Subject: [Imrg] welcome & administravia

From: Mark Allman <[email-masked]>
Date: Thu, 05 Sep 2002 22:37:51 -0400

Hello everyone!

I wanted to drop out a note with some RG administravia now that some
time has past since the RG announcement went out and the
subscription requests have slowed.

The charter for the RG is available from the RG's web page:

    http://imrg.grc.nasa.gov/imrg/

The charter is quite broad and pretty much anything related to
Internet measurement is fair game in this forum -- especially the
mailing list.  The only things I ask for the list are:

  + We stick to measurement topics.
  + Use pointers rather than attachments.  In fact, the mailing list
    is configured to hold "big" messages for approval (which I will
    not give).  If you do not have a place to drop something send me
    a note and I can drop it in the RG's web space.  
  + Conference/workshop announcements are fine as long as they
    relate (e.g., don't tell us about the conference on parallel
    simulation techniques or some such). 

I would really like to see announcements on the mailing list of new
papers, tools, techniques, etc.  I think it would be quite lovely if
folks were to throw half-baked, preliminary stuff on the list to let
the community help in the polishing process.

As stated in the charter the group is open to anyone.  However, we
have allowed for the possibility that we could conduct some work in
a closed fashion if that will foster progress on some particular
work item.  So, there could be closed design teams formed.  Or, we
could end up with closed meetings about some specific topic.  The
hope in doing work in a closed fashion will be to make more rapid
progress than could happen in a larger group.  Any closed function
will have a requirement to report back to the larger group
periodically.  I understand that this all could get dicey and could
be easily mismanaged and so I invite folks in advance to feel free
to yell my way if you think something bogus is happening or you are
being excluded from something that you should be included in.

My first request...  I would like to use the IMRG web page to track
papers, tools, conferences, etc. (or, at least have pointers to
other pages that have already compiled some of these things).  I
have added some (pretty much blank) outlines.  What I would really
love is a volunteer to act as the keeper of this information for the
RG, acting as the point in collecting information and updating some
HTML/bibtex/whatever.  If nobody is interested I can attempt to keep
up.  If you're interested please send me a private note.  And, if
you have input for these pages, please get it ready but don't send
it until we figure out who is going to carry this particular ball.

Finally, I'll note that this is an open RG and that means it is
**your** RG.  I just didn't get out of the way fast enough when Vern
was looking for a referee.  I want your input about the topics the
RG should be focused on.  I will likely try to kick-start some
discussion (especially to begin with), but would rather see
discussion and topics come from the group, not from the chair (for
one, I am lazy!).  So, please participate on the list, share your
work with us and let me know what you think.  I look forward to a
productive group!

allman

--
Mark Allman -- NASA GRC/BBN -- http://roland.grc.nasa.gov/~mallman/

_______________________________________________
IMRG mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/imrg

---

From: Constantinos <[email-masked]>
Date: Tue, 10 Sep 2002 18:38:40 -0400 (EDT)

Hi all,

first, crudos to Mark and everyone else that worked
on setting up this group!

Here is some food for thought and discussion..
Scott Shenker, at the last Sigcomm, talked about
the importance of focusing networking research on some
Transformative Community Projects (TCPs). The idea
is definitely appealing, at least in its principle.
Some recent TCPs include work on sensor networks,
p2p distribution, overlays etc. I think that a good
question for us is: which are the major
(or upcoming) TCPs in the area of network
measurements?

In fact, as I write these lines I realize that perhaps
things in the measurements area are gradually
becoming less and less of "community projects".
Specifically, a large number of measurement-related
questions can only be answered with traces from
the real Internet (even academic/research networks
such as the Abilene may not be representative).
Such traces however are available only to and from
a couple of tier-1 providers. How will be able to
build a measurements community when the "raw material"
of our work (i.e., traces) is only available to a
few research labs?

Any ideas/thoughts/suggestions?

