider user community.

    Also, as someone from outside the US, I would argue for more attempts to measure and map the Internet to extend beyond the North America and try to show more of the global nature of the Net.

  5. I'm not sure I can provide any fresh URLs that others will have provided.

Stephen Eick

  1. Stephen G. Eick
    Visual Insights/Lucent Technologies
    CTO Visual Insights

    I've been involved in the creation of several innovative and novel tools to visualize network data.

  2. In Visual Insights we produce a line of products for analysis and presentation of data. Our tools are particularly strong for scalability large datasets.

  3. SeeNet - visualizing time-varying network flows

    SeeNet3D - 3D visualization tools for network flows

    Visual Insights Advizor - workbench for rapidly constructing visual analysis tools

    I'll try to demo these tools using my laptop.

  4. A key research problem is how to scale visualization techniques to keep up with the larger and faster networks that are now emerging.


Steve Feldman

  1. Steve Feldman, MCI Worldcom/MAE Engineering, Network Architect
    I collect lots of statistics from the MAE infrastuture, then try to figure out what to do with them before my disks fill up.

  2. Purely ad-hoc activities, in response to specific needs at the moment. There's got to be a better way.

  3. I don't know of any, other than MRTG which is surprisingly useful given its simplicity.

  4. To be useful in a real network operations and engineering environment, the visualization tools need to display relevent data in a form that can be quickly understood. Of course, that's easy to say, but hard to accomplish unless everyone involved knows what the relevant data is, and how presentation methods would affect understanding of the data.

    I don't claim to have any good answers.

  5. Some of my own feeble attempts are publicly available at

Linton Freeman

  1. I am Linton Freeman. I am a Research Professor in the Institute for Mathematical Behavioral Sciences at UC Irvine. My specialty is social network analysis and I am the founding editor of the journal Social Networks. For the past four years I have been working on problems of visualization of static and dynamic social network structures. I am chairing an invited session of the 1999 meeting of the American Statistical Association on that subject. My work is in the more general area of social networks, and not specifically tied to computer-based networks. But since the computer-based networks are simply a special case of social networks, this approach is relevant.

  2. I have been exploring the possibilities of adapting existing programs from graph theory and molecular modeling for displaying social networks. In addition I have written several small, special purpose programs in this area. In addition, I am working with a team on the development of a general purpose, platform free, program that would allow users to explore and display social networks.

  3. I have already identified a large number of tools in a series of reports that are available on the web (see below).

  4. We need to learn more about what viewers actually "see" when they look at visual displays. Too much has been assumed about what are "good" displays, and too little empirical research has been conducted. See the paper by McGrath, Blythe and Krackhardt on the web page designated below. I currently have a PhD student, Jeff Stern, pursuing research in this direction.

  5. Please see:

Arne Frick

  1. Name: Arne Frick
    Affiliation: Tom Sawyer Software, Research Staff Member

    own activities/accomplishments related to visualization: fast and practically useful 2-D and 3-D spring embedders for visual topology analysis and exploration company activities/accomplishments related to visualization:
    • commercial high-quality relationship visualization technology that is
      • scalable
      • portable (C++, Java)
      • fast
      • reliable
    • core strength is network topology display; customers include
      • Cisco
      • Lucent
      • Nortel/Bay Networks
      • HP
      • NetSuite
  2. I shall describe the current activities and future plans of Tom Sawyer Software, the leading supplier of graph topology layout components for network design, management and optimization applications.

    Due to the growth in Internet usage and adoption of Java in networking applications, we have seen more need for high performance visualization. As a result, we have developed features in our new products that address these needs.

    In the past year, we have seen market demand for Java rise significantly and responded to that by introducing Java versions of our successful software components, Graph Layout Toolkit and Graph Editor Toolkit. The latter is not just a Java port of an existing C++ product, but a complete redevelopment with many new features, such as unlimited undo/redo capabilities and a client-server architecture to support thin client solutions. One area that we worked hard on was making sure Java could meet performance requirements for large network/Internet scale applications. Our 3.0 release is capable of displaying and laying out graphs with thousands of nodes.

