Talk Abstract: Network delay is a crucial metric for evaluating the state of the network. We present in this work a structural analysis of network delay, based on active delay measurements of a backbone network, i.e. Between Norway and china. This delay analysis is performed using a subspace method called Principal Component Analysis (PCA). The analysis reveals that the delay time series can be decomposed into two constituents: A smooth periodic trend and the impulsive sparse burst. We call the former the "normal" component and the latter the "abnormal" component. While this structural decomposition is appealing, essentially useful for network state inference and diagnosis; we find that using PCA in delay analysis has the same challenges as used in traffic analysis. Particularly, it experiences performance degradation due to the so called "perturbation phenomenon". Different issues may appear with this problem: How to cope with PCA weakness for network delay analysis? How PCA-based delay analysis, may be used for network state inference?

Talk Abstract: This talk will be an update to the IPv6 deployment measurements presented at AIMS 2010.

Interested in discussing:

• active measurement infrastructure scaling
• measurement best practices (technical/legal)
• data sharing
• IPv6 measurements

Talk Abstract: Internet topology generation involves producing realistic synthetic network topologies which imitates the characteristics of the Internet. Although the accuracy of a newly developed network protocol or algorithm does not considerably depend on the underlying topology, the performance is highly dependent on it. As a result, synthetic topologies are widely utilized by network researchers to analyze performance of their design in simulation/emulation environment. Previous studies on Internet topology generation have ignored subnetworks, which causes the failure of the generated topologies to reflect some crucial characteristics of the Internet. Most topologies are composed of only point to point links which results in a misunderstanding of the degree distribution of the Internet. In this study, we propose a subnet based Internet topology generator. Our study emphasizes the distinction between the observed degree distribution and the real degree distribution. Subnet based synthetic topologies capture both observed degree distribution and subnet distribution based on Internet measurement studies.

Interested in discussing: Internet topology generation

Talk Abstract: The objective of this talk is to give an update on TopHat, which has been introduced last year as an young measurement infrastructure deployed mainly on PlanetLab, with the initial objective of supporting user experiments at various stages of their lifetime. Information gathered about the testbed is used to help experimenters select their resources, leveraging the topological and geographical diversity of PlanetLab. On-demand measurements are also available, and allow to create alerts when conditions of the testbed change. Finally it is possible to query historical archive.

One specificity of the system is to allow the interconnection with third-party measurement infrastructures, to extend its scope, scale and functionalities. The objective is twofold: allowing studies at an even larger scale, and enriching available datasets to increase their value for users. After a short demo, we will introduce our current and future plans for improving the interconnection framework and foster data exchange.

Interested in discussing:

• a topic drafted last year: how can we join our efforts towards consistent/standardized data formats both for bulk download/exchange, and for presenting to the user?
• thoughts about what's missing in tools available for state of the art topology measurements; are there some methodology error we should get rid of ?
• and more generally, our longer term vision of active measurements

Talk Abstract: Network researchers have a need for higher volume and diversity in network measurement data. In this talk, we wil discuss some nascent data-sharing initiatives. The RIPE Measurement, Analysis, and Tools Working Group, together with RIPE NCC, is working to define a system for normalizing and sharing Internet measurements. At a more technical level, Network Measurement Reporting is a mechanism to collect and disseminate broad-based measurements from across the Internet.

Interested in discussing:

• How can we motivate researchers to collect better data, share data with others, and use data from others?
• What tools and organizational frameworks would help improve the simplicity and quality of network research?

Talk Abstract: Explicit congestion notification (ECN) is a key building block in a number of ongoing standardization efforts [Conex] and research projects [Alizadeh]. This paper therefore sought to survey the current state of ECN support on the Internet, updating and extending a similar survey from 2008 [Langley]. (There are a number of reasons to suspect the state of ECN support may have changed including 'server-side ECN' becoming the default on recent versions of the Linux kernel.) In the process of conducting our survey we discovered that some routers incorrectly handle the ECN bits in the IP header, namely clearing the ECT bit. Given that this is a new impediment to using ECN, we sought to carefully measure exactly where this problem occurred. While measuring ECN support to web servers is straightforward, we developed novel active/passive hybrid approaches for collecting similar measurements of paths to clients. This is important because even if some servers support ECN, if the paths to clients contain impediments to ECN usage (which we show they do) the incremental deployment of ECN is harmed.