Constantinos Dovrolis
-- 
Assistant Professor | Networking and Telecommunications Group
College of Computing | Georgia Institute of Technology
[email-masked] | 404-385-4205 | 218 GCATT
http://www.cc.gatech.edu/fac/Constantinos.Dovrolis/

---

From: Ratul Mahajan <[email-masked]>
Date: Tue, 10 Sep 2002 16:23:41 -0700 (PDT)

> How will be able to build a measurements community when the "raw
> material" of our work (i.e., traces) is only available to a few research
> labs?

you sound rather pessimistic in your outlook and restrictive in your
methodology ;)

a lot of cool stuff (not everything, i agree) can be done from the
sidelines (as you demonstrated in your sigcomm talk), and that is actually
part of the fun and challenge in measurement work.

cheers,
	-- ratul

---

From: "Henk Uijterwaal (RIPE-NCC)" <[email-masked]>
Date: Wed, 11 Sep 2002 16:40:52 +0200 (CEST)

> part of the fun and challenge in measurement work.

I'd think that part of the work of this group should be to set up a
repository for raw data.

Henk

> > Any ideas/thoughts/suggestions?

------------------------------------------------------------------------------
Henk Uijterwaal                    Email: [email-masked]
RIPE Network Coordination Centre     WWW: http://www.ripe.net/home/henk
Singel 258                         Phone: +31.20.5354414
1016 AB Amsterdam                    Fax: +31.20.5354445
The Netherlands                   Mobile: +31.6.55861746
------------------------------------------------------------------------------

That problem that we weren't having yesterday, is it better? (Big ISP NOC)

NOTE: My email address (and a hole in our mailing list software) is being
      abused by a spammer.  We are working on fixing this hole and tracking
      the spammer down.  If you receive mail from "[email-masked]" that is
      obviously spam, please send me a copy of the mail including ALL headers.
      I'm sorry for any inconvenience caused by this.

---

From: Constantinos <[email-masked]>
Date: Wed, 11 Sep 2002 13:48:27 -0400 (EDT)

So, I want to clarify something about the message
that I sent yesterday..

My goal was not to criticize research labs (such as
Sprint Labs, ATT-research, or occasionally a few others)
for not publishing their traces. Of course there
are many hard legal and practical issues that
prevent them from doing so, and I doubt that this
situation can easily change. Additionally, these
labs have accommodated academic research in the past providing
us with limited access to traces under certain constraints.

What I was trying to ask is: how can we ("we" meaning
people that don't have access to commercial networks
or routers) create a publicly available database
of traces (of various kinds) that is to be used strictly
for networking research? Such a database has been
offered for several years by NLANR-MOAT (and we
should all be grateful to those folks), but it mostly
includes university access links. Traces from the
Abilene would be possible, I suppose, but it is
questionable whether the Abilene carries
traffic that is representative for the rest of the Internet.

One possible solution of course, would be to change
Abilene's role.. instead of just interconnecting
schools and research centers, to provide transit
service to its current customers for *all* their
traffic, including "commercial" traffic. That would
give us a modern backbone (Abilene) that carries real
traffic, that has routing peering sessions with many other
carriers, but at the same time that is funded
to support and promote research.

Of course.. this is all wishful thinking..

Constantinos Dovrolis

---

From: Christophe Diot <[email-masked]>
Date: Wed, 11 Sep 2002 11:34:50 -0700

> us with limited access to traces under certain constraints.

getting data, even working for an ISP, is not easy. and
it was the first step. the next step is to make data
publically available. This will take time but we're heading
in that direction. If you compare to 4 years ago, the situation
as significantly improved. It is just not an easy process.

But you can believe me: we do the best we can, sometime
being on the edge of what our corporation allows us to do.

---

From: Petri Helenius <[email-masked]>
Date: Wed, 11 Sep 2002 21:53:07 +0300

> to support and promote research.

Talking of "commercial". Anybody know if academic or commercial
networks carry higher percentage of p2p traffic? Seems to dominate
traffic patterns on networks where private individuals represent
majority of users. 

