1 Trace collection in the UNC-CH DiRT lab The UNIVERSITY of NORTH CAROLINA at CHAPEL HILL

2 Outline  Monitoring location and UNC network  Setup specs - infrastructure  Process sequence overview  Live demo  Post-processing  Our experimental infrastructure and its capabilities

3 Trace collection point UNC-CH network Internet & Internet2 Monitor w/ DAG card

4 Infrastructure Monitor specs: P4 1.8 GHz CPU, 1.4 GB RAM, 5*32GB hard drives, FreeBSD 4.7.Monitor specs: P4 1.8 GHz CPU, 1.4 GB RAM, 5*32GB hard drives, FreeBSD 4.7. DAG 4.3GE dual interface 1000Base-SX Gigabit Ethernet 133MHz PCI-X card.DAG 4.3GE dual interface 1000Base-SX Gigabit Ethernet 133MHz PCI-X card.

5 Process sequence overview packet capture using dagsnap convert to tcpdump format using dagconvert anonymize using tcpdpriv create connection vectors in tmix analyze and present results run (100s of) tmix experiments in the lab

6 Demo 1./usr/local/bin/dagsnap -d /dev/dag0 -s 300 -v -o test.dag 2.dagconvert -Terf:pcap -i../test.dag -f b > test.b.tcpdump 3.dagconvert -Terf:pcap -i../test.dag -f a > test.a.tcpdump 4./usr/dirt/src/tcpdpriv /tcpdpriv -P99 -A60 -M20 -t mapping_file -r test.a.tcpdump -w test.a.anon.tcpdump 5./usr/dirt/bin/4.x/tcpdump-hiperf -I -S -n -tt -r test.a.anon.tcpdump tcp > test.a.anon.tcpdump.txt (-I  Print IP header fields (ttl, id and length))

7 Packet capture Usage: dagsnap [options]Usage: dagsnap [options] -d DAG device name -d DAG device name -h display help (this page) -h display help (this page) -j Maximize disk write performance - will only write in chunks -j Maximize disk write performance - will only write in chunks -m Maximum amount of data to write per call in MiB (default 4) -m Maximum amount of data to write per call in MiB (default 4) -o output file name (default is stdout) -o output file name (default is stdout) -s runtime in seconds -s runtime in seconds -v increase verbosity -v increase verbosity With -v three columns are printed per second.With -v three columns are printed per second. 1. The cumulative total of data written out. 1. The cumulative total of data written out. 2. The buffer occupancy. Small values indicate no packet loss. 2. The buffer occupancy. Small values indicate no packet loss. 3. The rate at which data is currently being written. 3. The rate at which data is currently being written.

8 Convert dag to tcpdump dagconvert: DAG file conversion utility: Usage: dagconvert [options]dagconvert: DAG file conversion utility: Usage: dagconvert [options] -d DAG device name -d DAG device name -h display help (this page) -h display help (this page) -v increase verbosity -v increase verbosity -i input file -i input file -o output file -o output file -r N[k|m|g] change output file after N Bytes. -r N[k|m|g] change output file after N Bytes. k, m, g suffixes for kilobytes, megabytes, gigabytes. k, m, g suffixes for kilobytes, megabytes, gigabytes. -s output snap length -s output snap length -t capture period in seconds -t capture period in seconds -T input and output types (see list of types below) -T input and output types (see list of types below) -f comma separated list of filters (see list of filters below) -f comma separated list of filters (see list of filters below)

9 anonymize usage: /usr/dirt/src/tcpdpriv /tcpdprivusage: /usr/dirt/src/tcpdpriv /tcpdpriv P99 – pass TCP port numbers through unchangedP99 – pass TCP port numbers through unchanged A60 – map address using mapping fileA60 – map address using mapping file M20 – option for multicast addressesM20 – option for multicast addresses

10 Example plot – throughput (Mbps) A 10-min trace collected at low-usage time (2:30am)A 10-min trace collected at low-usage time (2:30am)

11 Example plot – throughput (Kpps)

12 Analysis  Simple statistics like throughput plots over time  Loss rates  RTT (round trip time) calculations  Running tmix experiments with the data  analyze results  create various possible scenarios and test (e.g. what does doubling the traffic throughput do to end user response times?)

13 EndsystemsEndsystems Network Topology EthernetSwitchEthernetSwitch Router Router …… Monitors Access router & control station NFS servers arp proxy

14 Tmix discussion Replay trace on the network in a controlled environmentReplay trace on the network in a controlled environment Throughput can be varied up or downThroughput can be varied up or down Induce losses and delays per flowInduce losses and delays per flow Replaying a-b-t sequencesReplaying a-b-t sequences