Talk Abstract: Current large-scale topology mapping systems require multiple days to characterize the Internet due to the large amount of probing traffic they incur. The accuracy of maps from existing systems is unknown, yet empirical evidence suggests that additional fine-grained probing exposes hidden links and temporal dynamics. Through longitudinal analysis of data from the Archipelago and iPlane systems, in conjunction with our own active probing, we examine how to shorten Internet topology mapping cycle time. In particular, this work develops discriminatory primitives that maximize topological fidelity while being efficient.

Talk Abstract: Evaluating and characterizing access ISPs is critical to subscribers shopping for alternative ISPs, companies providing reliable Internet services, and governments surveying the availability of high-speed Internet services to their citizens. Ideally, ISP characterization should be done (i) at scale, to capture the diversity of available providers and their services, (ii) by end users, to guarantee accuracy, and (iii) continuously, to capture dynamic changes due to management policies (e.g. oversubscribed networks) and unscheduled events (i.e. service interruptions). Today, all existing approaches for profiling edge network services offer an apparently unavoidable tradeoff between these goals. This talk presents a novel software-based approach to ISP characterization at the edge of the network that leverages the detailed views offered by popular networked applications. We call the approach C2E - Crowdsourced ISP Characterization at the Network Edge. By passively monitoring user-generated traffic within these applications, C2E is able to capture the end users~R view in a scalable manner. By combining passive monitoring with dynamically extensive, on demand, active measurements, it can achieve the effectiveness of hardware-based solutions, without their associated costs, while retaining the control, adaptability, and low-barrier to adoption of software-based models. We have deployed a prototype implementation of the proposed approach as an extension to a popular BitTorrent client. Our extension, code named Dasu, has already been adopted by more than 20,000 users over the last few months, providing an almost ideal platform for experimentation.

Interested in discussing: End system measurements; home networks.

Talk Abstract: This talk introduces OneProbe, a rather new method for actively measuring path quality, designed to achieve reliable measurement and measure multiple metrics from a single end point. By exploiting TCP's basic data transmission algorithms (and others), OneProbe measures, in addition to RTT, one-way packet loss, packet reordering, and capacity at the same time. OneProbe has been deployed to continuously measure the quality of the Hong Kong academic network for almost two years. Besides the core measurement methodologies, interesting measurement results will also be presented in the talk.

Talk Abstract: When Internet paths experience problems (e.g., an outage or increased packet loss), the impact of the event is largely dependent on the time to 1) identify that problem is occurring, 2) isolate the source of the problem and 3) repair it. While previous work has focused on the first issue, the problem of isolation -- particularly across domains -- remains largely unsolved. In particular, identifying the root cause of a fault between two hosts requires bidirectional path information that is difficult to obtain even with control of both endpoints. In this work, we address this issue by using distributed active probing techniques to enable large-scale interdomain fault isolation with a relatively limited set of measurement hosts. We describe a system that incorporates traditional ping, traceroute, record route and timestamp measurements, along with limited spoofing, to identify failed links (potentially unidirectional) that cause partial outages in real time. Finally, we discuss how our system enables fine-grained failure remediation by identifying working paths between endpoints experiencing outages along their current path.

Interested in discussing:

• Increasing the coverage and diversity of vantage points for active measurements
• Measurements in home networks: what do we need and how do we get it?
• Measurements reflect the application/user view of networks and performance

Talk Abstract: We review four analyses we have previously undertaken to improve our understanding of IPv6 deployment based on independent data sources: address allocation, active topology probing, DITL DNS traffic to root servers, and two web-based survey of address holders from 2008 and 2009.

