The cost and complexity of deploying measurement infrastructure in the Internet for the purpose of analyzing its structure and behavior is considerable. Basic questions about the utility of increasing the number of measurements and measurement sites have not yet been addressed which has led to a "more is better" approach to wide-area measurement studies. In this paper, we step toward a more quantifiable understanding of the marginal utility of performing wide-area measurements in the context of Internet topology discovery. We characterize the observable topology in terms of nodes, links, node degree distribution, and distribution of end-to-end flows using statistical and information-theoretic techniques. We classify nodes discovered on the routes between a set of 8 sources and 1277 destinations to differentiate nodes which make up the so called "backbone" from those which border the backbone and those on links between the border nodes and destination nodes. This process includes reducing nodes that advertise multiple interfaces to single IP addresses. We show that the utility of adding sources beyond the second source quickly diminishes from the perspective of interface, node, link and node degree discovery. We also show that the utility of adding destinations is constant for interfaces, nodes, links and node degree indicating that it is more important to add destinations than sources. Keywords-Network measurement, traceroute, topology discovery, Internet tomography An emerging strategy to gain insight into the conditions and configuration inside the Internet is the use of end-toend measurements from a set of distributed measurement points. A design goal of the Internet has been to emphasize This work was partially supported by NSF research grants CCR-9706685 and ANIR9986397. The data used in this research was collected as part of CAIDA's skitter initiative, http://www.caida.org. Support for skitter is provided by DARPA, NSF, and CAIDA membership. P. Barford is with the University of Wisconsin, Madison. A. Bestavros, J. Byers and M. Crovella are with the Computer Science Department at Boston University. E-mail: pb@cs.wisc.edu, {best,byers,crovella)@cs.bu.edu . simplicity in its internal components; for this reason, measurements made at network endpoints are especially attractive. An example of this approach is the use of traceroute [17] for the discovery of network connectivity and routing. While traceroute is remarkably flexible and informative, it is an open question how useful traceroute is for uncovering topological information about the Internet. In this paper we study the use of traceroute as a tool for Internet topology discovery. We consider the common case, in which active measurement sites (traceroute sources) are relatively scarce, while passive measurement sites (traceroute targets) are plentiful. In such experiments, each traceroute source is able to discover a directed graph, induced by IP routing, from itself to all of the destinations. ' We are interested in the properties of the graph that is formed by the union of these individual views. In order to find the union of these views it is necessary to identify routers that advertise multiple interfaces, and to associate each advertised interface with a router. Our first contribution is to discuss our experiences in solving this problem and assess the importance of this issue when merging multiple traceroutes into a single graph. Our main contribution is to show how studying this graph helps clarify how end-to-end paths pass through the Internet. A principal observation is that the marginal utility of adding additional active measurement sites declines rapidly after the second or third site. This motivates a rough model for the routing graph discovered by traceroute as a richly-connected "switching core" fed by ingress and egress paths ("feeders"). Our work indicates that the core consists of a relatively small fraction of nodes and we show that almost all paths in our data pass through this core. If the source-destination pairs in our data are representative of typical endpoint pairs for IP flows, then the switching core is common to most end-to-end paths taken in the Internet. Thus the properties of the core are especially 'We make the simplifying assumption that IP routing paths are stable over the timeframe of individual traceroute executions; while this assumption is sometimes incorrect, it frees us to focus on a different set of questions. Note that this assumption does not imply that the resulting directed graph from a source is a tree. 5
Barford et al. study the relationship between the measurement accuracy and the number of traceroute sources in topology inference REF .
On the marginal utility of network topology measurements
IMW '01
Computer Science Materials Science