    In the next few months, we plan to introduce a new version of the Graph Layout Toolkit, featuring

    • a Model-View-Controller architecture separating graph models from their visualizations
    • a renewed, fully incremental layout system
    • faster lookup data structures for hit testing

  3. Naturally, I am biased here towards my company's tools. I'll leave it to others to judge whether they are widely used or not :-;

    However, I'd be happy to demonstrate the brand-new Graph Editor Toolkit for Java 3.0, which is a 100% Pure Java solution that provides customers with a thin-client fully programmable graph editor. In addition, it is capable of communicating with an industry-standard Graph Layout Toolkit server component, which can be either locally installed or a remote server, and which provides automatic layout capabilities.

  4. Past: graph drawing, automatic layout
    Present: scalable commercial tools to display network topologies
    more navigation and customization features


Taosong He

  1. Name: Taosong He

    Affiliation: Network & Services Management Research Department Bell Labs, Lucent Technologies

    Title: Member of Technical Staff

    1. T. He, "Java-Based Network Simulator Front-End", to appear in VisSym'99, Joint EUROGRAPHICS - IEEE TCCG Symposium on Visualization, May, 1999, Vienna, Austria.
    2. T. He, "Java-Based Visual Interface to Network Simulator", to appear in Applied Telecommunication Symposium, San Diego, CA, April, 1999.
    3. T. He and S. Eick, "Constructing Interactive Network Visual Interface", Bell Labs Technical Journal, 3(2), Spring 1998.
    4. K. Cox, S. Eick, and T. He, "3D Geographic Network Displays", SIGMOD Record, 25(4), December 1996, pp. 50-54.

  2. Developing interactive visualization and management systems to complex networks, including building Internet-based visual interface for the monitoring and control of networks. More specifically, we are developing a Java-Based visualization package to support the research/products of IP networks, including automatic network configurations, anomaly detection, event correlations, and many more.

  3. HP OpenView: strengths: provides a suite of solutions to the network management tasks, including configuration, monitoring, trouble shooting, and network layout. It supports IP protocol and many network equipments.

    weakness: OpenView is not designed as a visualization system, although it supports automatic network layout. It is not easy to add control or new views for some specific applications.

    NicheWork: Developed by Graham Wills of Bell Labs/Visual Insight.

    strengths: provides the capability of analyzing the patterns from very large network. It has been built and supported by Visual Insight product.

    weakness: do not support network management and monitoring tasks.

  4. For networking researchers, "visualization" usually means nice graphics user interface, effective network layout, and smart applications of colors and statistical charts to present real time information. The visualization researchers have successfully introduced many more advanced visualization techniques into some network applications, such as view linking, pattern recognition, and visual fraud detections.

    The future challenges include among many scalability, real time, and applications. First, Real networks such as an Intranet are usually very large and complicated, and users could be required to simultaneously visualize and control many kinds of heterogeneous information. We need to find the best level of detail mechanism to display the network information. Second, to deal with large amount of real time information possibly collected through Internet, simple animation is usually not enough. We need to be able to present the visual interface to assist users aggregating and comparing network attributes. Finally, the network applications, especially for IP networks, are quickly expanding. This has posed many interesting problems to network researchers. For example, how to collect information from MIB and put probes in a network to automatically detect its configuration and/or predict network faults? Network visualization could potentially play a very important role in these applications. However, we need to first address problems like distributing visualization, security, and bandwidth. More importantly, we need to invent more effective visual metaphors and interactive controls for these applications.


John Heidemann

  1. John Heidemann, USC/ISI.

    Working on the VINT project with the ns and nam, the LBL/UCB/VINT network simulator and animator.

  2. Our current visualization efforts are centered around enhancing nam. Recently we added support application-specific time/event graphs and simple scenario input/editing. Planed enhancements include:
    • better scenario editing capability
    • conversion tools to make it easier to import raw network data into nam
    • better support for user-customizable visualization
    • more experience and better support for large-scale visualization

  3. Nam is our primary visualization tool. Currently it provides very good support for visualizing simulation output for up to 100s of nodes. For weaknesses, see (2).

