Internet (IPv4) Topology Mapping. Department of Computer Science The University of Texas at Dallas

Transcription

1 Internet (IPv4) Topology Mapping Kamil Sarac Department of Computer Science The University of Texas at Dallas

2 Internet topology measurement/mapping Need for Internet topology measurement Help with network management or surveillance Robustness with respect to failures/attacks Comprehend spreading of worms/viruses Relevant in active defense scenarios Scientific discovery Scale-free (power-law), small-world, rich-club, disassortativity, 2

3 Traditional approach in layer 3 topology mapping: Router level maps 3

4 Network layer Internet topology maps sample IP network segment view at Layer 3 number of routers connected via subnets R 1 R 2 R 3 R 4 R 5 R 6 R 7 4

5 router level map at layer 3 corresponding router level map view R 1 R 2 R 3 R 4 R 5 R 6 R 7 5

6 How to build router level network maps? Involves topology data collection and topology construction How to collect topology data? Traceroute a network debugging and diagnostic tool End-to-end traces from k vantage points to n destinations where (typically) k << n How to construct topology maps? Resolving alias IP addresses Resolving anonymous routers 6

7 Traceroute-based topology data collection ksarac> tracert -d Tracing route to [ ] over a maximum of 30 hops: 1 2 ms 1 ms 1 ms ms 4 ms 3 ms ms 3 ms 3 ms ms 4 ms 10 ms ms 4 ms 4 ms * 13 ms 6 ms ms 4 ms 4 ms ms 15 ms 15 ms ms 27 ms 26 ms ms 35 ms 32 ms ms 25 ms 25 ms ms 27 ms 28 ms ms 27 ms 50 ms ms 96 ms 51 ms ms 84 ms 52 ms ms 61 ms 51 ms ms 53 ms 66 ms ms 99 ms 51 ms Trace complete. 7

8 Traceroute, cont d ksarac> tracert -d Tracing route to e2561.b.akamaiedge.net [ over a maximum of 30 hops: 1 4 ms 2 ms 2 ms ms 2 ms 2 ms ms 2 ms 2 ms ms 10 ms 3 ms ms 3 ms 3 ms ms 4 ms 4 ms ms 4 ms 3 ms * * * Request timed out ms 26 ms 25 ms ms 26 ms 26 ms ms 26 ms 26 ms ms 27 ms 27 ms ms 36 ms 36 ms ms 58 ms 58 ms ms 57 ms 57 ms Trace complete. n anonymous router that does not answer the traceroute query 8

9 How to use traceroute for topology discovery? e S Internet2 backbone N f U C W L K H d Traces d - H - L - S - e d - H - - W - N - f e - S - L - H - d e - S - U - K - C - N - f f - N - C - K- H - d f - N - C - K - U - S - e 9

10 How to use traceroute for topology discovery? e s.1 S s.2 l.1 L l.3 s.3 l.2 u.1 U u.3 u.2 f n.2 n.1 N n.3 c.2 c.1 w.1 w.2 C W c.3 k.1 c.4 w.3 K k.2 k.3 a.1 a.2 a.3 Each router has multiple IP addresses Traceroute returns only one IP address of each visited router h.2 H h.3 h.1 h d 10 Traces d - h.4 - l.3 - s.2 - e d - h.4 - a.3 - w.3 - n.3 - f e - s.1 - l.1 - h.1 - d e - s.1 - u.1 - k.1 - c.1 - n.1 - f f - n.2 - c.2 - k.2 - h.2 - d f - n.2 - c.2 - k.2 - u.2 - s.3 - e

11 IP lias Resolution Problem S U K C N Sampled network e L H W f s.3 d e s.1 s.2 l.1 u.1 u.2 k.1 c.1 n.1 k.2 c.2 a.3 w.3 n.2 n.3 f l.3 Sample map without alias resolution h.1 d h.4 h.2 11 Traces d - h.4 - l.3 - s.2 - e d - h.4 - a.3 - w.3 - n.3 - f e - s.1 - l.1 - h.1 - d e - s.1 - u.1 - k.1 - c.1 - n.1 - f f - n.2 - c.2 - k.2 - h.2 - d f - n.2 - c.2 - k.2 - u.2 - s.3 - e

