This paper describes the architecture and implementation of Windmill, a passive network protocol performance measurement tool. Windmill enables experimenters to measure a broad range of protocol performance metrics by both reconstructing application-level network protocols and exposing the underlying protocol layers' events. Windmill is split into three functional components: a dynamically compiled Windmill Protocol Filter (WPF), a set of abstract protocol modules, and an extensible experiment engine. To demonstrate Windmill's utility, the results from several experiments are presented. The first set of experiments suggests a possible cause for the correlation between Internet routing instability and network utilization. The second set of experiments highlights: Windmill's ability to act as a driver for a complementary active Internet measurement apparatus, its ability to perform online data reduction, and the nonintrusive measurement of a closed system. Protocol performance, passive measurement, online analysis, packet filter The Internet has grown significantly, and shows little sign of stopping. Understanding the interaction among the many Internet protocols is a key challenge necessary for its rational growth. As a real-world system, with economic incentives for uptime and robustness increasing, it is difficult to take portions of the network down for measurement and testing. Moreover, the rate of growth for the Internet has placed a severe tax on the network infrastructure, leaving many resources such as routers and highly trafficed Web servers in a state of constant overload. Compounding the problem, is that most of the software executing the protocols is shrinkwrapped and is not amenable to scrutiny or modification for performance measurement -a backbone router collapses within seconds with full debugging turned on. It is precisely at these points where the performance effects of protocol interaction are the greatest, and most poorly understood. This paper presents an architecture for an extensible software probe that can measure precisely these types of interactions under real-world conditions. The software probe described in this work utilizes passive techniques for eavesdropping on target protocols. Groups of these point probes can be distributed throughout a target network to measure an aggregate performance profile of target protocols. Care has been taken during the probe's design to enable its placement in high bandwidth monitoring points. This allows the measurement of Internet protocols across a spectrum of vantage points, from routing exchange points and enterprise gateways to local area networks. There are many research groups involved in the deployment of Internet probe machines for the measurement of Internet paths and topologies, including the NIMI [25], Surveyor [1], and IPMA [12] projects. These projects have approached Internet measurement by utilizing active performance metrics [24] -measurements that perturb the network, such as one-way loss along a datagram stream, or periodic traceroutes between the probe and specific end-hosts. Our work complements these efforts, in that we have designed and implemented the architecture of a passive performance probe that can be used in conjunction with active probes (possibly housed on the same host) to measure and infer performance data from the underlying network flows without perturbing the network or infrastructure. Unlike most tools that focus on capturing data for post analysis, Windmill was designed to support 24x7 -24 hours, 7 days a week, around the clock -passive measurements at key network vantage points. The architecture allows application-level protocol data (such as BGP, HTTP, DNS, etc.) to be distilled at the measurement point for either on-line analysis or further post analysis. Our tool allows for their measurement without modifying either the Internet infrastructure (the routers, nameservers, Web caches, end hosts, etc.) or host implementation of these protocols. Windmill's architecture supports the passive performance measurement of application-level protocols through the use of protocol reconstruction and abstraction-breaching protocol event monitoring. A probe experiment infers the end-host's view of a target protocol by recursively executing the lower protocol layers against the stream of incoming
Windmill REF is an extensible network probe environment which allows loading of "experiments" on the probe, with the purpose of analyzing protocol performance.
An Extensible Probe Architecture for Network Protocol Performance Measurement
Softw. Pract. Exp.
Softw. Pract. Exp.
Computer Science