    Currently nam is primarily used to visualize network simulation output, but it has been used to visualize network traces. We are working to make playback/conversion of real network traces easier.

  4. Past visualization work has focused on the very large (mapping ``the Internet'' and its traffic) and the small (detailed traffic over small networks). Visualization must push into the middle area and provide approaches to understand what happens to 100s of nodes in enough detail to be useful but with enough abstraction that the user isn't overwhelmed.

  5. VINT/ns:
    nam samples:

Bradley Huffaker

  1. Bradley Huffaker
    Cooperative Association for Internet Data Analysis (CAIDA)
    Primary author of Mapnet, Manta, Plankton, Otter

  2. Currently working on a 2D visualization of network data collect by Skitter.

  3. MRTG
    Distance Vector Multicast routing Protocol

  4. In the past many visualization, including my own, have simply tried to present the data in the hope that some "insight" might be gained simple from the fact that we have presented the data. What is really needed is a set of good questions. These questions will help us find what kind of visualization is needed, what data to use, and what data we can safely ignore.


Greg Johnson

  1. Greg Johnson is a Senior Programmer Analyst in the Scientific Visualization group at the San Diego Supercomputer Center located on the campus of the University of California San Diego. He holds both a B.S. and M.S. in Computer Science from the University of Alaska Fairbanks, with an emphasis on computer graphics. His areas of interest include high performance computing as it relates to computer graphics, collaborative scientific visualization, and web-based information delivery. Greg is a contributor to the Smithsonian Information Age exhibit, the Association for Computing Machinery's (ACM) Special Interest Group on Computer Graphics, and the SC (Supercomputing) Conference Series sponsored by IEEE and the ACM.

  2. None (at this time) that are specific to visualization of networking data.

  3. Traditional general purpose scientific visualization tools including AVS and IBM Data Explorer (DX) offer one possibility. In particular, these systems may offer an easy starting point to those interested in evaluating the applicability of traditional vis. algorithms to networking data. Also, tools like AVS and DX are available for a variety of platforms offering scalability from the PC to high-end workstations, improving both the size of data which can be effectively visualized, and interactivity with the data.

  4. There seems to be a need for tools which can present complex statistical information regarding networking performance, in an easy-to-understand visual format which can be interactively explored and updated in near real time.

  5. Unknown.

Jerry Jongerius

  1. Jerry Jongerius
    Datametrics Systems Corporation
    Author of VisualRoute (a Java program that displays a trace route on a world map)

  2. I am currently working to add more features into VisualRoute. In the future I plan on creating new products for the visualization of Internet related performance metrics.

  3. VisualRoute. Strengths: Its pattern and rules based database is able to adapt to network changes; Most Internet backbones are covered. Weaknesses: There is no widely accepted way of specifying the geographical location of network nodes, so the VisualRoute database must be built by hand.

  4. Either: a) A way of convincing the industry to follow RFC 1876 or b) A new RFC for finding the geographical location of network nodes that the industry will follow and use.

  5. VisualRoute:
    RFC 1876:

Linda Leibengood

  1. Linda Leibengood
    Technical Staff
    UUNet Technologies (formerly ANS)

  2. My primary focus is network performance monitoring and reporting. In addition to real-time alerts, we do a variety of periodic reporting and QoS tracking of our backbone loss and latency. To date, all data has been presented in ascii matrices or simple x-y plots. We know there's a better way. A goal in attending the workshop is to learn more about what tools exist and how they might best be applied to our data.

  3. I'm not aware of any that wouldn't already be known to this group.

  4. My perspective is a network management/operations one. Generating real-time alerts for loss or latency exceeding thresholds is easy and we do it. Visualization tools that would aid operations in determining the problem link(s) or potential cause would be invaluable.

    Over time we've come up with some simple metrics for tracking the overall performance of our network. When they change, the question is why and we find ourselves looking at nxn loss or delay matrices. Visual ways to "diff" loss or latency for a small to medium network (tens to hundreds of nodes) at different points in time or against "expected" values would be very useful.