Pete

---

From: Joerg Micheel <[email-masked]>
Date: Thu, 12 Sep 2002 09:37:01 +1200

> traffic that is representative for the rest of the Internet.

One way to go about this problem is to proof (or disproof) that
Abilene is in fact similiar in nature to any other (commercial)
network. Then work with the traces you've got, rather than
hiding behind excuses that noone has any good data (when there
is plenty of it). Or calibrate commercial results against the
research data, which is what Sprint has been doing in a number
of papers.

My position is that Internet2 is a "valid" IP network like any
other. There are differences between measurement points,
topologically, OC3c vs OC12c vs OC48c ... but also many
commonalities, such as the triurnal distribution of packet
sizes.

Challenge that.

I am sure CAIDA will be happy to allow researchers to carry
out such calibration work, they have a good storage of "real"
data, but much smaller, with limited accessability.

I have doubts that commercial networks will allow to let us
publish packet header traces in anonymous fashion on an
ongoing basis. There are many reasons to it, some of them
probably sufficiently strong.

	Joerg
-- 
Joerg B. Micheel			Email: <[email-masked]>
NLANR MNA at SDSC/UCSD			Page:  <[email-masked]>
The University of Waikato, CompScience	Phone: +64 7 8384794
Private Bag 3105			Fax:   +64 7 8585095
Hamilton, New Zealand			Plan:  PMA, TINE and the DAG's
_______________________________________________
IMRG mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/imrg

---

From: William Caban-Babilonia <[email-masked]>
Date: 11 Sep 2002 18:57:52 -0400

> traffic patterns on networks where private individuals represent

Well, I don't have "the" answer to that question but something I've been
seen related to p2p traffic on I2 institutions is:
->traffic to a p2p node, even with no change on its advertised content,
tend to increase dramatically over time, more peers use it as the "next
hop" peer
->p2p traffic tend to be 24/7 present on dorms, computer labs and IT
offices compared to any other places in campuses where its during work
hours (offices turn off their computers at the end of the day? don't
know).

With this in mind, and knowing that a dorm can easily have a 10Mb+ and
ITs divisions have their own rules with 100Mb+ or more of possible
dedicated bandwidth, having p2p on these environment running 24/7 and
knowing that the traffic increase over time, if this is compared with
the home user that have from 56K to 700K at most places and it does not
tend to have their computers connected 24/7 I will say that the higher
percentage of p2p traffic might be on the educational world.

But, I don't know how this will compare with ISPs or carrier
environments. Did they have this more controlled over their employees
and/or IT staff? The commercial ISPs IT staff I have been related to
have p2p running 24/7 as well but they are only few people and their
bandwidth is very limited (few T1s) compared to educational institutions
with DS3+. I don't have any information regarding this on carriers.

--William

---

From: Mark Allman <[email-masked]>
Date: Wed, 11 Sep 2002 23:24:45 -0400

> My goal was not to criticize research labs (such as Sprint Labs,
> ATT-research, or occasionally a few others) for not publishing
> their traces. Of course there are many hard legal and practical
> issues that prevent them from doing so, and I doubt that this
> situation can easily change. Additionally, these labs have
> accommodated academic research in the past providing us with
> limited access to traces under certain constraints.

There is a bit in the charter of this group that I want to
highlight.  (And, this bit was suggested by someone else -- and, if
I could remember who I'd give them credit.)

Certainly I think we can all now see that there is significant
interest in publically available measurement data.  The trick, in my
opinion, is to get the database(s) right.  See our paper for our
thoughts.

