IPv6 measurement in CSTNET. CSTNET, CNIC, Sep. 2014

Transcription

1 IPv6 measurement in CSTNET Chunjing Han CSTNET, CNIC, Sep. 2014

2 1. The activities of IPv6 measurement in CSTNET 2. IPv6 traffic analysis and user behavior Topics

3 1. The activities of IPv6 measurement in CSTNET

4 LDTM( Large scale distribution traffic monitor) n From 2012 n Collecting the Netflow V5/V9, IPFIX n Goal n Monitoring IPv6 traffic of the backbone and boundary links of CSTNET. n Natively support multi-tenants n Using cloud plus probe to implement LDTM n Cloud: collect, process, and merge the raw flows, storage the aggregated records, and provide visual service. n probe: create the improved Netflow packets and send network data to Cloud.

5 Design of LDTM n One cloud processing center locates at Beijing and several probes locate at the backbone links. n the collecting servers, web servers, database, storage device. n Architecture of deployment n our provide the traffic analysis query service, then we can also open this web service to other management systems. Web Server Raw f l ow Col l ect or Dat abase mi ddl e ware Weat her Map Traffi c DB Li nk anal ysi s Merged Fl ow records merger Traf f i c query mi ddl e ware and Web Servi ce l ayer CMDB Real t i me f l ow processor Moni t or obj ect anal ysi s Fl ow repeater Securi t y anal ysi s Report DB Net f l ow V5 Net f l ow V9 I PFI X Rout ers l oader aggregat or Report er Raw f l ow records Raw f l ow col l ect or GeoI P DB confi gurat i on DPI Deep packet i nspect i on n Multiple layers for traffic collector Integration With CNMS ( authority,ui,account,tennat,menu )

6 Distributed collector design model n An uniform CMDB to guarantee the consistency analysis result at different collectors n the stability of DPI s flows are not as good as Netflow exported by routers, flows of routers and DPI boxes are separately proceed in different collectors n It is effective and especially we always stop the DPI flow collector at the early stage of our system, but the Netflow processing is not affected at all.

7 Some IPv6 measurement activities n Add DPI flow processing n Deployed probes (Beijing, Shanghai, Guangzhou, Changchun, Shenyang, Lanzhou) n Hardware probes/software probes n Centralized architecture to manage this probes n Add IPv6 application analysis function n Add some IPv6 application recognition features n A unified application feature table and can use it in dual stack links realize the compatibility of IPv4 and IPv6. n Synchronization of configure data n Links, Routes n IP address belong information n Customs

8 IPv6 traffic analysis and user behavior

9 IPv6 network introduction in CSTNET n Pure IPv6 and dual stack network n Almost native IPv6 traffic, very little IPv6 tunnel traffic n A rapid growth of IPv6 traffic these years n The IPv6 traffic of CAS s universities is most heavilytrafficked, students use the IPv6 to share video, big software and files n IPv6 traffic is still free now, for encourage the users to use IPv6 resource

10 n IPv4 vs. IPv6 n The ratio of the TCP and UDP traffic is comparable Protocol Mix n The other traffic which is neither TCP nor UDP is 4.88%. n Fragment Header for IPv6 n IPv6 address announcement over ICMP6. Such a large amount of traffic by this kind of traffic might be a non-negligible problem for widely deployed IPv6 network. IPv6 IPv4 Transport TCP UDP Other TCP UDP Other Protocol Traffic (%) protocol mix

11 Application Mix n IPv6 and IPv4 show different application mix patterns. The IPv4 network is dominated by HTTP applications, rather than P2P applications in IPv6 n A breakdown analysis of the P2P applications n 93% of the P2P traffic is generated by utorrent, showing its prevalence in IPv6 network. n The reason n it is free and without traffic control, not many ICPs support IPv6. Application mix sub-application distribution of P2P

12 Domain statistics statistics- Popular sites top visitors top traffic IPv4 IPv6 IPv4 IPv6 mail.cstnet.cn neubt 360 sixxs qq g<mg (Tecent company) china neubt qiyi appspot qq g<mg china google xunlei googlevideo iqiyi neu6 baidu windowsupdate webterren nih acgvideo neu6 baidu scau ac microsoc kuaibo google- analy<cs geophy google weibo sixxs baidupcs googleusercontent 360 cgbt apple appspot

13 Region statistics n International traffic is very small n The proportion of IPv4 international traffic in the total IPv4 traffic n 36.7%, 27% is to/from US n The proportion of IPv6 international traffic in the total IPv6 traffic n 1% n some other type traffic n For science data transfer and file download Geographical distribution

14 Flow latency time n Client Network Delay n Server Network Delay n Application Latency n Simple 3 packet transaction (TCP only). n Divide the time delta by two, as we want to compute the network latency that we assume is half the round trip time. Server and Client Network Delay Application latency is computed as the time needed by an application to react to a client request.

15 Response time Response Time = server delay + client delay +application delay, Unit: 10 x (ms) Client delay Server delay Application delay n The server delay influenced the response time most Unit: 10 x (ms)

16 retransmission and out of order packets Link the number of out order packets the total number percent of out order of flows packets IPv6 link % link Table: out order packets statistics (two hours) the number of retransmission packets percent of the total number of flows retransmission packets IPv6 link % Table: retransmission packets statistics (two hours)

17 Performance comparison n IPv4 traffic n rich applications, online-video application, e-commerce sites and social networking sites n ICPs do everything they can to ensure the best performance which include web caches, video acceleration and CDN n IPv6 traffic n Few of commercial applications traffic n these cause the performance of high-speed IPv6 network is not better than that of the crowded IPv4 network.

18 Some problem in IPv6 measurement n No good IP belong information database n IPv4, GeoIP, QQ IP database and many others. n IPv6, we have not found a IPv6 belong information, so we don t know the detail information between source host and the destination host in a session. n CDN technology resulted in the more complex region analysis. n We need more commercial traffic to be analyzed n Different application mix n We need more commercial traffic which can be compared with IPv4 END