  5. none

Stuart Levy

  1. Five of us at NCSA, U. of Ill. Urbana-Champaign, including two from the NLANR Distrib. Appl. Support Team, are interested in building 3-D interactive graphical tools to view network utilization & behavior over time, and also to allow correlating general network behavior with performance of a particular distributed Grid application. We are:
    • Donna Cox, Prof. of Art & Design, and NCSA (
    • Robert Patterson, NCSA, Research Programmer (
    • Mark Gates, NCSA DAST, Research Programmer (
    • Stuart Levy, NCSA, Sr. Research Programmer (
    • Meghan Thornton, NCSA DAST, Research Programmer (

  2. We've been talking with Kevin Thompson et al. at MCI, and thinking in terms of tools suitable for visualizing vBNS (& Internet2) traffic measurements. So we'll punt on scaling problems; our visualizations will look at graphs with dozens or hundreds of nodes, not tens of thousands. However, we care about various time scales -- from few-minute samples to historical data spanning the lifetime of the network.

    Beyond absolute traffic kinds of measures, we'd like to be able to determine "normal" behavior of bits of the network over various time scales and display values relative to that.

    We'd like to make tools that are useful in practice to network operators and application developers on current networks, and look nice, rather than creating a general framework on which all future efforts should build, etc.

  3. Mark Gates can show tools he's created: "netlog", a C library to instrument an existing network application and log performance data, for archival or for live display using... "viznet", a Java tool to view throughput/bandwidth data from netlog and (potentially) other sources.
    To demo these, he'd need a unix workstation to show netlog, and any platform with Java 1.1 to run viznet.

    Besides creating desktop graphical tools, we'd like to integrate the intended vis system into the Virtual Director, a collaborative framework for navigating through & recording scenes in VR (e.g. in the CAVE). Stuart Levy could demonstrate Virtual Director on an SGI workstation (say an O2). This wouldn't be a network-vis demo though.

  4. Can't speak for network research, but something I (Levy) hope to learn about from ISMA: What are nice ways to store and access all the disparate, erratically-sampled, available data (traffic, delay, mcast-group membership ... X link,node,interface ... X time-interval ...)? Every data collector has idiosyncratic formats for similar things. So will we. But if we can use a scheme that's not completely ad hoc, and build on existing work (e.g. the ARTS library), it'd be nice (and easier to write the tools).

    Characterizing "normal" behavior is something I'd like to learn about, too.

    Mark Gates' tools mentioned above.
    Robert Patterson's animation of the growth of the NSFNet (9MB).
    From Stuart Levy, a little study of MBone packet loss.

Carl Malamud

  1. Carl Malamud is Chairman and CTO of Invisible Worlds, Inc., a Silicon Valley startup focused on creating and mapping information spaces that range from network topologies to more abstract spaces such as the Web, Media, or Document Collections. Carl's prior work includes founding the Internet Multicasting Service which was responsible for creating a large amount of data to inhabit the net.

  2. Our new company is defining a new protocol that is used for serving up data in a way that is suitable for a wide variety of visualization efforts. As such, we have a deep interest in both networking and in the visualization field.

  3. When it comes to actual delivery of visual data to a large number of desktops, most of the current work seems centered around various permutations of hyperbolic trees, such as Inxight's Java tools or the work by Tamara Munzer on SGI's SiteManager. When it comes to tools that can transparently get data, evaluate that data, and then publish it using a wide variety of visual constructs, there is clearly a lack of real solutions.

  4. (blank)

  5. (no URLs given)

Daniel McRobb

  1. daniel mcrobb
    Internet data analysis and visualization are primary research areas

    (evolving and supporting these tools)

  3. Most of the commercial stuff is not adequate for ISPs trying to deploy and maintain large infrastructures.

    we're trying to make them more relevant to ISPs but really need feedback from those using them in the field to do so. (Otter, Skitter, cflowd, Coral)

    will give overview of caida viz tools on main agenda

  4. I'm focused on visualizing routing and performance data in real time and historically. The skitter project is primarily intended to be used to measure forward IP paths (each `hop') from a source to many destinations. Skitter measures the IP path to a destination in a manner similar to traceroute: it increments the TTL when sending packets to a destination and records the router that replies at each TTL until a TTL sufficient to reach the destination is used. skitter uses ICMP echo requests as probes (unlike the default of UDP used by traceroute). When skitter finally receives the ICMP echo reply from the intended destination, it terminates the path probing for that destination and records the round-trip time from the source to the destination and back. see for details.

