Slide 1: state of the art in visualization of Internet data:

state of the art in visualization of Internet data:

topology, workload, performance and routing

11 January 2000


       scientific apparatus offers a window to knowledge, 
       but as they grow more elaborate, 
       scientists spend ever more time washing the windows. 
                                     -- Isaac Asimov 



kc claffy, UCSD/SDSC/CAIDA
kc@caida.org 
www.caida.org

Slide 2: SDSC visualization research

SDSC visualization research 


SDSC Vislab research:
modeling complex conditions
extending interactions
scalable visualization toolsets

CAIDA research at SDSC:
analyzing characterization criteria
correlating different datasets
visualizing events and trends

Slide 3: CAIDA vis: aiding Internet analyses

CAIDA vis:  aiding Internet analyses


identify and present insights into

topology
historical workload trends
active performance evaluation
routing efficiency

represent complex behavior, including

correlation of large datasets
enabling drill-down

Slide 4: CAIDA vis: Internet visualization

CAIDA vis: Internet visualization 


helping to manage explosive growth throughout the Internet

enhancing ability for providers and users to interpret vast quantities of data in real-time

@@@
creating user-friendly integration with network utilities and control systems

Slide 5: CAIDA vis: challenges

CAIDA vis:  challenges


manage complexity 
enable inter- and intra-ISP analysis and feature detection

develop new methods for data collection, reduction, aggregation, and mining (GByte or Tbyte datasets)

manage data that is geographically and logically distributed as well as dynamically changing

Slide 6: => visualizing topology: overview

=> visualizing topology: overview

        
several methods available

geographical

logical

hyperbolic (T. Munzner,Stanford)

Slide 7: visualizing topology: skitter

visualizing topology:  skitter

macroscopic, infrastructure-wide 
dynamically discover/depict topology (& b/w)
correlate path perf. w events, e.g. BGP
identify critical pieces of infrastructure

Slide 8: skitter: infrastructure-wide measurements

skitter: infrastructure-wide measurements

17 monitors (inc. 1 root name server)
multiple dst lists (29k servers, 36k dns)
architecture:
     - parallel ICMP probes
     - 52-byte packets
     - kernel time stamping
     - ssh / Kerberos

Slide 9: skitter: colored by more countries

skitter: colored by more countries

Slide 10: skitter: AS interconnectivity

skitter: AS interconnectivity

Slide 11: topology vis: geographic mapping

topology vis:  geographic mapping


difficult data analysis
requires mapping of thousands (millions?) of nodes to latitude/longitude coordinates

NetGeo service designed to help
http://netgeo.caida.org

backbones require company-specific heuristics

DNS registry growth is problematic
no common data formats

Slide 12: GTrace: geographic traceroute

GTrace: geographic traceroute
  
www.caida.org/Tools/GTrace/

Slide 13: semi-geographical topology (otter)

semi-geographical topology (otter)

www.caida.org/Tools/Otter

Slide 14

logical vs geographic topology
 

2-dimensional, hierarchical


geographic

Slide 15: skitter: 3D hyperbolic

skitter: 3D hyperbolic 
 
making huge topology graphs navigable

Slide 16: differencing routing tables

differencing routing tables 

www.caida.org/Tools/Mantra (multicast)

Slide 17: topology vis: research priorities

topology vis:  research priorities 


identify & extract features from large, complex datasets:
enable dynamic feature detection 
develop better data aggregation/reduction techniques
create meaningful displays, user-friendly tools
accurately correlate different datasets

obstacles:
     mapping IP addresses to ... anything meaningful

Slide 18: => visualizing Internet workload

=> visualizing Internet workload 

many uses
workload profiling 
performance and QOS assurance across ISPs
accounting/billing

measurement tools
router-based (cflowd, netflow)
stand-alone monitors (coral,skitter)

traditional vis can be helpful
time series, box&whisker, etc.	
3D real-time flow analysis

evolution requires use
envisioning new methods?
better data correlation tools are essential

Slide 19: traffic workload by protocol

traffic workload by protocol

Cichlid animations http://moat.nlanr.net/Cichlid/

Slide 20

traffic workload by protocol 

19 aug 99, ucsd-cerfnet

Slide 21

workload by protocol proportions 

19 aug 99, ucsd-cerfnet

Slide 22: visualizing workload by applications

visualizing workload by applications 
(e.g. ucsd-cerfnet)