12 IP lias Resolution pproaches Source IP ddress Based Method Relies on a particular implementation of ICMP error generation. IP Identification Based Method (ally) Relies on a particular implementation of IP identifier B B field, Many routers ignore direct probes. Dest = DNS Based Method Relies on similarities in the host name structures Dest = sl-bb21-lon-14-0.sprintlink.net sl-bb21-lon-8-0.sprintlink.net Dest = B Works when a systematic naming is used. Dest = B, ID=100 B B, ID=103 ID=99 Record Route Based Method Depends on router support to IP route record processing 12

13 nalytical IP lias Resolution UTD no response no response MIT liases

14 nonymous Router Resolution Problem e S Internet2 backbone N f U C W L K H d Traces d - - L - S - e d W - - f e - S - L - - d e - S - U - - C - - f f - - C d f - - C - - U - S - e 14

15 nonymous Router Resolution Problem S U K C N f Traces d - - L - S - e d W - - f e - S - L - - d e - S - U - - C - - f f - - C d f - - C - - U - S - e e e S L H W d Sampled network U C L W f d Resulting network 15

16 nonymous Router Resolution Basic heuristics IP: Combine anonymous nodes b/w same known nodes Limited resolution S U C z NM: Combine all anonymous neighbors of a known node L High false positives y C S U W z More theoretic approaches y L x H fter resolution W Graph minimization approach Combine s as long as they do not violate two accuracy conditions: x (1) Trace preservation condition and (2) distance preservation condition High complexity O(n 5 ) n is number of s fter resolution y S ISOMP based dimensionality reduction approach U Build an nxn distance C matrix then z use ISOMP to reduce it to a nx5 matrix S U K C N Distance: (1) hop count or (2) link delay z High complexity O(n W 3 ) n is number of nodes L y L H W x x Resulting network Sampled network 16

17 nonymous Router Resolution Graph Based Induction x C y2 x C y2 Parallel -substring y1 y3 y1 y3 D w x C y E z D w x C y E z Star C x y D w F v E z C x y D w F v E z Complete Bipartite C x y D w E z C x y D w E z Clique nonymous router resolution: Merge anonymous nodes as long as they cause no loops in path traces 17

18 Subnets as first class citizens in network layer Internet topology maps 18

19 network layer view incl. routers & subnets Not all subnets are created equal! Can we discover layer 3 view of subnets? List of alive IP addresses Subnet number as a.b.c.d/x R 1 R 2 R 3 R 4 R 5 R 6 R 7 19

20 Why know subnets? 1. n alternative layer 3 view of the Internet map where subnets are nodes routers are links /30 /29 S 1 S 2 S 1 S 2 S 3 S 4 S 3 S 4 /29 /31 20

21 Why know subnets? P2 & P3 are not nodeand-link disjoint but P1 & P3 are 2. more complete network layer picture of the underlying network P1 P2 P3

22 Why know subnets? P1 & P3 are not node-and-link disjoint as they share the same 2. more complete network layer picture of subnet the underlying network P1 P3

23 How to discover a subnet? ExploreNET an active probing based tool Given an IP address IP v, discovers the subnet hosting IP v Labels with its observable subnet mask Uses a set of heuristics for subnet inference 23

24 ExploreNET Given an IP address IP v, explore the subnet B R3 R4 v R2 R1 v (pivot interface) is the interface with R5 IP address IP v that is TTL = d hops away from vantage point R6 R7 24

25 How to discover a subnet? Probing cost is within to 25

26 ExploreNET internals How to explore the subnets that v resides? 1. Form a /30 subnet S which includes the IP address IP v of the pivot interface v Check if IP i /30 mate of IP v is likely to be in S 2. Grow S to a /X subnet (X = 29, 28, ) which includes IP v as long as IP addresses in subnet S satisfy our heuristics 26

27 ExploreNET heuristics 9 of them to improve accuracy of our inferences Q: Does IP address i belong to assumed subnet S? : Yes with high probability, if it satisfies heuristics Far-fringe interfaces S Close-fringe interfaces Ingress Router Ingress-fringe interfaces 27

28 ExploreNET limitations Requires router responsiveness Depends on heuristics based on best practices in layer 3 network configuration Underestimation due to subnets with sparsely utilized IP addresses Underestimation due to path diversity due to load balancing or TE practices 28

29 ExploreNET evaluations ccuracy and completeness of the heuristics Comparison against ground truth data Collected from the public Internet using mrinfo [MDP2010] mrinfo an IP multicast diagnostic tool Returns IP multicast enabled interfaces of a router For each such interface, returns IP addresses of other multicast enabled interfaces on the same subnet mrinfo based ground truth data total of 5536 subnets collected from the Internet ExploreNET experiment Pick a random IP address from each subnet and run explorenet to discover the subnet 29