    Skitter data results in a spanning tree structure originating at the polling host and extending into the infrastructure toward the destination hosts in the polling set. We then aggregate data into a centralized database for correlation and depiction as a top-down, macroscopic view of a cross-section of the Internet from at least a small set of sources. Juxtaposition of such data sets has been a remarkably unattended area given its potential utility in a variety of areas. Analysis of real-world trends in routing behavior across the Internet has direct implications for next generation networking hardware, software and operational policies. Observations of macro-level traffic patterns provide insights into:

    mapping dynamic changes in Internet topologies using the collapsed skitter spanning tree as viewed from the perspective of the originating skitter host

    tracking related performance effects in real-time using skitter's RTT variance data to indicate regions of the infrastructure experiencing abnormal delay

    as a quality check for backbone engineers to compare the expected with actual results of configuration/policy changes

    identifying critical paths in the infrastructure, i.e., routers or exchange points that might be sources of significant network vulnerability.

    performance testing of fielded Internet hardware, e.g., initial skitter measurements identified statistically significant problems on certain routers using network route cache technology.

    Skitter also offers promise in potential correlation to BGP data to allow engineers to discern who is announcing what to whom over specific paths. (We have software to hold BGP RIB attributes (AS path, origin, next hop, MEDs, localpref, aggregators, community) for each path, in addition to RTT values (microsecond granularity) and dropped packet counters). We will eventually integrate Skitter output data with a comprehensive database of physical topologies (e.g., prototypes are CAIDA's java-based topology mapping tools for ISP backbones, the Mbone and caching hierarchy topologies). These data can also help pinpoint routing instabilities and other anomalies, and track their secondary, downstream effects, e.g. on round trip times, availability, packet loss across specific paths. A repository of these data/analyses will significantly enhance our predictive capabilities on the Internet, and holds promise for insights into the infrastructure as a whole.


Tamara Munzner

  1. Tamara Munzner
    Stanford University Graphics Group
    PhD candidate
    Thesis topic: Interactive Visualization of Large Graphs and Networks

  2. ----------

    H3/H3Viewer, a 3D hyperbolic graph layout and drawing system that scales to graphs with around 100,000 edges. It's been incorporated into Site Manager, a free SGI product for webmasters: It's also in use by McRobb at CAIDA:

    Planet Multicast a 3D geographic visualization of the 1994 MBone.


    Constellation, a 2D visualization system for linguistic queries of the MindNet semantic network. (no URL yet)


    Checkerboard, a visualization front end for extremely large graphs which have been chopped into bite-sized pieces by James Abello's hierarchical decomposition algorithm. The targeted platform is a large high-resolution (4000x1500 pixel) display system.

  3. is a list I put together a few years ago of infovis resources. Not entirely up to date, but it does point to a lot of other information sources. (The accompanying bibliography page is quite out of date.)

  4. scalability: networking data tends to be larger than the capabilities of many/most viz tools

    task-appropriateness: many viz tools try to handle the generic case, but a custom-designed tool that exploits domain knowledge might be more effective

  5. See above.

Tracie Monk

  1. Tracie Monk
    Director, CAIDA
  2. CAIDA's priorities are on the development and deployment of tools for measuring, analyzing and visualizing Internet traffic and related data.
  3. Commercial tools are in their early stages; research tools for visualizing Internet data are not much better and often lack "relevance" from an engineering perspective. Several tools are covered at
  4. The purpose of this workshop is to assist with a convergence between the rapidly evolving capabilities of the visualization community and the rapidly growing needs of the networking (particularly operational networking) community. Very little has been done in the past, however, vendors are now being pressed by their customers to come up with new products to serve this increasingly complex sector. I anticipate that this will be a growing, vital industry as we see increasing efforts to gather, correlate and visualized data relating to intra- and inter-ISP traffic.
  5. CAIDA's lists are available at and

