---

Dates: April 22 (Thu) - 23 (Fri), 2004
Place: Information Sciences Institute, Marina del Rey, CA

Driving directions    

CAIDA/WIDE Collaboration

The objectives of informal joint CAIDA/WIDE workshops are:

• to discuss Internet measurement analysis activities going on in each organization;
• to explore opportunities for joint collaboration on projects;
• to continue data exchange.

---

Workshop Minutes

April 22 (Thursday)

1. Review of 2003 activities
   
   
   • Jun Murai (WIDE), WIDE report
     - Internet traffic developments in Japan: rapid increase of stream-based traffic
     - domestic 10GE network: triangle JAIST - Osaka- Tokyo. How to deal with lambda-networks from user's point of view? How to measure these networks if there is still no traffic?

     bill: are there tools to measure trafic at multiple Gb rates?
     kc: what's the goal for making such tools? what are the questions to answer?
     nevil: hardware exists
     kc: does it work?
     bill: real time control of applications' performance is necessary. We need measurements to enable it.

     Kenjiro Cho (WIDE), WIDE measurement activities
     - DNS, IPv6 topology, BGP simulation, netflow/sflow - subjects of this workshop
     - 10G (lambda-networks vs. layer3), StarBED, distributed IX, satellite, AI3, UniDirectionalLinkRouting, mobile, InternetCar, Auto-ID - other topics
   
   
   
   • kc claffy (CAIDA), CAIDA report
     - results in six main areas identified in CAIDA Progam Plan 2003-2005:
     1. macroscopic topology (most comprehensive in the world macroscopic topology data) & routing (new theoretical approaches to compact routing schemes)
     2. workload characterization (2005 goal: 24 hr packet trace from the core)
     3. DNS: this workshop (OARC proposal was submitted to NSF)
     4. performance (BWEST, intermediate RTT from skitter/scamper)
     5. IMDC - Trends (more important now than the amount of money NSF gave to it)
     6. security (automatic detection/protection is the main task)


2. 11:30-17:30 DNS measurements and modeling
   
   
   • Yuji Sekiya (WIDE), Comparison of active and passive measurement results
     - active measurements with dnsprobe (RTTs to root & ccTLD servers) vs. passive measurements with NeTraMet (2 locations since Oct03, at Keio & Tokyo Universities)
     - consistent active&passive results at U. Tokyo, strange M-root RTTs at Keio (different active&passive results!)
     - future plans: re-organize measurements, detect anycast servers, publish NeTraMet results
   
   
   
   • Nevil Brownlee (CAIDA),
     Measurements and laboratory simulations of the upper DNS hierarchy
     - PAM 2004 presentation
     
     DNS projects at the U. of Auckland
     - new statistical plots to visualize root servers' performance: X - time of day, Y - RTT distribution to a given root, color = # of queries
   
   
   
   • Duane Wessels (CAIDA), Data collection and analysis for DNS-OARC
     - components: passive collector, data files in XML, centralized system for archiving/analysis/display
     - collected: IP protocol types, response codes, query types, etc.
     - examples of graphs: no ICMP attacks on roots (entirely UDP traffic), mysterious spikes in rates of queries for root-server addresses, analysis by query types and clients' subnets
     - software is run on two primary instances of F-root. It keeps a week of data & monthly summaries

     k: CAIDA is commissioned by RSSAC to collect data on effects of anycast & dnssec on the global Internet stability

   • Akira Kato (WIDE), Measurements at M-root server
     - M-root gets MOST of its queries from US (a factor of 5 more than from Japan!)
     - other large contributors: Japan, Korea, China

     bill: lots of people want to collect data from roots. what's the best way? (not everybody likes OARC)

   • Bradley Huffaker (CAIDA), Sources of strange queries at F-root
     - queries come sometimes from Europe and sometimes from the US, there is no clear pattern
     - a small # of prefixes queried both instances of F-root. In principle, this should not happen
   
   
   
   • Matthew Luckie (WAND), IPv6 DNS misconfigurations
     - easy to introduce errors into IPv6 DNS config files/records (typos)
     - got 410 zones, 3% (12) had errors: not as many as expected, but rudimentary checks would help even more (i.e. Best Practices for IPv6 DNS config)
   
   
   
   • Francisco J. Martin (Oregon State University), Toward rapid diagnosis and repair of DNS problems
     - cognitive networking: self- configuring, diagnosing and tuning
     - approach: build a model, identify 'normal' & 'abnormal' behavior, shift diagnostic discovery from endpoints (human users) to the network itself
     - funded by DARPA, looking for more funding
   
