Francesco Oppedisano

Towards Privacy-Preserving Network Monitoring: Issues and Challenges

Passive network monitoring is required for the operation and maintenance of communication networks as well as to detect frauds and attacks. Typically, raw packet-level traffic traces are collected using suitable traffic probe devices and fed to monitoring applications (IDSs, antivirus, etc.) for analysis, with potential risks for the legitimate privacy rights of the customers. This paper aims to discuss the technical feasibility and the underlying research challenges of a two-tiered privacy-preserving network monitoring system, where carefully designed data protection mechanisms can coexist with suitably adapted monitoring applications.

A cooperative PC/Network-Processor architecture for multi gigabit traffic analysis

The extensive availability of cost effective commodity PC hardware pushed the development of flexible and versatile traffic monitoring software such as protocol analyzers, protocol dissectors, traffic sniffers, traffic characterizers and IDSs (Intrusion Detection Systems). The largest part of these pieces of software is based on the well known libpcap API, which in the last few years has become a de facto standard for PC based packet capturing. Many improvements have been applied to this library but it still suffers from several performance flaws that are due not to the software itself but rather to the underlying hardware bottlenecks. In this paper we present a new traffic monitoring device, implemented by an Intel IXP2400 Network Processor PCI-X card connected to a gigabit Ethernet LAN hosting a cluster of common personal computers running any libpcap based application. This architecture outperforms the previous solutions in terms of packet capturing power and timestamp accuracy.

PingPair: A Lightweight Tool for Measurement Noise Free Path Capacity Estimation

The paper presents PingPair, a novel tool for end-to-end path capacity estimation. The tool is based on the classical packet dispersion technique, enhanced by a novel algorithm for the selection of the best measurement samples based on queueing delay estimation. In addition, PingPair takes into account the measurement noise that afflicts the interarrival times registered by a user level application; we experimentally observe the Gaussian nature of such a noise. Since PingPair relies on one- point measurements only, it can be deployed in almost all network scenarios, thus providing maximum flexibility. The performance of the tool has been assessed through both NS2 simulations and extensive experimental campaigns, including Internet as well as field trial measurements. The results are compared to those achieved by Capprobe, which is one of the most effective out of the many available one-point measurement-based capacity estimation tools. Despite the very low amount of probing traffic generated, PingPair outperforms Capprobe in most scenarios, yielding more precise capacity estimates; therefore, it proves to be a very fast and unintrusive way to measure the capacity of a network path.

Noise Reduction Techniques for Network Topology Discovery

Topology discovery techniques based on a network tomography approach can be successfully adopted in almost all scenarios, in that they infer the internal characteristics of a network without any cooperation from the internal nodes. Out of the many tomographic topology discovery techniques proposed in the literature, those based on the use of packet sandwich probes (a special kind of packet trains) present some particularly attractive features. The rationale of such approaches is to take advantage of end-to-end measurements to infer the logical topology of the network through hierarchical clustering algorithms. Typically, due to the interference with cross traffic, such measurements are affected by a zero-mean noise which, in turn, may cause the wrong reconstruction of the network topology. This paper analyzes the causes of certain noise patterns (which have actually been observed during experiments) and proposes a noise reduction algorithm to sort out this issue. Such an algorithm does not rely on any assumption about the statistical model of the cross-traffic noise and its effectiveness has been tested through a campaign of ns2 simulations.

Merging Spanning Trees in Tomographic Network Topology Discovery

Tomographic techniques allow the reconstruction of network topologies with no need for cooperation from internal routers. However, most of such mechanisms adopt a method of node clustering producing trees that reveal only a partial structure of the network. Therefore, we have proposed a novel approach to topology discovery based on packet sandwich probes and decision theory allowing to retrieve a complete picture of the network, which includes the detection of all the internal nodes along with the values of capacities of the interconnecting links. Such an approach, as well as all the standard techniques of topology discovery, reconstructs the spanning tree of the probe sender only. Hence, in this paper a specific technique is presented for merging the spanning trees associated to all different roots, in order to provide a complete representation of the network. Such a method does not require further probing traffic and is specifically designed to merge topology reconstructions where all the nodes of the network (not only the branching nodes) are revealed, along with link capacities. Our algorithm performs quite well on a wide set of both synthetic and realistic topologies, and in many cases provides a picture of the network which is exactly equivalent to the original one.

Network Topology Discovery Based on a Finite Set of Hypotheses

Tomographic techniques allow for the reconstruction of network topologies with no need for cooperation from internal routers. Traditional tomographic techniques infer the internal network layout by clustering nodes into tree structures that, in many cases, reveal only a partial graph structure of the network. This paper proposes a novel approach to network topology discovery by means of packet sandwich probes; the underlying theoretical basis relies on the application of Decision Theory to a finite set of possible topological hypotheses. The decision process is however disturbed by the interaction of probes with regular cross traffic, which results in a background noise that afflicts the measurements. To cope with this phenomenon, a model-free noise reduction technique is also used. The algorithms presented in the paper are validated through extensive simulations in several network scenarios. The results show that such a methodology allows to retrieve a complete picture of the network that includes the detection of all the internal nodes along with the values of capacities of the interconnecting links.

A Novel High-Speed Micro-Flows Classification Algorithm Based on Perfect Hashing and Direct Addressing

The high level of performance achieved by todays traditional PCs makes x86 personal computers effective and inexpensive platforms for the development of high performance network devices. In particular, such devices can replace, especially in the access portion of the network, traditional devices for operations like management, monitoring and accounting. This new possibility pushes the research towards the development of new algorithms and functionalities on top of the x86 architecture. In this framework, the purpose of this work is to design a new high-speed longest prefix classification algorithm for packet accounting to be integrated on top of Linux based PCs for traffic characterization and accounting on high speed (> 1Gbps) links, regardless of the detail level of the rule set.