Proposed Work

In January 2000, the PingER data gathering tools are deployed at 28 sites in 15 countries, and several more sites are expected to join in Q1 2000. A total of 593 remote nodes at 424 sites in 72 countries are probed by the monitoring sites, providing performance metrics on 2138 end-to-end pairs. PingER is thought to be the largest network performance monitoring project in existence. As with so many aspects of modern computing and networking, the needs of the HEP and ESnet communities continues to push the envelope, and the PingER tools are an important part in measuring the success.

Select and deploy an extended set of Beacon sites to represent the expanded areas covered by the measurements. The current set of about 56 sites was selected when we were monitoring about 30 countries and 1200 pairs. Both these numbers are more than doubled today and continue to expand with new requirements. The concept and requirements for Beacon sites are documented in http://www-iepm.slac.stanford.edu/pinger/beacon.html (PingER Beacon Sites), and briefly are a selected subset of all the sites, that are monitored by all measurement sites.

In co-operation with HEPNRC, SLAC will continue to develop and deploy the timeping program and include the new concept of directives where the host monitoring site can have greater control over the parameters by specifying the scheduling mechanism and frequency at which to send probes, the size of the probes, the type of probes to send, and the way the results are logged. The ability to customize the frequency and size of the probes will allow finer detailed monitoring of high performance links, and lower impact on poorly provisioned links. Also more detailed logging of results will allow more statistics and new metrics to be developed. In addition the data gathering will be amended to use protocols other than ICMP ping. For example, the version of ping developed at NIKHEF can be used to specify the Per Hop Behaviour (PHB) for a network using Differentiated Services. There are also TCP-based ping-like tools such as sting [3] and SYNACK which can be called by PingER instead of ping. These tools will be particularly useful for the study to compare reported performance to detect evidence of rate limiting. Also use of the ULM format for recording results will be explored, and the tools available to analyse ULM formatted data will be evaluated. Traceroute studies will be expanded and data will be gathered routinely to provide historical routing information. As before, all raw and processed data and results will be made public via the web to enable researchers and networkers to perform their own analyses and acclerate progress and understanding in this important field.

Development of the analysis tools will involve a big drive to take more advantage of databases for the storage and retrieval of data. Tools using perl and java database connectivity will be developed. Standard SQL will be used to make the code as platform-independent as possible. The guthrie program which manages the details of the large number of nodes involved in the PingER project, and provides smooth scaling to handle thousands of pairs of sites, will be enhanced to provide a GUI front end and a version using the Java runtime environemt (JRE) will be developed. Existing tools to automatically modify the list of nodes (see http://www-iepm.slac.stanford.edu/monitoring/remote_sites.html ) and produce spreadsheet ready versions of group affiliations will be extended.

There are a large number of analysis projects under way, including further analysis and new tools. SLAC is working on methods to detect ICMP rate limiting, where ping probes are limited for security or bandwidth reasons and may mistakenly indicate poorer network performance than is the case. In addition methods to detect links employing other non-standard or advanced techniques such as load balancing will be developed to further understand accurate performance monitoring. Tools such as TTCP and SmartBit will be utilized to further understand how different protocols work and validate the PingER methodology, especially as it relates to predicting TCP throughput. A new project involving passive monitoring using the OC3MON box and the Coral-Reef [4] is just beginning and work will be done to compare performance with active measurement tools. SLAC is taking a leading role in monitoring performance for the 6bone/6REN IPv6 network. Currently there is 1 monitoring site at SLAC, but we expect to deploy the IPv6 version of PingER at two new sites; at the 6-TAP in Chicago and at the CERNet NOC in China in Q1 2000. SLAC is also working on detailed analysis of connectivity to East Europe and South America for the ICFA SCIC and ESnet-International groups. Also Internet2-International and NATO are interested in our measurement and analysis of performance to remote and poorly provisioned regions.

The project has continually caused suprises and questions had to be addressed that had not been forseen, sometimes resulting in a whole new line of enquiry and research. Also, some initial trials have failed to provide the necessary information. One such area of initial trials is that of visualisation. The project continues to examine tools and renewed effort to collaborate with developers to incorporate features that can be exploited by the unique nature of the Energy-Labs' requirements will be undertaken. The existing WWW pages of tables and graphs will be complemented with new graphing techniques and more data analysis tools will be reviewed and tool-specific formats may be included in the table for power users. A new weather-map type front end will be explored along with already under review tools such as cichild, otter, and trunks-map. Another aspect of the project that will be reworked in collaboration with the XIWT is the ability to use PingER for anomaly detection and near real-time trouble-shooting, although it is still not envisioned that these tools will be used as a front line warning mechanism for network operations centers.

Development Collaboration & Relationship to Other Work

SLAC continues to actively work with The Cross Industry Working Team and has forged links with other commercial interests including the NetPredict start-up.

Our Strengths

Those involved in the IEPM effort have a long history of Networking and Network monitoring. In addition the IEPM effort so far has established many new alliances and connections. SLAC has deployed machines from the AMP, Surveyor, RIPE and NIMI network performance projects. In addition collaborations with UCLA and CEEsat/NATO are being developed. SLAC has numerous publications and has been invited to participate in many workshops and network activities and given many talks throughout the world.

Deliverables and Schedule

• Develop new tools for aiding new analysis.
• Further Develop existing tools
• Define and Deploy new list of Beacon Sites.
• Deploy new tools to existing collection sites.
• Deploy existing and new tools to further sites.

And coninued gathering and analysis of monitoring data.

In addition,

• Monthly reports over the life of the project.
• A final DOE publishable report at the end of the project.
• The software tools will be made publicly available.
• The data will be made available for analysis with other tools upon request.

Furthermore, we have been invited to take part in a staggering number of conferences and workshops this year. We will present papers and/or give talks at;

• CHEP'00. The Computing in High Energy Physics Conference to be held in February '00 is the primary showcase for our work in the HEP community. We have been invited to present a talk during a plenary session, a talk during the network track parallel session and a poster.
• XIWT/IPERF. SLAC continues to work wlith the XIWT/IPERF and at the next meeting in February we will update the group on our work with QoS and VoIP; the new developments in the analysis tools; results in detecting rate limiting; comparison of results between projects and visualization tools.
• IPv6 Forum and IETF. SLAC is involved in performance monitoring for the forthcoming IPv6 forum summit, and we have been invited to present a review of our results to the IPv6 WG at the next IETF meeting.
• Internet2 International. SLAC will detail findings on performance to sites on networks involved in the Internet2 International group. In some cases this will provide a before and after picture of the effect of peering.
• PAM2000. We submitted an abstract and have been accepted to present a paper at the Passive and Active Monitoring conference in April. The paper will examine the results from a number of monitoring projects, and use the differences to explore the strengths and weaknesses of the various projects, including assessing under what network scenarios the monitoring system is most accurate.
• IEEE. A paper has been accepted for the forthcoming IEEE Communications Magazine on Network Traffic Measurements and Experiments. The magazine will be published sometime this summer.
• SC2000. SLAC will participate in the Super Computing 2000 in November 2000.
• SIGCOMM 2001. SLAC will submit a paper to be titled Accurate Network Performance Monitoring in the Presence of Differentiated Services. This paper will be based on the work to detect signatures of rate limiting and networks using Expedited Forwarding.

References

1. Proposal for IEPM funding 1997
2. Proposal for IEPM funding 1998
3. The sting project
4. The Coral-Reef Software Suite

Revised 10 January 2000
URL: http://www-iepm.slac.stanford.edu/about/fwp/fwp-00.html
Comments to iepm-l@slac.stanford.edu