   
   
   • Genevieve Bartlett (ISI), Deploying DNSSEC at a root server *
          * This talk was given on Friday, April 23.
     - monitoring traffic at B-root
     - preliminary analysis & statistics
   
   

   General discussion: future directions of DNS research and collaboration

   Bill Manning (ISI)
   

   1. IPv6 queries at root servers: about 20 per 10 minutes
   2. "Bottom-up" DNS measurements
      - is it feasible to study the behavior of "stub" resolvers?
      - get the following data: version id of resolver, # of replies, timestamps, initial & subsequent queries, reply data
      - need a tiny system that would fit into an embedded device/silicon

---




April 23 (Friday)

3. IPv6 measurements
   
   
   • Matthew Luckie (WAND), Active measurements of IPv6 topology: scamper project
     - scamper PMTU: discover MTUs along the Path
     - scamper analysis shows examples of suboptimal routing (US-US goes through Europe, Japan)
     - discover alternative path and examine delays along each path

     bill: what are possible path metrics? RTT is one, largest MTU may be another.

   • Kenjiro Cho (WIDE), Dual-stack world: a view from .jp
     - iWhy is the IPv6 performance often much worse than IPv4 one?
     - pinged dual v4-v6 sites: 10% unreachable, ~60% reachable for both, 20% unreachable for IPv6, 10% unreachable for IPv4
     - compared rtts: most sites - not bad, but there is a number of BAD sites
     - next step: make measurements from Europre & US, improve visualization

     kc: isn't it true that tunnels make routing bad?
     bill: is info about tunnels in RTTs? but: in long or short ones?

   General discussion: future directions of IPv6 research and collaboration

   • Kenjiro Cho (WIDE)
     - IPv6 measurement metrics at IAJapan
   • k claffy (CAIDA)
     - problem - we can't measure tunnels (layer 2)
     - what should be the outcome of IPv6 research? a web page monitoring & comparing IPv6-IPv4 performance?
     - should we encourage users to switch from tunnels to native?
   • Jun Murai (WIDE)
     - measurement/analysis should be aimed to help improve the future design
   • BillManning (ISI)
     - ping root & TLD servers from a number of locations, compare IPv6-IPv4 performance



4. Traffic Monitoring
   
   
   • Bartek Wydrowski (Caltech), FAST TCP - Internet Congestion Control *
          * This talk was given on Thursday, April 22.
     - tested to some extent (dummynet, PlanetLab, Internet2 backbone, ns-2), future - WAN in the lab
     - algorithm yields steady throughput
     - TCP benchmark - need for an independent verification, reproducibility, fair comparison. Who can do it?
   
   
   
   • Seiichi Yamamoto, Traffic monitoring by sflow
     - The goal is to establish practical traffic monitoring & to deal with high-speed networks
     - sflow simplifies the measurements by using packet sampling. ALthough it does not provide complete information, it reveals the trend (cf. RFC 3176)
     - next steps: verify meauserement stability, find effective points for monitoring

     david: we at UCSD developed an adaptive packet sampling technique

   • Colleen Shannon, Security data collection at CAIDA
     - trace collection involves:
     1. maintaining remote monitors
     2. transfering data to SDSC (huge files over slow links)
     3. sanitizing data (tradeoff between payload & IP anonymizing)
     4. providing access to external users
     - network telescope: DoS attacks, network worms (Code Red, Sapphire, Witty)

     bill: how to distinguish between harmful worms & possible beneficial self-propagating code (i.e. patches & updates)?

5. BGP and Routing
   
   
   • Kengo Nagahashi, BGP simulation environment on Starbed
     - STARBED is a large-scale PC cluster
        scales: basic (14 hosts), middle (~100), large (~1000)
     - comparison of convergence time for random topology & hierarchical topology (longer for random topology)
   
   
   
   • Dima Krioukov, Compact routing model
     - new theoretical approaches to Internet routing
   
   
   
   • Kenjiro Cho, Server placement/selection for scale-free networks
     - simulations to estimate the efficiency of different server selection algorithms on scale-free graphs
     - future plans: animations

Action items discussion and wrapup

• kc claffy
  - statement of work for WIDE
  
• Marina Fomenkov
  - next workshop on August 6-7, 2004 in San Diego (after IETF meeting)