Hal Burch

Mapping the Internet

How can you determine what the Internet or even an intranet looks like? The answer is, of course, to draw it on screen. Once you can see the data succinctly, it becomes much easier to understand. The drawing itself can help locate bottlenecks and possible points of failure. Where is that newly acquired subsidiary connected? Which business units have connections to business partners? More important, visual displays of networks have another dimension-color. Color is an easy way to display link use, status, ownership, and network changes.

What can you do with Traceroute

Traceroute has been a staple of network administration since the mid-1980s. This well-known utility traces outgoing paths toward network destinations by sending packets with progressively longer time-to-live (TTL) fields and recording their deaths. When a packet dies, most routers return a notice using one of their interface addresses. Traceroute records the addresses, which we can identify using the Domain Name System (DNS). Traceroute is an interactive tool that is not suitable for Unix-style programming with pipes and filters. We have embedded the programs functions in a filter, which gives us great flexibility in network mapping and other network explorations.

Monitoring link delays with one measurement host

We present RCM, a system to monitor link delays on a network using a single measurement host. RCM is a combination of a new measurement system and a new network tomography technique. The measurement system employs tunnels to connect to border routers where it can source and sink measurements across the network. RCM uses network tomography to calculate the delays across individual network links from these measurements. The network tomography technique expands on previous linear algebra techniques to deal with the limitations of the resulting data without assuming either link delay symmetry or a particular topology. The network tomographic technique is compared against direct measurements in simulation to ensure accuracy. RCM is deployed on a large ISPs network to diagnose the cause of end-to-end delays, from which additional results are presented. The results are compared against known behaviors of the network to ensure the results are consistent with those behaviors. The system is analyzed for its ability to pin-point the cause of changes in end-to-end delay.

Persistent triangulations

Triangulations of a surface are of fundamental importance in computational geometry, computer graphics, and engineering and scientific simulations. Triangulations are ordinarily represented as mutable graph structures for which both adding and traversing edges take constant time per operation. These representations of triangulations make it difficult to support persistence, including ‘multiple futures’, the ability to use a data structure in several unrelated ways in a given computation; ‘time travel’, the ability to move freely among versions of a data structure; or parallel computation, the ability to operate concurrently on a data structure without interference. We present a purely functional interface and representation of triangulated surfaces, and more generally of simplicial complexes in higher dimensions. In addition to being persistent in the strongest sense, the interface more closely matches the mathematical definition of triangulations (simplicial complexes) than do interfaces based on mutable representations. The representation, however, comes at the cost of requiring O(lg n) time for traversing or adding triangles (simplices), where n is the number of triangles in the surface. We show both analytically and experimentally that for certain important cases, this extra cost does not seriously affect end-to-end running time. Analytically, we present a new randomized algorithm for 3-dimensional Convex Hull based on our representations for which the running time matches the Ω(n lg n) lower-bound for the problem. This is achieved by using only O(n) traversals of the surface. Experimentally, we present results for both an implementation of the 3-dimensional Convex Hull and for a terrain modeling algorithm, which demonstrate that, although there is some cost to persistence, it seems to be a small constant factor.

Vulnerability Response Decision Assistance

Each year, thousands of new software vulnerabilities are reported, and affected organizations must analyze them and decide how to respond. Many organizations employ ad hoc systems of decision making, which often result in inconsistent decisions that do not properly reflect the concerns of the organization at large. VRDA (Vulnerability Response Decision Assistance) allows organizations to leverage the analysis effort at other organizations and to structure decision-making. VRDA enables organizations to spend less time analyzing vulnerabilities in which they are not interested, to make decisions more consistently, and to structure their decision making to better align with the goals of the organization. VRDA consists of a data exchange format, a decision making model, a decision model creation technique, and a tool embodying these concepts. One response team is employing a basic form of VRDA to cut the number of vulnerabilities analyzed by a factor of two. Another response team is developing and testing a VRDA implementation within their organization.