Today's Int ernet is a massive, dist([/#][ net work which cont inuest o explode in size as ecommerce andrelatH actH]M/# grow. Thehet([H(/#]H( and largelyunregulatS stregula of t/ Int/HH3 renderstnde such as dynamicroutc/[ opt2]3fl/ service provision, service level verificatflH( and det(2][/ of anomalous/malicious behaviorext/[(22 challenging. The problem is compounded bytS fact tct onecannot rely ont[ cooperatH2 of individual servers and routSS t aid intS collect[3 of net workt/[S measurement vits fort/]3 t/]3] In many ways, net workmonit]/#[ and inference problems bear a st[fl[ resemblancet otnc "inverse problems" in which key aspect of asystfl are not direct/ observable. Familiar signal processing orst[]23/#[S problems such ast omographic imagereconst[/#[S] and phylogenet# tog identn/HH2[M have int erest3/ connect[HU t tonn arising in net working. This artflMM int/ ducesnet workt/H3]S]/ y, a new field which we believe will benefit greatU from tm wealt of stH2](/#S( ttH2 andalgorit#S( It focuses especially on recent development s int2 field includingtl applicat[fl of pseudolikelihoodmetfl ds andt reeestfl3](/# formulat]M23 Keyw ords:Net workt/HflS33/ y, pseudo-likelihood,t opology identn/]H22(/ tn est/]H tst 1 Introducti6 Nonet work is an island, ent/S ofitS[S] everynet work is a piece of an int/]SS work, a part of t/ main . Alt[]][ administHSHSS of small-scale net works can monit( localt ra#ccondit][/ and ident ify congest/# point s and performance botU((2/ ks, very few net works are complet/# # Rui Castroan Robert Nowak are with theDepartmen t of Electricalan ComputerEnterX Rice Unc ersity,Houston TX; Mark Coates is with the Departmen t of Electricalan ComputerEnterX McGill UnG ersity,Mon treal, Quebec,Can Gan Lian an Bin Yu are with theDepartmen t of Statistics,...

The modeling and analysis of computer communications networks give rise to a variety of interesting statistical problems. This paper focuses on network tomography, a term used to characterize two classes of large-scale inverse problems. The first deals with passive tomography where aggregate data are collected at the individual router/node level and the goal is to recover path-level information. The main problem of interest here is the estimation of the origin-destination traffic matrix. The second, referred to as active tomography, deals with reconstructing link-level information from end-to-end path-level measurements obtained by actively probing the network. The primary application in this case is estimation of quality-of-service parameters such as loss rates and delay distributions. The paper provides a review of the statistical issues and developments in network tomography with an emphasis on active tomography. An application to Internet telephony is used to illustrate the results.

Abstract—Network tomography is an appealing method for active measurement of link level characteristics such as delay and loss on end-to-end paths. Most network tomography techniques developed to date are based on one-way measurements requiring collaboration from both sending and receiving hosts which severely limits the scope of the paths over which these techniques can be used. We extend our previous work on Network Radar, a new tomographic inference method based on round trip time (RTT) measurements from TCP SYN/SYN-ACK packets. In this paper, our contributions are three-folded. (1) We extend our analytic framework for estimating delay variance on the shared network segment using Network Radar to include confidence estimates which enable measurement accuracy to be assessed- an important consideration for practical deployment. (2) We evaluate Network Radar in a series of experiments conducted in a controlled laboratory environment. These tests explore the boundaries of effectiveness of our RTT-based method, and show that it works well over a wide range of traffic conditions. (3) We evaluate Network Radar in a series of tests conducted in the wide area Internet. These tests show that RTT-based delay variance estimates can be used effectively to identify most likely network topology- a natural and verifyable application for RTT tomography. The performance results in this paper demonstrate that Network Radar can now be used for both research and operational purposes. I.

Inferring the routing topology and link performance from a node to a set of other nodes is an important component in network monitoring and application design. In this paper we propose a general framework for designing topology inference algorithms based on additive metrics. The framework can flexibly fuse information from multiple measurements to achieve better estimation accuracy. We develop computationally efficient (polynomial-time) topology inference algorithms based on the framework. We prove that the probability of correct topology inference of our algorithms converges to one exponentially fast in the number of probing packets. In particular, for applications where nodes may join or leave frequently such as overlay network construction, application-layer multicast, peer-to-peer file sharing/streaming, we propose a novel sequential topology inference algorithm which significantly reduces the probing overhead and can efficiently handle node dynamics. We demonstrate the effectiveness of the proposed inference algorithms via Internet experiments.

