Inference of network properties from active and passive measurements on wired/wireless networks: A modeling approach

• Main Author: Wei, Wei
• Language: ENG
• Published: ScholarWorks@UMass Amherst 2006
• Subjects: Computer science
• Online Access: https://scholarworks.umass.edu/dissertations/AAI3242338

In this thesis, we propose several inference techniques to discover network properties for wired and wireless networks from active and passive measurements. These techniques are used to identify the existence of a dominant congested link, classify the access network type of an end host, and determine the fraction of wireless traffic in a large network. We first propose a model-based approach that uses periodic end-end probes to identify whether a "dominant congested link" exists along an end-end path. We provide a formal yet intuitive definition of dominant congested link and present two simple hypothesis tests to identify whether such a link exists. We then present and examine several novel model-based approaches for identifying a dominant congested link that are based on interpreting probe loss as an unobserved (virtual) delay. We develop parameter inference algorithms for Hidden Markov Models (HMMs) and Markov models with a hidden dimension to infer this virtual delay. We further estimate the maximum queuing delay of the dominant congested link, once we identify that a dominant congested link exists. We next propose a simple and efficient end-end scheme to classify an access network one of three categories: Ethernet, wireless LAN and low-bandwidth connection. Our scheme leverages off of intrinsic characteristics of the various access networks and utilizes the median and entropy of packet pair interarrival times. Extensive experiments show that our scheme obtains accurate classification results within 2 seconds. Last, we propose a classification scheme to differentiate Ethernet and WLAN TCP flows based on measurements collected passively at the edge of a large network. This classifier computes the fraction of wireless TCP flows, and the degree of belief that a TCP flow traverses a WLAN inside the network. The core of this classifier is an iterative Bayesian inference algorithm developed to obtain the maximum likelihood estimate (MLE) of these quantities. We apply the classifier to various traces collected at the edge of the UMass campus network and infer that 11-14% of all TCP flows coming into UMass campus traverse a 802.11 wireless link within the campus. We also detect wireless usage (through the use of private routers and access points) in areas not covered by the official wireless infrastructure.