A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA

A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA Yuming Jiang, Chen-Khong Tham, Chi-Chung Ko Department of Electrical Engineering, National University of Singapore, 10 Kent Ridge Crescent, Singapore 119260. Email: engp7450, eletck, elekocc@nus.edu.sg Abstract. Keywords: This paper presents a CORBA-based traffic monitoring scheme for monitoring real-time traffic flows. This scheme enables a Web-based network manager application to locate relevant traffic monitors along the path of a real-time flow and subsequently retrieve traffic information from them in real-time. This information can be displayed in graphical form and also used to derive additional performance parameters related to the real-time traffic flow. Network management, Real-time traffic, Web-based management, CORBA 1. INTRODUCTION The increasing use of real-time applications (RTAs), such as audio and video, over the Internet and the interest in adding Web functionality in networking applications invoke the need of Web-based network management for RTAs. Among all aspects of such management, traffic monitoring is an essential one. There are two Web-based network management models commonly adopted by current Web-based network management/monitoring systems (NMSs) [8, 9, 10, 11]. Figures 1 and 2 show the functional components of the two models. In these models, the Web-based manager is the component that retrieves information from other elements of the configuration, analyses the information, and shows analysed results to users. The agent is the component which gathers and records management information for one or more network elements and communicates the information to the manager through the embedded Web-server. The managed objects component 1

2 contains management information about network resources and their activities. The network management server component in Figure 2 generates summaries and statistical analyses of management information. It acts as an information collecting and analysing centre for locally managed network elements. Both models use HTTP and/or Java techniques to exchange management information between the Web-based manager and embedded Web-server. The interfaces between the manager and Web-server are proprietary. Figure1. One-to-one model Figure2. A model for summarisation These two models are widely used in current Web-based NMSs. However, they are not suitable for monitoring real-time traffic. One reason is that real-time applications usually cross several network segments and administrative domains. This makes sharing of network management information, such as real-time traffic information, among different NMSs difficult because of the proprietary interfaces between the manager and Web-server in these models. Another reason is that, in these models, there is no means for the manager to locate other devices or servers automatically. In contrast, monitoring real-time traffic flows requires the Web-based manager to retrieve traffic information from devices or servers embedded in different network segments simultaneously. In order to provide a possible approach for the real-time traffic monitoring, we have designed a new CORBA-based scheme. With this scheme, the Web-based manager can locate relevant traffic monitors along the path of a real-time traffic flow and simultaneously retrieve traffic information from them in real-time. This scheme includes a CORBA-based network monitoring structure and a mechanism for the Web-based manager to retrieve real-time traffic information from relevant traffic monitors simultaneously. The following sections describe the scheme in detail.

A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA 3 2. PROPOSED CORBA-BASED SCHEME In this section, an overview of CORBA-based network management architecture is given. Then, the reason of selecting event reporting for retrieving traffic information is introduced. Thirdly, the CORBA-based realtime traffic monitoring structure of the proposed scheme is described. Fourthly, CORBA IDL interfaces are defined for this scheme. Finally, the mechanism used by the Web-based manager to interact with traffic monitors is presented. 2.1 CORBA-based network management architecture A network is inherently distributed and heterogeneous, so is its management. Although SNMP gives the baseline of interoperation of network management over the Internet, the above two conventional models show that the proprietary interfaces make it difficult to integrate different vendors' NMSs. To face this challenge, researchers, standard bodies and industry are looking in new directions to meet today's network management requirement. CORBA seems to be a suitable technology framework for this and CORBA-based network management is gaining more and more interest from researchers to NMS vendors [2, 3, 4, 5, 6, 12]. Figure 3. CORBA-based network management architecture The Common Object Request Broker Architecture (CORBA) [1], defined by Object Management Group (OMG), offers an environment for building distributed object-oriented applications. With CORBA, users gain access to distributed objects transparently without having to know where they are located or what software or hardware platform they reside on. OMG also defines the Interface Definition Language (IDL) and different

4 programming language mappings to the interfaces defined by the IDL. These enable client/server objects to interact among Object Request Brokers (ORBs) from different vendors. Through a local ORB, a client can transparently invoke a method on a server object, i.e. implementation of the object, which can be on the same machine or across a network. The local ORB intercepts the call and is responsible for finding an object that can implement the request, pass parameters to it, invoke its method, and return the results to the client. These operations can pass through another ORB to reach the implementation object if it is located on a different machine. An Internet Inter-ORB Protocol (IIOP) [1] has been defined by OMG for ORBto-ORB communication. Figure 3 shows the CORBA-based NMS architecture. In this architecture, the manager interacts with managed network elements through IIOP. The elements can be a CORBA-based NM agent, an SNMP agent with CORBA/SNMP gateway [2, 4], or even an SNMP NM server with CORBA/SNMP gateway. The interfaces between the manager and managed network elements are defined in the CORBA IDL. The interworking between CORBA and SNMP systems has been proposed in [3] and [4]. In this architecture, the manager interacts with the CORBA-based NM agents directly instead of through an embedded Web-server as in conventional Web-based management models. In addition, the manager can retrieve information from different agents simultaneously. 2.2 Event reporting vs. polling Event reporting and polling are two approaches used in NMSs for a manager to retrieve management information from managed objects. Polling is a request-response interaction between a manager and an agent. With event reporting, the initiative is with the agent and the manager takes on the role of a listener, waiting for incoming information. Both approaches are useful for network management. However, it is obvious that event reporting will cause less management traffic and less notification delay than polling. Hence, event reporting is adopted in the proposed real-time traffic monitoring scheme. 2.3 Real-time traffic monitoring structure Figure 4 shows the structure of the proposed Web-based real-time traffic monitoring scheme. In this structure, there are five functional elements: (1) the source of real-time traffic or the sender, (2) the sink of the traffic or the receiver, (3) the Web-based monitoring manager, (4) the CORBA-based traffic monitor, and (5) the real-time application name server (RTANS). The

A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA 5 source sends real-time traffic to the receiver. The receiver is the sink and user of the traffic. The monitor gathers information about the real-time traffic and communicates that information to the manager. There can be several monitors along the path of the real-time traffic flow. The manager is the real-time traffic information processing centre, retrieving traffic information from relevant monitors, displaying monitored traffic graphs and providing traffic analysis results like throughput, jitter and loss rate to users. The RTANS acts as a registration centre, providing a name service both to traffic monitors and to the manager: monitors register their CORBA object references and traffic attributes with it, while the manager select them from it. Among the five elements, the latter three are involved in real-time traffic monitoring. They interact with each other through the ORB Core which includes the ORB, client-side Stub, server-side Skeleton and IIOP. Figure 4. CORBA-based real-time traffic monitoring structure 2.3.1 Monitor The traffic monitor, which can be embedded in the sender, the receiver or just standalone, is responsible for gathering information about real-time traffic and reporting the traffic information to the manager. Based on [7], it consists of two functional elements: (1) a traffic flow meter and (2) CORBA-based monitor objects, the reader in [7]. The traffic flow meter counts the number of packets and bytes in real-time traffic flows. These real-time traffic flows are identified by their attributes. In the proposed scheme, the attributes of a real-time traffic flow includes its source address, source UDP port, destination address and destination UDP port. The CORBA-based monitor objects, generated for each new detected real-time traffic flow, are responsible for communicating usage data, like the number of bytes in the traffic flow, from the meter to the Web-based manager.

6 Detecting the start of a new real-time traffic flow triggers two consecutive events in a monitor. The first is the start of a new group of CORBA-based monitor objects which provide interaction mechanisms between the monitor and RTANS, and between the monitor and manager. The second is the registration of new detected real-time traffic flow attributes and object references to the RTANS. 2.3.2 Web-based manager The manager is the real-time traffic information processing centre which retrieves traffic information from relevant monitors, displays monitored traffic graphs and provides traffic analysis results. The manager firstly selects a real-time application which it wants to monitor from the RTA list obtained from the RTANS. Then, it generates corresponding CORBA objects to communicate with monitors that are metering the traffic of the real-time application at different network segments. Lastly, the manager provides analysis results to users according to the information collected from all relevant monitors. 2.3.3 Real-time application name server The Real-Time Application Name Server (RTANS) is a well-known name server to both the manager and monitors in a real-time traffic monitoring system. It is a registration centre where traffic monitors register real-time traffic attributes and corresponding CORBA object references. The traffic attributes are used by the RTANS to sort out monitors relating to a certain real-time application and generate a RTA list. The object reference enables the manager to retrieve the object and invoke operations of the object. 2.4 IDL interfaces There are three IDL interfaces defined in the proposed scheme. They are interfaces between following monitoring elements: (1) monitor-rtans, (2) manager-rtans, and (3) manager-monitor. Table 1 describes the IDL interfaces of monitor-rtans and manager- RTANS. For these interfaces, the RTANS acts as the server side, while the monitor and the manager act as the client side of ForMonitor and ForManager respectively. The key operation in ForMonitor IDL is register. The register operation is used by the monitor to register attributes of realtime traffic flows which it detects, and references of CORBA objects generated for the detection. The attributes are described by RtAttributes and

A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA 7 the reference is represented by MonitorOp, defined in Table 2. The ForManager interface has an operation of getrtalist which is used by the manager to get the RTA list of type RtaList from the RTANS. The RtaList type consists of traffic attributes of the RTA and references of all relevant MonitorOp objects in corresponding monitors. Table 1. Interfaces of monitor-rtans and manager-rtans module RTANS { //Real-Time Application Name Server struct RtAttributes{ ;}; //attributes of real-time traffic struct RtItem { RTFM::MonitorOp monitorop; RtAttributes rtattributes;}; //item of RTA list typedef sequence<rtitem> RtaList; //RTA list interface ForMonitor { void register ( in RtAttributes rtattr, in RTFM::MonitorOp monitorop);}; interface ForManager { void getrtalist( out RtaList rtalist ); }; }; //End of RTANS module Table 2. Interface of manager-monitor module RTFM{ //Real-Time Flow Monitoring struct Record{ ;}; //record of real-time traffic information typedef sequence<record> Records; interface ManagerOp { void updatetrafficinfo ( in Records records ); }; interface MonitorOp { void setmanagerobj ( in ManagerOp managerop ); void setupdateinterval ( in long interval ); }; }; // End of RTFM module Table 2 describes IDL interfaces between the manager and monitor. For MonitorOp, the monitor is the server which implements the object, while the manager acts as the client. For the ManagerOp, however, the manager is on the implementation side while the monitor is the client. There are two key operations in the MonitorOp IDL: setmanagerobj and setupdateinterval. The setmanagerobj operation is invoked by the manager to send its ManagerOp reference to the monitor, and the setupdateinterval is called to set the update interval used by the monitor to report traffic information to the manager. The key operation in ManagerOp IDL is updatetrafficinfo which is invoked by the monitor to automatically update traffic information, like the number of bytes in the traffic flow, to the manager in the update interval.

8 2.5 Real-time traffic monitoring mechanism Figure 5 shows CORBA objects and their interactions in the proposed scheme. The IDL interfaces of these objects have been defined in Table 1 and Table 2. Figure 5. Interaction among CORBA objects The steps through which the manager finds relevant monitors to a RTA and subsequently cause the monitors to report their monitored traffic information of the RTA to the manager are as follows. Firstly, once a new real-time traffic flow has been detected, a monitor initiates three CORBA objects: a client object of ForMonitor, a proxy object of ManagerOp, and an implementation object of MonitorOp. Secondly, the monitor registers attributes of the real-time traffic, i.e. RtAttributes type, and the reference of the implementation object of MonitorOp to the RTANS by invoking the register operation from the client object of ForMonitor. At the same time, in the RTANS, the implementation object of ForMonitor will add this new registration item to its relevant RTA list according to its traffic attributes. Thirdly, the manager gets the RTA list, RtaList type, from the RTANS by invoking getrtalist operation from the ForManager interface whose client object is in the manager while the implementation is in the RTANS. The manager selects a RTA and its relevant monitors' MonitorOp references from the RTA list and starts to retrieve traffic information from these monitors. This causes the generation of several groups of CORBA objects. Each group, responsible for communicating with one monitor, consists of a proxy object of MonitorOp and an implementation object of ManagerOp.

