Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.
-
date post
19-Dec-2015 -
Category
Documents
-
view
216 -
download
2
Transcript of Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.
![Page 1: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/1.jpg)
Observed Structure of Addresses in IP Traffic
CSCI 780, Fall 2005
![Page 2: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/2.jpg)
More specific Structural characteristics of
destination IP addresses seen on Internet links Traces are omni-directional Set of source addresses is roughly
equal to set of destination addresses Destination address prefix based
aggregation
![Page 3: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/3.jpg)
Terminology Active address: an IP address visible
in the trace as destination p-aggregate: a set of IP addresses
that share the same p-bit address prefix
Active p-aggregate: a p-aggregate containing at least one active address
N: the number of active addresses in the trace
![Page 4: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/4.jpg)
Problem statement How can we model the set of
destination IP addresses visible on the access links?
In particular, how can we model the addresses aggregate (address structure)?
![Page 5: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/5.jpg)
Address structure
The arrangement of active addresses in the address space
![Page 6: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/6.jpg)
Trace collection
![Page 7: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/7.jpg)
Importance of address structure A stable short-term fingerprint of a
site Different sites have different address
structure
Address structure is the most important factor affecting aggregate packet count distribution
![Page 8: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/8.jpg)
Packet count distribution No. of packets per flow; (heavy-tail) per destination address; (heavy-tail) per destination address aggregate (MORE
heavy-tail)
![Page 9: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/9.jpg)
Factors affecting aggregate packet counts Address packet counts
No. of packet per destination address
Address structure No. of active addresses per aggregate
Correlation between these two
![Page 10: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/10.jpg)
Semi-experiments
![Page 11: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/11.jpg)
Address structure matters most
![Page 12: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/12.jpg)
Tour of U1’s address structure
![Page 13: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/13.jpg)
Address structure looks self-similar Interesting structure all the way down
Visually self-similarself-similar characteristics Validate the intuition: multi-fractal
model for address structure An address structure viewed as a subset of
the unit interval [0,1) Cantor dust with two parameters
Dimension: active p-aggregates Mass: active addresses within each prefix
aggregate
![Page 14: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/14.jpg)
Canonical Cantor Dust
![Page 15: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/15.jpg)
Dimension for address space
![Page 16: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/16.jpg)
Fitness with prefix aggregates
![Page 17: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/17.jpg)
Why multi-fractal
Mono-fractal only captures global scaling behavior of aggregate counts
Address structure has different local scaling behavior (active addresses)
Besides (capacity) dimension, introduce another parameter: mass
![Page 18: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/18.jpg)
Multi-fractal Model Start with a cantor dust with dimension
D Repeatedly remove middle subinterval
with proportion
Unequally distribute a unit of mass between subintervals Unequal distribution of mass leads to
different local scaling behaviors
![Page 19: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/19.jpg)
The model fits well
![Page 20: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/20.jpg)
Causes Cascade effects:
A recursive subdivision plus a rule for distributing mass
Procedure of address allocation ICANN allocates short prefixes to providers Providers allocates less shorter prefixes to
customers Share the same rule: left-to-right allocation
![Page 21: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/21.jpg)
Is the model useful?
![Page 22: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/22.jpg)
How densely addresses are packed?
Metrics: active p-aggregate counts for prefix p
![Page 23: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/23.jpg)
Aggregation ratio
![Page 24: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/24.jpg)
Characterize address separation Metrics: discriminating prefixes of an
active address a The prefix length of the largest aggregate
whose only active address is a : number of addresses that have
discriminating prefix p
![Page 25: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/25.jpg)
CDF of address discriminating Prefix counts
![Page 26: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/26.jpg)
Aggregate population distribution
Population of an aggregate is the number of active addresses contained in it
Aggregates exhibit a wide range of population
Aggregate population distributions are the most effect test to differentiate address structures
![Page 27: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/27.jpg)
CDF of aggregate population distribution
![Page 28: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/28.jpg)
Properties of Sampling effect
How does the shape of the curve depend on N?
Short-term stability Is stable over short time period?
![Page 29: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/29.jpg)
Similar curves
![Page 30: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/30.jpg)
Relatively stable
![Page 31: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/31.jpg)
Worm changes the shape
![Page 32: Observed Structure of Addresses in IP Traffic CSCI 780, Fall 2005.](https://reader030.fdocuments.us/reader030/viewer/2022032703/56649d385503460f94a12496/html5/thumbnails/32.jpg)
Worm changes aggregate packet count