But, there is a class of data that will likely *never* be released
through such a system.  For this sensative data it would be useful
to invent some sort of mechanism whereby a researcher could ask for
some analysis to be done on the data (by the owner of the data).
So, for instance, rather than allocating disk space on an FTP server
to dish out measurments ISP foo could allocate a machine to crunch
their data for other researchers -- being careful in what
information is returned.  Of course, we can do this today (I have
done this on occasion on data that I do not have permission to
publically release) by asking some researcher to run some python
script on some tcpdump files.  But, the question for the group is:
Can we automate or mostly automate the process?  And, then can we
design a system for crunching (taking into account all the resources
issues, etc.)?  Or, is such a system just NP-hard?

allman

---

From: adg <[email-masked]>
Date: Thu, 12 Sep 2002 15:24:59 +0200

On Wed, Sep 11, 2002 at 11:24:45PM -0400, Mark Allman wrote:

Hi,

> some analysis to be done on the data (by the owner of the data).

[snip]

> Can we automate or mostly automate the process?  

yes, we can automate it.

we may design an Authenticated protocol for Data Analysis Management 
(ADAM).  researchers can use it to ask another party to analyze its
own data on the behalf of the requester. the protocol should let
the client to reference the remote data to be processed, the kind of 
analysis that should be applied to the data (choosing from a set of
algorithms, implemented by the remote data-crunching-system), etc.

the automatization can be achieved by carefully modeling the remote
authorization architecture.  what follows is just one proposal based 
on "provisional authorizations" [1]; from the abstract of the first
reference:

    "given (almost) any logic L, we may define a provisional authorization
     specification language pASL_l. pASL_l is based on the declarative,
     polynomially evaluable authorization specification language ASL 
     proposed by Jajodia et al. - cfr. [2,3]. We define programs in pASL_l,
     and specify how given any access request, we must find a \"weakest\"
     precondition under which the access can be granted..."

so, a system security officer (SSO) can use a logical language (that 
we may choose) for provision specification.

the ADAM interface performs authentication, verifying if the user is who 
she is claims to be. 

if the verification succeed, the data processing request is passed on to
a provision evaluation module (PEM), an order specification module (OCM)
and a provision verification module (PVM).

        Access                          Authorization
        Request +---------------------+   Request                   Response
                |                     |            +---------------+
Client  ------> | +----------------+  |----------->| Authorization |--------->
                | | Authentication |  |            |  Processor    |
                | |    Processor   |  |            +---------------+
                | +----------------+  |                    ^
                |          |          |                    |
                | +----------------+  |                    |
                | | Role Checker   |  |                    |
                | +----------------+  |                    |
                +---------------------+                    |
                                                           |
                                                           |
                           +-------------------------------+
                           |
                          \ /                             +-----------------+
                      +-----------------------------+     |                 |
            +---+     |     Provision-based         |     | Authorization   | 
System      | G |     | Authorization Program       |     |  Information    |
Security    | U |     |                             |     |                 | 
Officer -->| I |<--->| +-----+   +-----+   +-----+ |<--->| +---------+     |
(SSO)       +---+     | | PEM |-->| OSM |-->| PVM | |     | | Object  |     |
                      | +-----+   +-----+   +-----+ |     | | Subject |     |
                      +-----------------------------+     | |  Role   |     |
                                                          | | Action  |     |
                                                          | +---------+     |
                                                          |                 |
                                                          +-----------------+

alternative approaches exist...

references:

[1] Sushil Jajodia, Michiharu Kudo, V.S. Subrahmanian,
    "Provisional Authorizations", In A. Ghosh, editor, 
    Recent Advances in Secure and Private E-Commerce. 
    Kluwer Academic Publishers, Boston, 2001. 

[2] S. Jajodia, P. Samarati, and V. S. Subrahmanian. 
    "A logical language for expressing authorizations",
    In Proc. IEEE Symp. on Security and Privacy, pages 31-42,
    Oakland, CA, May 1997.

[3] Jajodia, P. Samarati, V. S. Subrahmanian, and E. Bertino, 
    "A unified framework for enforcing multiple access control policies",
    In Proc. ACM SIGMOD Int'l. Conf. on Management of Data, pages 474-485, 
    Tucson, AZ, May 1997. 

> allman

ciao, alfonso