Rikki Nguyen

  1. Rikki Nguyen
    Manager of Internet Development
    Cable & Wireless

  2. I am in charge of low level development projects that directly affect the Cable & Wireless backbone (formerly Internet MCI). This includes tools that configure routers (BGP, peering, access lists), tools that perform traffic analysis for our backbone, and network visualization tools that assist in real time monitoring of the network.

  3. I am currently working on projects that support real time monitoring and analysis of a production network. This would include protocol monitoring of BGP and similar protocols, traffic monitoring of SONET fiber, and trending of backbone changes over time.

  4. Something that would track (trending), visualize, and monitor network criticalities such as routing information, topology, and other network metrics. Eventually, a tool that allows simulative changes to a model and one that may even apply those changes to a production network.

  5. none

Stephen North

  1. Stephen C. North
    Head, Information Visualization Research
    AT&T Shannon Laboratory, Room D-209
    180 Park Ave., Bldg 103
    Florham Park, NJ 07932-0971 (USA)
    phone: 973 360 8638 (voice) 8077 (fax)

    I'm not any kind of expert on Internet statistics and metrics, but I've been working in software and network visualization (applied algorithms and tool hacking) for more than 10 years. In January 1998 my colleagues and I started a new department (Information Visualization) in Network Services Research. Most of us participate in the AT&T Infolab, an interdisciplinary program for exploring and understanding data, often at extreme scale, about telecomm networks, services and their underlying information systems.

  2. In the short term our goal is to create useful tools that could apply to many kinds of networks. Rather than focus specifically on deep models of IP we would assume someone else will do the data analysis and modeling and we're more concerned with how to show network data, at scale, in an convenient understandable way. So we would focus on flexible models (nodes, edges, paths, higher-order objects; or topology, static configuration, traffic and events at network elements). We didn't really plan it this way but now I realize it's a direct analog of our approach to software visualization, where we created a generic front end that could be customized to different kinds of graphs, but we let other people work on software databases and repositories (e.g. C++, HTML, etc.) To us they're just graphs. Of course there are differences, e.g. the scale that the front end has to cope with.

    In the long term our goal is to solve the scale problem in graph (network) visualization. We are looking into external memory graph algorithms to help with the data management part of this problem and to organize graphs for visualization.

  3. I would assume others are much more knowledgable about the kind of things you can find on tucows etc.

    I would mention that our group has several mature tools for graph visualization:

    graphviz (gviz) is good for static layout of graphs having up to say several hundred nodes (hierarchical layout and force-directed placement). Works with Unix/X, Java, win32, HTML (GIF/ismap).

    dynagraph is a demo-able, almost useful prototype for dynamic hierarchical layouts. We have front ends in TCL/tk and win32/OLE. (We tried using Pad++ hoping to support compound graphs, but it had too many problems.) I'm hoping to use this for experiments in incrementally browsing small pieces of very large graphs.

    SWIFT-3d is an interactive viewer for large scale network data displayed with geographic maps and standard statistical controls. It can handle drill-down on extremely large scale data, e.g. a day's worth of long distance calls. We're now adapting it to the AT&T Frame Relay network and from there we hope to go to IP networks and web traffic. I have a video though it's a year old, and the work has progressed beyond that point. I can also bring videos of the graph layout work, but I think it's a little far afield for the IP data analysis + metrics who are probably more interested in what the tools can do, than in applied comp geom.

  4. We need visual representations and interaction techniques that can both cope with extreme scale and multiple levels of abstraction e.g. layering in networks and services. We also need effective back end techniques to preprocess large graphs.