Talk Abstract: Location-specific Internet services are predicated on the ability to identify the geographic position of IP hosts accurately. Fundamental to many prior geolocation techniques is their reliance on passive landmarks with known coordinates. In this talk, we introduce a new lightweight framework for IP geolocation called "Posit" that only requires a small number of Ping measurements conducted to end host targets. Critical to our geolocation technique is the ability to estimate distance probabilities between targets and a set of passive landmarks without any direct latency measurements required between the two sets of Internet hosts. This significantly reduces the network load of the Posit methodology in contrast to other geolocation techniques that exploit passive infrastructure. We demonstrate that our technique performs significantly better than all existing geolocation tools across a wide spectrum of measurement infrastructures with varying geographic densities.

Talk Abstract: Abstract not submitted

Interested in discussing: Home networks; Anti-censorship

Talk Abstract: See Jordan Augé's talk.

Interested in discussing:

• interconnection of measurement infrastructures
• coordinating measurements with testbed-based applications and experiments that user those measurements
• acceptable use policies for experiments that involve human subjects

Talk Abstract: The spread of residential broadband Internet access is raising the question of how to measure Internet speed. Unfortunately, the accuracy of tools to measure speed (more precisely, available bandwidth and TCP achievable throughput) was rarely tested from hosts connected to residential networks. This paper performs a comparison of state-of-the-art speed measurement tools from hosts connected to two different commercial ADSL networks. Our results show that (when using default settings) some of the tools underestimate the available bandwidth of broadband links by more than 50%. We demonstrate using a controlled testbed that this underestimation happens because current home gateways have a limited forwarding rate.

Talk Abstract: See Hakan Kardes' talk.

Interested in discussing:

• Communications: network protocols, health systems, smart grid communications
• Complex networks: biological networks, social networks, graph data mining, network visualization
• Internet measurements: Internet topology, Internet modeling, network sampling
• Network security: anonymizer technologies, private communication, secure cloud

Talk Abstract: In this talk, I present some geographic properties of Internet topology and routing. We performed 400.000 network routes and we mapped the discovered routers onto the globe by Spotter. By this we are able to uncover spatial properties of the network. The presentation include the analysis of link level geographic properties, the quantification of circuitousness and asymmetry of Internet routes from the geography point of view.

Interested in discussing: geolocation, measurements of Internet topology, routing

Talk Abstract: Governments, researchers, and commercial entities share an interest in mapping Internet resources to physical locations, a process termed geolocation. For example, governments use this data to prepare and plan for adverse events as well as to tax and regulate. Academics use this data to more accurately capture the geographic deployment and utilization of Internet resources. Commercial interests use this data to provide better localized services, target pricing or ads, enforce Digital Rights Management (DRM) restrictions or data privacy requirements, and assign incoming requests for content to the nearest data center storing it.

We examine four free providers Software77, MaxMind GeoLiteCity, HostIP, and IPInfoDB, and four commercial providers Cyscape, IPligence, MaxMind GeoIP, and Digital Envoy. We also downloaded and parsed the Regional Internet Registry (RIR) delegation files. We then examine the degree to which these databases agree or disagree with each other. We follow this with analysis of how these disagrements breakdown by region and organization type.

Talk Abstract: The Internet Topology Data Kit (ITDK) is a collection of topology and supplemental data created by CAIDA as a resource for the research community. This talk will describe the goals and contents of the ITDK.

Talk Abstract: This talk will cover the past year's use of CAIDA's Archipelago (Ark) measurement infrastructure and give an update on the current state and future plans.

Talk Abstract: The goal of our research is to automatically detect performance degradations that affect users online experience. For this purpose, we need data from end-users' machines. We have built an end-host data collection tool called HostView. HostView collects network traffic and system performance information annotated with feedback from end-users. This talk will describe our experience with the deployment of HostView. We will also present some preliminary results on network performance from end-hosts.

