Zugl.: Bremen, Univ., Diss., 2006

Zugl.: Bremen, Universiẗat, Diss., 2006.

The goal with this thesis work has been to identify what a telecommunications company should monitor and to find a network monitoring system that can monitor these identified objects on two different platforms: Windows and Linux. The network monitoring system has been implemented in a telecommunications company’s environment and this thesis presents how the system monitors their environment. The subject for this thesis work is within network monitoring. The problem formulation has been answered by conducting a literature study and by testing network monitoring systems’ features in a lab environment. The sources used in the literature study consists of scientific articles and other articles found on the web. The lab environment consisted of virtual machines that runs Linux or Windows as an operating system.   The purpose of the work was to enlighten Cellip in what objects they should monitor and to help the company to monitor them by implementing a network monitoring system. Cellip is a telecommunications company that provides IP-telephony services through Session Initiation Protocol. The limits of this thesis work are based on what their environment supports in terms of monitoring. Cellip’s environment consists of Linux and Windows servers, Cisco switches and firewalls, and Sonus Session Border Controllers.   In summary, the result of this thesis gives the reader information about what a telecommunications company with a similar environment to Cellip should monitor, what three systems that can monitor these objects, which of the three systems that has most automatized features and finally how the chosen system Datadog monitors and presents the objects. Some of the objects that are important to monitor is: memory, disk storage, latency, packet loss. In conclusion, this thesis presents a monitoring baseline for telecommunication companies with a similar environment to Cellip.

ITC/USA 2012 Conference Proceedings / The Forty-Eighth Annual International Telemetering Conference and Technical Exhibition / October 22-25, 2012 / Town and Country Resort & Convention Center, San Diego, California / The iNET program uses network technology and infrastructure to enhance traditional telemetry systems. The program's components were designed with an eye to existing and emerging technology and infrastructure, requiring the program to gather data about these systems. The methods used in this design effort can be used to characterize existing network infrastructure to determine what upgrades and changes are necessary to deploy a TmNS. This paper describes the methods used for characterizing a range network infrastructure and explores network capacity and policy issues effecting a TmNS deployment. This effort includes making estimates and taking measurements of network capacity, surveying and analyzing network routing/management policies, and proposes a system for evaluating networks for future TmNS deployments.

No description available.

The success of the internet over last few decades has mainly depended on various infrastructure technologies to run distributed applications. Due to diversification and multi-provider nature of the internet, radical architectural improvements which require mutual agreement between infrastructure providers have become highly impractical. This escalating resistance towards the further growth has created a rising demand for new approaches to address this challenge. Network virtualization is regarded as a prominent solution to surmount these limitations. It decouples the conventional Internet service provider’s role into infrastructure provider (InP) and service provider (SP) and introduce a third player known as virtual network Provider (VNP) which creates virtual networks (VNs). Resource discovery aims to assist the VNP in selecting the best InP that has the best matching resources for a particular VN request. In the current literature, resource discovery focuses mainly on static attributes of network resources highlighting the fact that utilization on dynamic attributes imposes significant overhead on the network itself. In this thesis we propose a resource discovery approach that is capable of utilizing the dynamic resource attributes to enhance the resource discovery and increase the overall efficiency of VN creation. We realize that recourse discovery techniques should be fast and cost efficient, enough to not to impose any significant load. Hence our proposed scheme calculates aggregation values of the dynamic attributes of the substrate resources. By comparing aggregation values to VN requirements, a set of potential InPs is selected. The potential InPs satisfy basic VN embedding requirements. Moreover, we propose further enhancements to the dynamic attribute monitoring process using a vector based aggregation approach.

The success of the internet over last few decades has mainly depended on various infrastructure technologies to run distributed applications. Due to diversification and multi-provider nature of the internet, radical architectural improvements which require mutual agreement between infrastructure providers have become highly impractical. This escalating resistance towards the further growth has created a rising demand for new approaches to address this challenge. Network virtualization is regarded as a prominent solution to surmount these limitations. It decouples the conventional Internet service provider’s role into infrastructure provider (InP) and service provider (SP) and introduce a third player known as virtual network Provider (VNP) which creates virtual networks (VNs). Resource discovery aims to assist the VNP in selecting the best InP that has the best matching resources for a particular VN request. In the current literature, resource discovery focuses mainly on static attributes of network resources highlighting the fact that utilization on dynamic attributes imposes significant overhead on the network itself. In this thesis we propose a resource discovery approach that is capable of utilizing the dynamic resource attributes to enhance the resource discovery and increase the overall efficiency of VN creation. We realize that recourse discovery techniques should be fast and cost efficient, enough to not to impose any significant load. Hence our proposed scheme calculates aggregation values of the dynamic attributes of the substrate resources. By comparing aggregation values to VN requirements, a set of potential InPs is selected. The potential InPs satisfy basic VN embedding requirements. Moreover, we propose further enhancements to the dynamic attribute monitoring process using a vector based aggregation approach.