  5. We're still working on a new departmental web site. We hired people but no one here has time to meet with them :-) Our tools can be found at Others have used them for on-line demos, see

Shankar Rao

  1. Shankar Rao
    IP Network Engineer
    Qwest Communications

  2. I have been involved with Architecting and deploying Network Management/Analysis infrastructure for Qwest's IP network using currently available commercial applications. I am primarily interested in looking at new ideas and concepts about how we gather and analyze metrics and statistics on large IP networks.

  3. (no tools suggested)

  4. I have not been very actively involved in network visualization for very long. However, with my previous operational and engineering experience with large scale IP networks I feel that we need to look at issues such as defining visual ways of looking at network performance (possible parameters could be packet types, packet sizes, packet loss, overhead (e.g. routing/polling)); from an application point of view - real time applications; and flows based on application/protocol types (e.g. VPN's). I would also like to have the ability to visualize changes in traffic flows (maybe based on origin/destination AS) to understand how potential network/configuration changes can impact traffic.

  5. (no URLs given)

Rob Rice

  1. Rob Rice
    Make Systems, Inc.
    Senior Member of Technical Staff

    Lead engineer on design and implementation of IP and ATM routing models (BGP, EIGRP, IGRP, OSPF, IS-IS, RIP, PNNI) in NetMaker MainStation 3.0. Project lead on automatic model generation from Cisco configuration files.

  2. At Make Systems, we view network visualization not only as getting an accurate picture of the current state of the network, but also the ability to visualize the state of the network under what-if scenarios, such as changes to the network topology, changes in device configuration, changes in traffic characteristics or distribution, or changes in peering relationships.

    In other words, visualization is both of collected data (current or historic) as well as data generated from a model of the network (futures, what-if scenarios) that includes devices, links, traffic routes, utilizations, evaluations of service level criteria, etc. Because of the complexity involved, we strongly associate visualization with the ability to filter information and perform visualization transformation operations on the filtered data.

    Our recent activities at Make Systems have been to complete NetMaker MainStation 3.0, which shipped on March 30. A major focus of this release is the ability to model and analyze the performance of networks with multiple technologies (IP, ATM, and bridging) constructed from equipment from multiple vendors, carrying traffic with diverse stochastic characteristics and service requirements. Another focus has been simplifying model creation. MainStation automatically constructs accurate topology and configuration models from Cisco configuration files or from ASCII data exported from network management tools. MainStation also automates creation of traffic models from sniffers/probes, NETFLOW data, and baseline data. A key aspect of this system is the ability to model the achievement or failure of application service level criteria (delay, jitter, loss) computed on an end-to-end, transaction oriented basis.

    Future plans include

    • Automated design capabilities for multitechnology/multiservice networks
    • network topology analysis
    • support for emerging networking technologies and for developing new features that facilitate model building, traffic engineering, and performance analyses for large ISPs and carriers.

  3. MainStation includes a tool called Visualizer, which generates a graphical representation of a network. Visualizer displays nodes (routers, hosts, switches, bridges, edge devices, FR POPs), links (WAN links, LANs, clouds, ATM virtual paths/circuits, FR PVCs), and traffic flows. Visualizer has a very versatile set of display filters to allow you to create views with a specific subset of elements in the network. Visualizer offers a number of layouts, which determine the relative locations of network elements on the canvas. Links may be colored according to utilization, cost, or speed. Nodes icons can represent either function or vendor. These features allow you to effectively visualize very large networks.

    Other MainStation tools facilitate network "visualization" in a broader sense. Object Editor and Report Engine display detailed information on the configuration of network elements. Planner models the operation of a network to help you visualize the network's performance under what-if scenarios. The Report Engine displays performance results with text and graphics. The Analyzer tool automates failure analyses. The Interpreter and Baseliner tool facilitate the visualization of measured traffic statistics. Interpreter and Baseliner offer extensive sampling, filtering, and aggregation features. The Accountant tool analyzes network cost.

  4. Current challenges for us regarding network visualization include
    • Making effective use of three-dimensional views of the network
    • Scalable collection of end-to-end traffic statistics
    • Mapping of traffic flows to a network model when the traffic endpoints are outside the network model (for example, modeling transit flows across an ISP)
    • Inferring end-to-end traffic patterns from interface statistics
    • Automated construction of integrated models of networks including IP routers, ATM switches, and layer 2 switches.

