material thu 2 mar wg meeting fyi forwarded ravi thuraisingham enron communications 02 29 00 01 15 pm nevil ipn caida org 02 28 00 10 35 pm metrics caida org cc bcc ravi thuraisingham enron communications subject material thu 2 mar wg meeting hello appended find summary ideas people contributed since caida began get metrics wg started material already appeared metrics mailing list older material comes personal emails posting give us ideas think able attend wg meeting san jose thursday 2 mar like spend time morning getting know attendees interests experience making internet measurements suggest good way would group give short 10 minutes response times gets even interesting need able see traffic one direction client server get fairly accurate round trip time client server irrespective far away client measurement host tcps three way handshake connection establishment see opening syn wait client ack server syn ack client server round trip time think actually already done could also potentially try correlate dns queries tcp connections perhaps determining probabilities given environment host initiating tcp connection host received record track various application level response times personally love lot data ratio dns response time tcp transfer time http connections even measurement makes attempt discern constitutes web transaction user full page usually many tcp connections anyway think fairly interesting things measure simple techniques simple ones may interesting things could digging payloads highly utilized applications tcp nightmare perfomance wise basic infrastructure things dns udp probably cover open udp protocol without incurring performance penalties would make completely unusable snmp example application limited network service providers would find round trip time information snmp packets network management stations agents useful think rudimentary things tcp well also think sites would interested rudimentary information example weighted traffic round trip time distribution tcp traffic networks communicated say 24 granularity gives sites notion close talk frequently little work could probably make reasonable bandwidth estimates every end network see tcp data could certainly get reasonable number maximum observed bandwidth methods also decouple measurement traffic know value think significant active probers run host decoupled actual measurement timestamps coming kernel space bpf thinking long time eventually like skitter tools able use tcp packets probing need things like ip firewall code properly time non blocking connects count passive tool see syn syn ack use tcp port round trip time measurements trick kernel sending tcp packets raw socket need feedback passive tool tracing like skitter needs know reply seen hop destination reached difficult simple bytestream oriented ipc sufficient going like idea proposed others maybe funded point tracking instrumenting freenix tcp ip stacks lot useful information could pulled stack eventually someone going come pieces information desirable enough someone want stack instrumented somewhere currently implemented full blown metering system like rtfm think interim lot things could using libpcap local machines non promiscuous user space safe easy implement test benefits user likely tangible well understood relationship workstation understood particularly true us network expertise least plausible find correlations measurements user experience fairly short period time helping us hone useful even find weak correlations whatever reason correlation exists people interested helping development something use personally essentially guaranteed see traffic directions personally interested trying find small sets information correlate user experiences take terabyte disk 64 processors deal data say 10 000 desktops anyway random thoughts hard part moment thinking useful generalizations infrastructure support cindy bickerstaff responded starting capture mss window size negotiations timeit servers get idea typical usual wonder daniel code could various traffic monitoring points caida data could used fill parameters trying model passive data collected since typical web page many elements single client server first base page gives starting idea expect subsequent elements like repeat measurements path short time interval since strong time day week effect volumes perf short duration data collection single web page incl elements might give options modeling maybe getting better estimate packet loss really enjoyed joining e 2 e interest group ideas factors references past modeling attempts e g mathis et al paper ack bulk transfer focus paul krumviede highlighted difficulty agreeing details measure common metrics like availability reliability throughput latency example throughput since proposed measured using tcp file transfer random data one concern latency get measured many customers service would large businesses measuring customer end 56 64 kbps circuit almost certain drive end end latency measurements beyond defined bounds measuring within points provider network might show figures customers could never see compromise define throughput metric ocurring access link loads 50 bit rate one measure given discussion recognized prelude imposition minimal slas part certification process service providers may illustration perils discussing slas metrics interchangable form may easy separate minds carter bullard said specifically interested bridging rtfm ippm work particularly describe rtfm generic connectivity monitor ippm describes type p unidirection bidirectional connectivity single point rtfm detect conditions standard descriptions done would useful personally one things interested tcp based streaming services performance seen internet radio distribution course ip telephony wireline performance metrics would good describe nevil brownlee comments also interested developing rtfm meter platform general measurements two areas seem interesting apart getting information tcp streams qos difserv performance metrics need characterise ipsec metrics still useful look port numbers kinds traffic still identified curtis villamizar said particularly interested work dos http www cs washington edu homes savage traceback html would like see agenda would provide general way determining packets came tool tracing dos attacks