Talk Abstract: Understanding the topological characteristics of the Internet is an important research issue as the Internet grows with no central authority. Internet Topology mapping studies help better understand the dynamics of the Internet backbone network. In this talk, we will first discuss issues in link-level Internet topology mapping and present some approaches to handle them. Then, we introduce Cheleby, an integrated Internet topology mapping system. Cheleby first dynamically probes every observed subnetwork in the Internet using a team of PlanetLab nodes around the world. Then, it utilizes efficient algorithms for resolving subnets, IP aliases, and unresponsive routers in collected data sets to provide sample link-level topologies. Different from current topology mapping systems, Cheleby not only regularly samples the Internet topology but also processes the collected data to build more complete maps.

Talk Abstract: Three Tools:

• ShaperProbe: End-to-end detection of traffic shaping - GATech, M-Lab (under submission)
• Pythia: Detection, localization, diagnosis of performance problems - GATech, DoE (early work; 4 months)
• Troubleshooting home wireless networks - GATech, Intel Labs, CMU (early work; 6 months)

Talk Abstract: RIPE Atlas is a new active measurement network launched by the RIP ENCC in November 2010. It's goal is to scale up to thousands, potentially tens of thousands of vantage points and execute built-in and user specified measurements. I will outline the idea, technical background, current status and plans.

Interested in discussing: Active measurements, data sharing, measurement communities.

Talk Abstract: See Nicholas Weaver's talk.

Talk Abstract: NetViews is a tool written entirely in Java that monitors both control plane and forwarding plane paths on the Internet. NetViews achieves this by leveraging a real time experimental BGP collector called BGPMon and traceroute services provided by various looking glass servers located across the world. NetViews visualizes incoming bgp and traceroutes on a geographical overlay map in order to help network operators get a quick and insightful view of their reachability.

Talk Abstract: An overview of the DHS S&T directorate will be discussed including the introduction of the new Cyber Security Division. Specific attention will be given to the Cyber Security Program Areas and the Internet Measurement and Attack Modeling topics.

Talk Abstract: Internet topology maps have been widely studied during the last decade. One common perspective in these studies is to consider the Internet topology as a router-graph where nodes and links represent the routers and the connections between routers, respectively. In reality Internet is a network of routers and subnets such that a subnet can be a multi-access LAN rather than a point-to-point link. An immediate consequence of not accounting for multi-access links is the inflation in the router degree. That is, a router gets connected to a subnet with a single interface, however, the router-graph representation reflects the router as if it has an interface for each router on the same subnet. In this paper, we suggest an alternative framework for representing and analyzing Internet topology maps called network layer maps.

Network layer maps capture the Internet topology as a network consisting of routers and subnets in the form of both point-to-point links and multi-access LANs. We utilize our standalone subnet collector tool called xnet and IP alias resolution algorithm palmtree to construct network layer Internet topology maps.

Interested in discussing: Internet topology measurements

Talk Abstract: Abstract not submitted

Talk Abstract: BGP data collectors such as Oregon RouteViews have provided BGP data for over a decade, but only recently the data became available in real-time. This talk reviews how one can access real-time data, the format used to exchange the data, and some potential uses of the data. The approach is based on a publish-subscribe model where anyone can obtain a real-time feed of BGP updates. As an update arrives at a BGP peer, the update is processed and inserted into the stream. The data is available both in an easy to parse XML and a binary "bits off the wire" format. In addition, a second stream periodically announces BGP routing tables for each of the peers. The software is extensible to easily add new peers and connect feeds together. The data may be particularly interesting to active measurement projects as now one can instantly collect BGP data along with active measurements and/or BGP changes could trigger actions by active measurement projects.

Talk Abstract: Recent studies in the UK and the USA have shown that there is a wide gap between speeds advertised by ISPs and actual speeds obtained by users. In this project we analyze the various factors like latency, choice of ISP, service plan and access link technology, and how they affect performance seen by home users.