Slide 23: multicast workloads (using mantra)

multicast workloads (using mantra)

18 oct 99, fix-west.mbone.nasa.gov

Slide 24: workload vis: research priorities

workload vis:  research priorities 

id and present `useful' workload metrics, particularly given persistence of fire-fighting environment

id significant patterns, timeframes, correlations
vary by user need
change as technologies and 'net change

obstacles:
limited access to commercial networks
network performance impact 
faster speeds and changing transport technologies complicate data acquisition and processing

Slide 25: => performance evaluation vis

=> performance evaluation vis

 
  useful for:

diagnosing problems

verifying service level agreements 

predicting software HCI for network apps

providing Internet weather reports

Slide 26: IPPM visualization

IPPM visualization (ippm-db.advanced.org)

Slide 27: perf. eval: skping (www.freebsd.org)

perf. eval: skping (www.freebsd.org)

Slide 28: perf.eval: routing (path change)

perf.eval: routing (path change)

Slide 29: perf.eval: sktrace (www.cnet.com)

perf.eval: sktrace (www.cnet.com)

Slide 30: performance eval vis: priorities

performance eval vis: priorities 


faster data collection, faster processing, faster rendering

need intuitive graphic presentations correlating:
performance across sources
comparisons w/topology, workload, routing analyses

obstacles
poorly defined user requirements/interfaces
negative perceptions regarding quality and worth driven by explosive growth

Slide 31: => visualizing routing efficiency

=> visualizing routing efficiency



sausage/laws....

how best to identify outages, flaps, critical paths

how best to meet real-time challenges

currently non-intuitive, incantation-driven

Slide 32: routing: example (instability)

routing: example (instability)


RTT data changes color if path changes
10 unique paths over 24 hour period
lots of jitter in data
unlikely to be intentional 
heavy tails predominate

Slide 33: routing: example (load balancing)

routing: example (load balancing)


RTT similar over predominantly 2 paths 
likely intentional load balancing

Slide 34: routing: sktrace (parc.xerox.com)

routing: sktrace (parc.xerox.com)

Slide 35: routing vis: research priorities

routing vis:  research priorities 


better IP routing instrumentation 
real-time analysis without interfering with performance
realistic inter-domain routing models

tasks
identification & vis of flaps, outages, critical paths
correlation with performance problems
analysis of asymmetries and routing instabilities
analysis of effects of unicast/multicast incongruities

Slide 36

routing vis:  research obstacles


routes may change faster than ability to measure or analyze

poorly instrumented infrastructure (new tools needed)

mapping IP address to anything 
  (deja vu)

prudent security dictates inhibiting research

Slide 37: now what?

now what?  


the ideal:
well-instrumented infrastructure 
seamless integration of variety of data sources
important for simulation/prediction
but unlikely for the foreseeable future

a case study (real-life problem)
optimize root name server location
use visualization to correlate data sources / types
use collaborative project to encourage 
       proactive participation 
       (network operators, researchers, others)

Slide 38: => skitter: macroscopic case study

=> skitter: macroscopic case study 

DNS f root server (pv's):  path wingspans 
www.caida.org/Tools/Skitter

Slide 39: skitter: rtt vs hopcount (correlation?)

skitter: rtt vs hopcount (correlation?)

Slide 40: skitter: rtt distribution: tri-modal

skitter: rtt distribution: tri-modal

Slide 41: skitter: rtt vs longitude (light cone)

skitter: rtt vs longitude (light cone)

Slide 42: dispersion among ASes across paths

dispersion among ASes across paths

Slide 43: dispersion among ASes across paths (sdsc)

dispersion among ASes across paths (sdsc)

Slide 44: dispersion among countries across paths

dispersion among countries across paths

Slide 45: Internet visualization summary

Internet visualization summary


CAIDA research pushes boundaries
analysis of complex conditions
management of large datasets
correlation between different datasets
development of timely, insightful visualization 

new CAIDA Vis group will investigate
tool integration
user interface improvements
networked collaborative environments

Slide 46: potential payoffs

potential payoffs


give insights to vendors re next 
   generation hw/sw requirements

calibrate user activity (e.g., moni-
   toring service level agreements) 

provide diagnostic and planning tools 
   for ISPs 

identify and quantify infrastructure 
   dependencies for researchers

Slide 47: www.caida.org/Presentations/

www.caida.org/Presentations/

kc claffy
UCSD/SDSC/CAIDA
kc@caida.org
www.caida.org