Monitoring and mining real-time network data streams are crucial operations for managing and operating data networks. The information that network operators desire to extract from the network traffic is of different size, granularity and accuracy depending on the measurement task (e.g., relevant data for capacity planning and intrusion detection are very different). To satisfy these different demands, a new class of monitoring systems is emerging to handle multiple and arbitrary monitoring applications. Such systems must inevitably cope with the effects of continuous overload situations due to the large volumes, high data rates and bursty nature of the network traffic. These overload situations can severely compromise the accuracy and effectiveness of monitoring systems, when their results are most valuable to network operators. In this thesis, we propose a technique called load shedding as an effective and low-cost alternative to over-provisioning in network monitoring systems. It allows these systems to handle efficiently overload situations in the presence of multiple, arbitrary and competing monitoring applications. We present the design and evaluation of a predictive load shedding scheme that can shed excess load in front of extreme traffic conditions and maintain the accuracy of the monitoring applications within bounds defined by end users, while assuring a fair allocation of computing resources to non-cooperative applications. The main novelty of our scheme is that it considers monitoring applications as black boxes, with arbitrary (and highly variable) input traffic and processing cost. Without any explicit knowledge of the application internals, the proposed scheme extracts a set of features from the traffic streams to build an on-line prediction model of the resource requirements of each monitoring application, which is used to anticipate overload situations and control the overall resource usage by sampling the input packet streams. This way, the monitoring system preserves a high degree of flexibility, increasing the range of applications and network scenarios where it can be used. Since not all monitoring applications are robust against sampling, we then extend our load shedding scheme to support custom load shedding methods defined by end users, in order to provide a generic solution for arbitrary monitoring applications. Our scheme allows the monitoring system to safely delegate the task of shedding excess load to the applications and still guarantee fairness of service with non-cooperative users. We implemented our load shedding scheme in an existing network monitoring system and deployed it in a research ISP network. We present experimental evidence of the performance and robustness of our system with several concurrent monitoring applications during long-lived executions and using real-world traffic traces.

There seems to be more security events happening on the network nowadays, so the administrators have to be able to find the malicious activities in progress as soon as possible in order to launch effective and efficient countermeasures. The Network administrators need to monitor the networks through collecting real time traffic measurement data on their networks, but they might find that the data gathered seems to be too little or too much detail. SNMP-based tools traditionally adopted most often give too little. However, packet sniffing tools investigate too much, so that the performance is sacrificed, especially on a large network with heavy traffic. Flows are defined as a series of packets traveling between the two communicating end hosts. Flow profiling functionality is built into most networking devices today, which efficiently provide the information required to record network and application resource utilization. Flow strikes a balance between detail and summary. NetFlow is the de facto standard in flow profiling. We introduce¡A describe¡Aand investigate its features, advantages, and strengths. Many useful flow-related tools are freely available on the Internet. A mechanism is proposed to make use of the flow logs to monitor the network effectively and efficiently. Through verification, it is believed that using flow logs can benefit the network administrator so much. The administrators can use them for timely monitoring, DoS and worm propagation detection, forensics et al.

Monitoring is an important activity in daily local area network maintance routine. To be able to run the network efficiently and without incidents that run into problems, networks must be monitored. This way it is possible to detect and remove serious problems at early stages. Various techniques are employed, including monitoring and checking users actions, data traffic, active running processes, open ports and system log analysis. This thesis describes a method for engineering and implementing local area networks software and using it for field data analysis. In the process of writing this thesis such sample of software was created and aimed at the processes and event logs of Kaunas University of Technology Software Engineering Department. In the conclusion methods and ways that will help solve current problems were suggested. Most alarming thing to notice was constant port scans and illegal attempts to log into the system without permission.