Talk Abstract: Abstract not submitted

Talk Abstract: Data collected using traceroute-based algorithms underpins research into the Internet's router-level topology, though it is possible to infer false links from this data. One source of false inference is the combination of per-flow load-balancing, in which more than one path is active from a given source to destination, and classic traceroute, which varies the UDP destination port number or ICMP checksum of successive probe packets, which can cause per-flow load-balancers to treat successive packets as distinct flows and forward them along different paths. Consequently, successive probe packets can solicit responses from unconnected routers, leading to the inference of false links. This paper examines the inaccuracies induced from such false inferences, both on macroscopic and ISP topology mapping. We collected macroscopic topology data to 365k destinations, with techniques that both do and do not try to capture load balancing phenomena. We then use alias resolution techniques to infer if a measurement artifact of classic traceroute induces a false router-level link. This technique detected that 2.71% and 0.76% of the router links in our UDP and ICMP graphs were falsely inferred due to the presence of load-balancing. We conclude that most per-flow load-balancing does not induce false links when macroscopic topology is inferred using classic traceroute. The effect of false links on ISP topology mapping is possibly much worse, because the degrees of a tier-1 ISP's routers derived from classic traceroute were inflated by a median factor of 2.9 as compared to those inferred with Paris traceroute.

Talk Abstract: This work performs controlled experiments to analyze the performance of home networks. We show that the home network has a significant impact on end-to-end performance. For example, watching TV can double the time to download a file; and deploying a wireless network significantly increases round-trip times. Despite its impact on end-to-end performance, most existing diagnosis tools ignore the home network when identifying the cause of performance problems. To make matters worse, our results show that simple techniques that directly probe the home gateway cannot reliably identify that the home network is the cause of performance degradation. We are currently designing a technique based on packet bursts to identify performance problems caused by the home network. Our results for Ethernet based home networks are encouraging.

Joint work with Lucas Di Cioccio and Catherine Rosenberg

Talk Abstract: ESnet runs a large perfSONAR deployment, and all data is publicly available. This talk we described what we are monitoring and how researchers can access the data.

Talk Abstract: Internet topology maps have been widely studied during the last decade. One common perspective in these studies is to consider the Internet topology as a router-graph where nodes and links represent the routers and the connections between routers, respectively. In reality Internet is a network of routers and subnets such that a subnet can be a multi-access LAN rather than a point-to-point link. An immediate consequence of not accounting for multi-access links is the inflation in the router degree. That is, a router gets connected to a subnet with a single interface, however, the router-graph representation reflects the router as if it has an interface for each router on the same subnet. In this paper, we suggest an alternative framework for representing and analyzing Internet topology maps called network layer maps. Network layer maps capture the Internet topology as a network consisting of routers and subnets in the form of both point-to-point links and multi- access LANs. We utilize our standalone subnet collector tool called xnet and IP alias resolution algorithm palmtree to construct network layer Internet topology maps.

Talk Abstract: Internet is a large scale network showing characteristic features of complex systems, such as power laws in the degree distribution and in traffic correlations. In recent years new data accumulated about spatial distributions in the Internet including inter router distances and waiting times. In this talk we show that the distribution of these quantities follow a very extreme power law 1/x and a cummulative distribution log(x) which is also known as Benford's law in an another context. These distributions without cutoffs have infinite variance, mean and normalization constant. Such distributions appear, when the log of the quantity has a wide distribution. We argue that this special power law might signal a more general scale invariance in the Internet under nonlinear rescaling of random variables. We show that other complex systems, such as gene co-expression networks can have similar features. infinite variance and mean

Interested in discussing: geolocation, complex networks, internet mapping, future internet

Talk Abstract: Netalyzr recently added a larger IPv6 test suite, including relative latency for IPv6 vs IPv4 vs Dual Stacked pages (in Javascript, modeled on previous sites), measured network latency and traceroute between IPv4 and IPv6, IPv6 path MTU discovery, network interface enumeration, DNS support for AAAA queries, DNS support for AAAA glue records, and detection of some common IPv6 related failures. Additionally, Netalyzr has been used for testing/debugging by two IPv6 projects.

This talk will briefly summarize some of the preliminary IPv6 related findings from the new IPv6 deployment.