Abstract — Information about the topology and link-level characteristics of a network is critical for many applications including network diagnostics and management. However, this information is not always directly accessible; subnetworks may not cooperate in releasing information and widespread local measurement can be prohibitively expensive. Network tomographic techniques obviate the need for network cooperation, but the majority assume probing from a single source, which imposes scalability limitations because sampling traffic is concentrated on network links close to the source. We describe a multiple source, end-toend sampling architecture that uses coordinated transmission of carefully engineered multi-packet probes to jointly infer logical topology and estimate link-level performance characteristics. We commence by demonstrating that the general multiple source, multiple destination tomography problem can be formally reduced to the two source, two destination case, allowing the immediate generalization of any sampling techniques developed for the simpler, smaller scenario. We then describe a method for testing whether links are shared in the topologies perceived by individual sources, and describe how to fuse the measurements in the shared case to generate more accurate estimates of the link-level performance statistics. Index Terms — Internet tomography, end-to-end measurements, active probing, topology discovery, loss rate estimation.

In this paper we address the problem of topology discovery in unicast logical tree networks using endto-end measurements. Without any cooperation from the internal routers, topology estimation can be formulated as hierarchical clustering of the leaf nodes based on pair-wise correlations as similarity metrics. We investigate three types of similarity metrics: queueing delay measured by sandwich probes, delay variance measured by packet pairs, and loss rate measured also by packet pairs. Unlike previous work which first assumes the network topology is a binary tree and then tries to generalize to a non-binary tree, we provide a framework which directly deals with general logical tree topologies. Based on our proposed finite mixture model for the set of similarity measurements we develop a penalized hierarchical topology likelihood that leads to a natural clustering of the leaf nodes level by level. A hierarchical algorithm to estimate the topology is developed in a similar manner by finding the best partitions of the leaf nodes. Our simulations show that the algorithm is more robust than binary-tree based methods. The three types of similarity metrics are also evaluated under various network load conditions using ns-2. 1

Abstract—In this paper, we address the problem of topology discovery in unicast logical tree networks using end-to-end measurements. Without any cooperation from the internal routers, topology estimation can be formulated as hierarchical clustering of the leaf nodes based on pairwise correlations as similarity metrics. Unlike previous work that first assumes the network topology is a binary tree and then tries to generalize to a nonbinary tree, we provide a framework that directly deals with general logical tree topologies. A hierarchical algorithm to estimate the topology is developed in a recursive manner by finding the best partitions of the leaf nodes level by level. Our simulations show that the algorithm is more robust than binary-tree based methods. Index Terms—Graph-based clustering, mixture models, network tomography, topology estimation. I.

Assessing and monitoring the performance of computer and communications networks is an important problem for network engineers. There has been a considerable amount of work on tools and techniques for data collection, modeling, and analysis within the network research community. The goal of this paper is to present an overview of the engineering problems and statistical issues, describe recent research developments, and summarize ongoing work and areas for further research. While there are many interesting issues related to network analysis, our focus here is on estimating and monitoring network Quality-of-Service parameters. We discuss methods for estimating edgelevel parameters from end-to-end path-level measurements, an important engineering problem that raises interesting statistical modeling issues. Other topics include network monitoring, network visualization, and discovering network topology. Data from a corporate network are used to illustrate the problems and techniques. As in any overview paper, the discussion is likely to be slanted towards our own research interests.

In network topology discovery, it is often necessary to collect measurements between network elements without injecting large amounts of traffic into the network. A possible solution to this problem is to actively query the network for some measurements and use these to infer the remaining ones. We frame this as a particular version of the Noisy Matrix Completion problem where the entries reflect path-level measurements (distances) between network elements, and we study a variant of the Landmark MDS algorithm proposed in [9] and [16]. This algorithm finds an Euclidean embedding of the network elements that preserves distances, given that we observe all pairwise distances between a small set of landmark nodes and only few distances between the landmarks and the remaining nodes (end hosts). We give a theoretical analysis of Landmark MDS, specifically showing that without noise, the algorithm perfectly recovers all pairwise distances, and bounding the reconstruction error in the presence of noise. 1

Abstract—Accurate and timely identification of the routerlevel topology of the Internet is one of the major unresolved problems in Internet research. Topology recovery via tomographic inference is potentially an attractive complement to standard methods that use TTL-limited probes. In this paper, we describe new techniques that aim toward the practical use of tomographic inference for accurate router-level topology measurement. Specifically, prior tomographic techniques have required an infeasible number of probes for accurate, large scale topology recovery. We introduce a Depth-First Search (DFS) Ordering algorithm that clusters end host probe targets based on shared infrastructure, and enables the logical tree topology of the network to be recovered accurately and efficiently. We evaluate the capabilities of our DFS Ordering topology recovery algorithm in simulation and find that our method uses 94 % fewer probes than exhaustive methods and 50 % fewer than the current state-of-the-art. We also present results from a case study in the live Internet where we show that DFS Ordering can recover the logical router-level topology more accurately and with fewer probes than prior techniques. I.