Network Tomography Using Passive End-to-End Measurements

Network tomography refers to the inference of characteristics of internal links in a network using end-to-end measurements. The link characteristics of interest include packet loss rate, delay, and bandwidth; here we focus on loss rate. Depending only on end-to-end measurements is convenient in the context of the Internet because network operators such as ISPs offer limited visibility into the internal functioning of their networks. Besides being an interesting problem in its own right, network tomography can help identify bottlenecks and trouble spots (e.g., points of congestion) within the network. This information can help diagnose network problems and, in the long run, drive network provisioning decisions for ISPs and network connectivity and server placement decisions for their customers such as Web site operators. Previous work on inferring link loss rate using end-to-end measurements has largely been based on active probing techniques. MINC [1] bases its inference on losses experienced by multicast probe packets injected into the network while [2] does so using closely-spaced unicast probe packets striped across multiple destinations. In contrast, our goal is to infer link loss rates based on passively observing the end-to-end loss rate for existing traffic such as that between a Web server and its clients. A passive approach has the advantage that there is no wasteful traffic and the measurements do not perturb the network. However, the disadvantage is that we have less control over the measurement process. Unlike active techniques that are able to identify and localize individual loss events, our passive approach has to make do with aggregate statistics such as the loss rate. While accuracy may suffer, we believe a passive approach is still advantageous if we can infer where the trouble spots (e.g., highly lossy links) are in the network. While being basically passive, our approach has a small active component to discover the network topology using traceroute measurements. However, these measurements only need to be made relatively infrequently and can be done in the background.