  5. Make Systems, Inc. home page:

Greg Staple

  1. Greg Staple, Founder and President, TeleGeography. Inc., Wash. D.C. ( Though we have concentrated on mapping the international telecoms world -- traffic flows, bandwidth, carriers -- our yearbook -- TeleGeography -- has long championed the importance of Internet metrics (we published early papers by A. M. Rutkowski and K. Claffy) as well as providing an outlet for cybermaps (eg, by J. Quarterman, M. Dodge, and J. December). We also sponsor a N. American mirror for (

  2. Our recent Internet work has focused on mapping the transmission capacity of major global backbone providers and the dedicated IP bandwidth between country pairs with an eye to teasing out some of the economic and political implications (eg, peering and competition issues), and sizing demand for new undersea cable systems. We are also interested in how the Internet's architecture may affect the spatial distribution of e-commerce activities (eg, location of server farms, caching, demands on international bandwidth, payment flows).

  3. The signal to noise ratio of some of the more popular network visualization tools we have seen leaves something to be desired for a non-technical audience. As such, we are keen to see tool sets (or approaches) for graphically presenting the spatial distribution of Internet content and network relationships in more accessible ways (ie, which are at least as intuitively obvious as a topographical map).

    Equally important, in our view, is the question of which variables drive the visualizations. One interest of ours is the extent to which key variables might shed some light on the comparative market power of various Internet actors and the ways in which traffic flows (loads) may map to payments. What can the graphic display of available -- or possible-- Internet metrics tell us about the viability of different Internet economic models (peering, access and interconnection prices).

    In a more consumer-oriented vein, we also have an ongoing interest in user-friendly graphics which can help someone see how their terminal, server, ISP, backbone fits into the larger Net. Here, perspective may be more important than utility (navigation). Ditto for information searches, which is why some of the tools being developed at Alexa and Invisible Worlds seem promising to us.

  4. See 3. above.

  5. One take on our 1998 survey of global Internet connectivity can be found at

    For those interested in sizing the total international bandwidth available by country see

Bill Woodcock

  1. Bill Woodcock
    Network Architect

    I specify and project-manage the relatively simple visualization tools that we write in-house here, and I try to keep abreast of the commercial tools available in the same space, as well, obviously, as those k's folks turn out.

  2. My attention is primarily drawn to visualization of operational issues, rather than planning concerns... That is, I tend to be more interested in tools which allow the diagnosis of current problems than those which focus on prediction of future growth spots or future bottlenecks. Our in-house tools tend thus to be aimed primarily at real-time data collection from layer-2 and layer-3 transit nodes, and monitoring link quality in real-time, rather than at projecting historical trends, or at visualization of large topologies, or other areas like that. To the extent that we can visualize that using colored maps rather than tables, we do.

  3. I don't think we're using anything that's publicly distributed that everyone isn't already familiar with.

  4. Rather than seeing the whole field moving in some specific direction over time, I suppose I see the field as composed of several fairly distinct problem/ solution set areas... To name a few, there are the sort of real-time diagnostic tools that are needed to localize and understand breakage, whether that be fiber cuts, BGP configuration failures, unexpected traffic loading, or security intrusions. I see work continuing in several of the specific sub-categories of this area... For instance, Dartmouth just released a new version of InterMapper a week or so ago, and we now have an IETF working group dedicated to coming up with a common protocol for exchange of security information between monitors and consoles in real-time. Separately, there are better and better tools all the time for the discovery or extrapolation and visualization of the topology of live networks, using active probes like traceroute, link-and-address analysis via SNMP queries, and the analysis of routing-table dumps or feeds. On a third front, we're seeing more organization and coordination between folks like Sean Donelan, and the Journal of Infrastructural Warfare and other outage- monitoring information sources, and it's only a matter of time before someone does an "Internet weather" equivalent drawing upon those datasets.

  5. (no URL's supplied)

for more information:   info @ last update:  
this page: