Paris traceroute: Measuring more accurate and complete paths



Similar documents
Measuring Load-balanced Paths in the Internet

Traceroute Anomalies

Network Layer. Introduction Datagrams and Virtual Circuits Routing Traffic Control. Data delivery from source to destination.

Active Measurements: traceroute

Collaborative Research Proposal: an In-Band Traceroute Service. Dave Plonka

Exam 1 Review Questions

Early Recognition of Encrypted Applications

Cisco IOS Flexible NetFlow Technology

Per-Packet Load Balancing

IP Routing Configuring Static Routes

Network layer: Overview. Network layer functions IP Routing and forwarding

Configuring a Load-Balancing Scheme

Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol

Configuring a Load-Balancing Scheme

Measuring and Characterizing End-to-End Route Dynamics in the Presence of Load Balancing

Avaya ExpertNet Lite Assessment Tool

Internet (IPv4) Topology Mapping. Department of Computer Science The University of Texas at Dallas

RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks. Kathleen M. Moriarty. MIT Lincoln Laboratory.

Internet Protocol: IP packet headers. vendredi 18 octobre 13

Homework 3 TCP/IP Network Monitoring and Management

Assignment #3 Routing and Network Analysis. CIS3210 Computer Networks. University of Guelph

Configuring a Load-Balancing Scheme

Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress

Hands On Activities: TCP/IP Network Monitoring and Management

Question 1. [7 points] Consider the following scenario and assume host H s routing table is the one given below:

Troubleshooting Tools

Internet Packets. Forwarding Datagrams

Chapter 4. VoIP Metric based Traffic Engineering to Support the Service Quality over the Internet (Inter-domain IP network)

Enabling Flow-based Routing Control in Data Center Networks using Probe and ECMP

Chapter 9. IP Secure

Software Defined Networking (SDN) - Open Flow

Load Balancing. Final Network Exam LSNAT. Sommaire. How works a "traditional" NAT? Un article de Le wiki des TPs RSM.

CS335 Sample Questions for Exam #2

NAT TCP SIP ALG Support

CS 457 Lecture 19 Global Internet - BGP. Fall 2011

Netflow Overview. PacNOG 6 Nadi, Fiji

Juniper Exam JN0-343 Juniper Networks Certified Internet Specialist (JNCIS-ENT) Version: 10.1 [ Total Questions: 498 ]

How will the Migration from IPv4 to IPv6 Impact Voice and Visual Communication?

Internet Firewall CSIS Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS net15 1. Routers can implement packet filtering

Layer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers

File transfer and login using IPv6, plus What to do when things don t work

Internet Infrastructure Measurement: Challenges and Tools

Network Layer: and Multicasting Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

Network Management & Monitoring

Multihoming and Multi-path Routing. CS 7260 Nick Feamster January

CSE331: Introduction to Networks and Security. Lecture 8 Fall 2006

Internet Architecture and Philosophy

Traceroute The Internet s Diagnostic Tool

Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity

Using IPM to Measure Network Performance

IP Phone Presence Setup

18: Enhanced Quality of Service

Internet Protocols Fall Lectures 7-8 Andreas Terzis

ExtraHop and AppDynamics Deployment Guide

Configuring NetFlow Switching

Advanced BGP Policy. Advanced Topics

High Availability. Vyatta System

An Evaluation of Peering and Traffic Engineering in the Pan- African Research and Education Network

Firewalls and Intrusion Detection

Answers to Sample Questions on Network Layer

High-Frequency Active Internet Topology Mapping

netkit lab MPLS VPNs with overlapping address spaces 1.0 S.Filippi, L.Ricci, F.Antonini Version Author(s)

Balasubramanian Ramachandran

How do I get to

EITF25 Internet Techniques and Applications L5: Wide Area Networks (WAN) Stefan Höst

Troubleshooting Load Balancing Over Parallel Links Using Cisco Express Forwarding

Internetworking. Problem: There is more than one network (heterogeneity & scale)

RapidIO Network Management and Diagnostics

2. IP Networks, IP Hosts and IP Ports

Procedure: You can find the problem sheet on Drive D: of the lab PCs. 1. IP address for this host computer 2. Subnet mask 3. Default gateway address

NAT and Firewall Traversal with STUN / TURN / ICE

Computer Networks I Laboratory Exercise 1

Network layer" 1DT066! Distributed Information Systems!! Chapter 4" Network Layer!! goals: "

Efficient strategies for active interface-level network topology discovery

1. How many unique network IDs are there in class A addresses? # of unique hosts?

Gary Hecht Computer Networking (IP Addressing, Subnet Masks, and Packets)

Network Management and Debugging. Jing Zhou

Network Security TCP/IP Refresher

Technical Bulletin. Enabling Arista Advanced Monitoring. Overview

Passive Network Traffic Analysis: Understanding a Network Through Passive Monitoring Kevin Timm,

Inter-domain Routing Basics. Border Gateway Protocol. Inter-domain Routing Basics. Inter-domain Routing Basics. Exterior routing protocols created to:

Transcription:

Paris traceroute: Measuring more accurate and complete paths rice ugustin Fabien Viger, Xavier uvellier, Matthieu atapy, lémence Magnien, Timur Friedman and Renata Teixeira aboratoire IP6 NRS Université Pierre et Marie urie Paris 6

What s wrong with traceroute? -bash-3.00$ traceroute -n www.google.com 1 70.87204.1 8.323 ms 0.797 ms 1.066 ms 2 70.84.160.130 0.471 ms 0.262 ms * 3 70.85.127.109 0.299 ms 0.258 ms 0.256 ms 4 70.87.253.17 0.302 ms 0.206 ms * 5 208.172.139.129 0.569 ms 0.556 ms 0.480 ms 6 204.70.193.193 28.347 ms 204.70.192.49 0.694 ms * 7 208.172.97.170 28.380 ms 204.70.193.185 28.378 ms 208.172.97.170 28.374 ms 8 208.172.99.94 28.356 ms 208.172.108.6 28.483 ms 208.172.99.94 28.444 ms 9 72.14.238.57 30.792 ms 30.674 ms 208.172.108.6 28.437 ms 10 72.14.238.151 31.371 ms 72.14.238.57 30.653 ms 30.718 ms 11 66.249.95.194 40.722 ms 72.14.238.151 31.237 ms 66.249.95.194 40.870 ms 12 216.239.51.104 31.390 ms 72.14.238.190 40.858 ms 216.239.51.104 31.357 ms 1

What s wrong with traceroute? -bash-3.00$ traceroute -n www.google.com 1 70.87204.1 8.323 ms 0.797 ms 1.066 ms 2 70.84.160.130 0.471 ms 0.262 ms * 3 70.85.127.109 0.299 ms 0.258 ms 0.256 ms 4 70.87.253.17 0.302 ms 0.206 ms * 5 208.172.139.129 0.569 ms 0.556 ms 0.480 ms 6 204.70.193.193 28.347 ms 204.70.192.49 0.694 ms * 7 208.172.97.170 28.380 ms 204.70.193.185 28.378 ms 208.172.97.170 28.374 ms 8 208.172.99.94 28.356 ms 208.172.108.6 28.483 ms 208.172.99.94 28.444 ms F 9 72.14.238.57 30.792 ms 30.674 ms 208.172.108.6 28.437 ms E 10 72.14.238.151 31.371 ms 72.14.238.57 30.653 ms 30.718 ms 11 66.249.95.194 40.722 ms 72.14.238.151 31.237 ms 66.249.95.194 40.870 ms 12 216.239.51.104 31.390 ms 72.14.238.190 40.858 ms 216.239.51.104 31.357 ms G H J N K 2

Findings Identified traceroute deficiencies on load balanced paths Measured paths are inaccurate and incomplete May diagnose an incorrect path Many routers have load balancing capabilities Per-packet, per-flow, per-destination uilt a new traceroute: Paris traceroute 3

lassic vs Paris traceroute lassic traceroute: E G H J N K F Paris traceroute: K F E G H I J M N 4

Traceroute under load balancing ctual network: TT = 2 E Inferred path: TT = 3 False link E Missing nodes and links 5

Hard to diagnose aberrant paths ctual network: TT = 3 TT = 4 Inferred path: TT = 2 6

Hard to diagnose unstable paths ctual network: E Inferred path: E 7

Problems happen even under per-flow load balancing Port 2 Flow 1 Port 1 TT = 2 Port 3 E TT = 1 TT = 3 Traceroute uses the destination port as identifier Per-flow load balancers use the destination port as part of the flow identifier 8

Paris traceroute: Tracing a single path Solves the problem with per-flow load balancing Packets have the same flow identifier Works with UP, TP and IMP Port 1 Port 1 Port 1 TT = 2 TT = 3 E TT = 1 9

Identifying the probes IPv4 header V/ihl TOS ength Identifier Fragment TT Proto hecksum Source address estination address Payload Source port est. port Type ode hecksum ength hecksum Identifier Sequence Payload Payload UP header IMP header 10

Paris traceroute: Tracing all the paths hange the probing strategy t each hop: Send packets with a different flow identifier Send enough probes to enumerate all interfaces with a high degree of confidence lassify load balancers: per-flow or per-packet 11

Interfaces enumeration TT = 1 Port Port Port Port 12 4 811? Port Port Port 35 67 910?? Steps: Interfaces after? Suppose 2 interfaces Send 6 packets through Responses from 2 interfaces Suppose actually 3 interfaces Send 5 more packets through No third interface Stop probing 12

Probing overhead per hop lassic traceroute: 3 packets by default Paris traceroute: at least 6 packets to rule out load balancing # interfaces 1 2 3 4 5 6 15 16 # packets 6 11 16 21 27 33 90 96 Up to 96 probes (up to 16 responding interfaces in our traces) 13

Paris traceroute output -bash-3.00$ paris-traceroute n a exh www.amazon.com 1 132.227.74.1 2 132.227.106.254 [...] 7 194.68.129.201 8 64.125.23.13:0,1,3,6,9,10 64.125.23.9:2,4,5,7,8 9 64.125.27.225:0,1,3,6,9,10 64.125.27.165:2,4,5,7,8 10 64.125.27.57:0,1,3,6,9,10 64.125.27.209:2,4,5,7,8 11 64.125.28.126:0,1,3,6,9,10 64.125.29.109:2,4,5,7,8 12 64.125.29.230 [...] Single path, no load balancing Per-flow load balancer 2 load-balanced paths ist of flow identifiers 14

oad balancing is common Measurements from 15 sources to 70,000 destinations Paths affected by load balancing: 39% by per-flow 2% by per-packet 70% by per-destination Many Tier-1s use load balancing 15

oad balancing causes anomalies From our IP6 vantage point: iamonds appear in 30% of the destinations Paris traceroute removes 10,662 from 19,159 (56%) oops appear in 4.5% of the measured routes Paris traceroute removes 5,047 from 5,795 (87%) ycles appear in 0.25% of the measured routes Paris traceroute removes 3,886 from 5,674 (68%) Other causes Routing changes NT boxes uggy routers Per-packet load balancing 16

oad-balanced paths Generally short, narrow and symmetric Some are extremely long More than 10 hops Some others are very wide Up to 16 responding interfaces Parallel paths with different hop counts 17

onclusion Vast deployment of load balancing lassic traceroute discovers inaccurate and incomplete paths Paris traceroute reports more accurate and complete paths 18

More information www.paris-traceroute.net 19

Perspectives Measure native path diversity in the internet (submitted to IM2007) Handle some probing subtleties Simple extensions to detect: Per-destination load balancing Uneven load balancing Return path diversity 20

ackup slides/making of 21

Hop by hop progression Port Port Port 12 4 811 Port 12 Port Port Port 12 48 11?? TT = 2?? E Next steps: Nexthops of? Find enough packets traversing Enumerate interfaces 22

oad balancer classification Port Port Port Port Port Port 1 Steps: Port 1 Port 1 Per-packet or per-flow Suppose per-packet? TT = 1 Send 6 identical packets Responses from 12 interfaces 23

What s wrong with traceroute? -bash-3.00$ traceroute -n www.google.com 1 70.87.204.1 8.323 ms 0.797 ms 1.066 ms 2 70.84.160.130 0.471 ms 0.262 ms * 3 70.85.127.109 0.299 ms 0.258 ms 0.256 ms 4 70.87.253.17 0.302 ms 0.206 ms * 5 208.172.139.129 0.569 ms 0.556 ms 0.480 ms 6 204.70.193.193 28.347 ms 204.70.192.49 0.694 ms * 7 208.172.97.170 28.380 ms 204.70.193.185 28.378 ms 208.172.97.170 28.374 ms 8 208.172.99.94 28.356 ms 208.172.108.6 28.483 ms 208.172.99.94 28.444 ms 9 72.14.238.57 30.792 ms 30.674 ms 208.172.108.6 28.437 ms 10 72.14.238.151 31.371 ms 72.14.238.57 30.653 ms 30.718 ms 11 66.249.95.194 40.722 ms 72.14.238.151 31.237 ms 66.249.95.194 40.870 ms 12 216.239.51.104 31.390 ms 72.14.238.190 40.858 ms 216.239.51.104 31.357 ms H E G J F N K 24

Introduction Traceroute measures a path between two hosts in an IP network It is widely used by: Network operators Networking researchers Geeks/omputer enthusiasts 25

Hard to diagnose aberrant paths Inferred path: ctual network: TT = 3 TT = 4 TT = 2 26

Hard to diagnose unstable paths Inferred path: E ctual network: E 27

Introduction K E G H F J N 28