30 ExploreNET evaluations - results M total no. of subnets (5536) unresponsive (768) B exact discovery (3702) C failure cases (673) D subsumes mrinfo subnets (142) E partially unresponsive (251) F partially unresponsive and having non-multicast IPs (55) ccuracy: B+D / B+D+E+F = 93% Completeness-1: B+D / M = 69% Completeness-2: B+D / B+C+D = 85% 30

31 Use of subnet info for network diagnosis 31

32 Tracenet: n extension for traceroute B network segment 1. Traceroute at toward B Traceroute returns: B 1. One router (or IP address) at each hop on the -to-b path 2. Point-to-point link between consecutive routers (or consecutive (?) IP addresses) 32

33 Tracenet: n extension for traceroute Internet at the network layer consists of Router & subnets (point-to-point OR multi-access) B network segment with ROUTERs & SUBNETs B traceroute returned network segment 33

34 Tracenet Overview Traceroute vs tracenet B network segment 2. Tracenet at toward B t each hop distance d = 2, 3, 1. Trace collection - Find an IP i in a subnet S at hop d 2. Subnet exploration Explore subnet S returning all IP s in it B 34 i S i

35 Tracenet Overview Traceroute vs tracenet B network segment 2. Tracenet at toward B t each hop distance d = 2, 3, 1. Trace collection - Find an IP i in a subnet S at hop d 2. Subnet exploration Explore subnet S returning all IP s in it B i 35 S

36 Tracenet Overview Traceroute vs tracenet B network segment 2. Tracenet Tracenet returns: at toward B t each hop distance d = 2, 3, 1. Trace collection - Find an IP i in a subnet S at hop d One layer-3 subnet topology at each hop on the path B 2. Subnet exploration Explore subnet S returning all IP s in it Multiple IP addresses at each subnet Subnetting relation between IP addresses Subnet mask info for the subnet Some IP alias resolution as an artifact 36

37 traceroute vs tracenet in use IP alias resolution on the links IP addresses & hop distances at each subnet Subnets on a path w/ their subnet mask 37

38 Conclusions IPv4 network topology discovery Router level topology discovery IP alias resolution nonymous router resolution Subnet discovery Presented a heuristic to discover L3 subnet info Developed two tools implementing the scheme explorenet given an IP address, discovers the subnet tracenet an extension to traceroute To download tracenet and explorenet implementations 38

39 Future work How to extend this to IPv6? How to do IPv6 alias resolution? How to do IPv6 subnet discovery? 39

40 Thank you 40

41 TraceNET Heuristic 1 - Prefix Reduction Encountering a stop-and-shrink statement implies that the candidate subnet has been grown beyond its real size Execution of this statement shrinks to by removing all IP addresses in /p but not in /p+1 s the subnet grows larger possibility of encountering a false positive IP address causing execution of stop-andshrink statement increases This rule serves as one of the stopping conditions of subnet exploration algorithm This rule increases our confidence level on accuracy of large subnets 41

42 TraceNET Heuristic 2 Upper Bound Subnet Contiguity Tests whether the candidate IP address is in use and not located farther from the investigated subnet Code Snippet 42

43 TraceNET Heuristic 3 Single Contra Pivot Interface Eliminates Ingress Fringe Interfaces Under a fixed ingress router to subnet Code Snippet 43

44 TraceNET Heuristic 4 Lower Bound Subnet Contiguity Increases the confidence on the contra-pivot interface determined by the previous heuristic Code Snippet 44

45 TraceNET Heuristic 5 Mate-31 Subnet Contiguity Shortcut rule for immediately adding /31 mate of the pivot interface Valid for /30 mate in case /31 mate did not return a reply Code Snippet 45

46 TraceNET Heuristic 6 Fixed Entry Point Tests whether the examined IP address resides at another subnet located at the same distance with the explored subnet Code Snippet 46

47 TraceNET Heuristic 7 Upper Bound Router Contiguity Detects far fringe interfaces Code Snippet 47

48 TraceNET Heuristic 8 Lower Bound Router Contiguity Detects close fringe interfaces Code Snippet 48

49 TraceNET Heuristic 9 Border ddress Reduction This rule applies to the collected subnet not to the examined IP address It is a post processing operation While contains any of the border addresses the subnet is divided into two halves and the one containing the pivot interface is set to be the new iteratively 49