A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA 9 After these, the fourth step is that each object group of the manager sends its reference of implementation object of ManagerOp and the required traffic information update interval to its corresponding monitor by invoking setmanagerobj and setupdateinterval operations through the proxy of MonitorOp. Lastly, each monitor, after receiving the ManagerOp implementation object reference, reports current traffic information periodically in the required interval to the manager by calling the updatetrafficinfo operation through the proxy of the ManagerOp. Through the above steps, the Web-based manager can locate and communicate with relevant monitors simultaneously; the monitors can report traffic information to the manager directly. Hence, the manager can get traffic information of a RTA from different network segments in realtime. With that information, the manager can provide more insightful analyses such as the throughput experienced by the traffic flow at different network segments, the delay variation and loss rate, to users. 3. PROTOTYPE IMPLEMENTATION A prototype monitoring system has been implemented based on the proposed scheme. Figure 6 shows the test bed and location of each of the functional elements, described in Section 2.3. The ORB used in our design is OrbixWeb 3.0 [13] for Windows NT/95. The Web-based manager, the RTANS, and CORBA objects part of the monitor are written in Java using JDK 1.1 [14] The Java multithreading technique is used in our design to generate multiple threads of CORBA objects in the manager and monitors. With multiple threads, the manager can simultaneously retrieve traffic information of a real-time application from relevant monitors at different network segments. The Web-based manager, like any Applet, is subject to security restrictions imposed by the browser in which it executes. To overcome this, Java Plug-in [15] is adopted. The HTML file in which the manager Java program is embedded is converted to support the Java Plug-in by using the Java Plug-in HTML Converter [15]. In Figure 6, there are three monitors at different network segments: Monitor 1 embedded in the sender host, Monitor 2 in the router, and Monitor 3 in the FastEthernet segment. Figure 7 shows a sample page of traffic graphs of a real-time application metered by the three monitors. This page is created by the Web-based manager of our prototype NMS using the proposed scheme. With the traffic information from the three monitors, other data about the traffic flow, such as the data loss rate, can be easily derived.

10 Figure 6. Test-bed of prototype implementation From Monitor 1 From Monitor 2 Monitored Traffic Traffic Average From Monitor 3 Figure 7. A sample page of monitored traffic graphs

A Web-Based Real-Time Traffic Monitoring Scheme Using CORBA 11 4. CONCLUSIONS The widespread use of the WWW and increasing use of real-time applications over the Internet result in the use of Web-based network management for real-time applications. Among the features of such a network management system, monitoring real-time traffic is the most fundamental one. However, conventional Web-based network management models have difficulty in providing this. In this paper, a new CORBA-based real-time traffic monitoring scheme has been presented. With this scheme, the manager can simultaneously retrieve traffic information of a real-time application from different network segments in real-time. The traffic information is reported by traffic monitors embedded at different network segments. With such information, the manager can easily derive additional parameters of the real-time application, such as delay variation and loss rate. A prototype implementation of the proposed scheme has also been described, showing the feasibility of this scheme. REFERENCES [1] OMG, The Common Object Request Broker: Architecture and Specification, v2.0, July 1996. [2] S. Mazumdar and K. Swanson, WEB based management - CORBA/SNMP gateway approach, presented at the Seventh IFIP/IEEE International Workshop on Distributed Systems: Operations & Management, L'Aquila, Italy, October 28-30, 1996. [3] OMG, Interworking between CORBA and TMN System, RFP, OMG Doc#: telecom/97-09-04, September 29, 1997. [4] OMG, JIDM Interaction Translation - SNMP part: Final submission to OMG's CORBA/TMN Interworking, RFP, OMG Doc#: telecom/98-05-03, May 1998. [5] L. Deri, B. Ban, Static vs. Dynamic CMIP/SNMP Network Management Using CORBA, IBM Research Report, IBM Zurich Research Laboratory, 1996. http://domino.watson.ibm.com/library/cyberdig.nsf/papers/ [6] G. Chen, M. Neville, Q. Kong, Distributed Network Management Using CORBA/TMN, Proceedings of the 7th IFIP/IEEE International Workshop on Distributed Systems Operation and Management (DSOM), 1996. [7] N. Brownlee, C. Mills, G. Ruth, Traffic Flow Measurement: Architecture, RFC 2063, 1997. [8] J. Boyle, H. Truong, N. Nour, Providing a web-based view of your managed network, Proceedings of 1997 IEEE International Conference on Communications (ICC'97), Montreal, Canada, June, 1997. [9] 3COM, Transcend drmon Edge Monitor System, http://www.3com.com/products/dsheets/400310.html [10] MCI, vbns Network Traffic and Performance Monitoring, http://www.vbns.net/nettraff.html

12 [11] D. Backman, Web-based Management: 9 Products to Help Simplify Your Network, Features, July 15, 1997, Network Computing Magazine. http://www.networkcomputing.com/ [12] Hewlett-Packard, HP Introduces CORBA-based OpenView Telecom Platform with Topology Service and CORBA/TMN Integration, April, 1997. http://www.hp.com/csopress/97apr29a.html [13] IONA Technologies, OrbixWeb 3.0 Evaluation Edition, http://www.iona.com/ [14] JavaSoft, Java Development Kit, http://www.javasoft.com/products/jdk/1.1/ [15] JavaSoft, Java Plug-In, http://www.javasoft.com/products/plugin/