5 Application of Network Tomography in LANs

5.1 The Applicability of the Delay Model

The notions of the delay model provide useful instruments to conduct a link-level delay distribution inference in a network. The measurements can be obtained by adopting one of the techniques described in the Section 4 such as Ping, Traceroute or Pathchar. The choice of the delay model and the reliability of the measurements are to be decided ointly. !nly in this case it is possible to obtain optimal result from the estimations. "ctually, it is necessary to know how high is the gap, if it e#ist, between the theoretical instruments provided by the delay model and their applicability. The aim of this section is to reduce this gap and allow the simplest solutions to obtain reliable results. The present section describes in details the procedure to calculate the estimate of the link delay distribution. $t provides, in particular, a general process to compute the iterative analyses of the steady probability distribution described in the Section %. The reliability of the results can be tested only by implementing the inference model to a network. "n application in a &"' is the easiest way to proof the theoretical forecast, and to test a large scale theory such as $nternet Tomography to a small network. Successively it is mentioned the choice of Ping to obtain the measurements. "lthough, some changes of Ping(s program, are also described to provide reliable measurement to the inference model. The applicability of a model covers a delicate aspect of an inference model. $t is not always possible to test an inference model with simple solutions. )ased on the analysis of link delay estimation by &o Presti in a &"', this can be possible and the aim of this *hapter is to provide its process of work.

5.2 Modeling Delay

&et T+,-,&. be a logical tree . - represents the set of vertices, with the source /, the receivers 0 and the branch point of phys. The packets pair is sent down along the tree

1manuele !rlando

from the root. &et us denote for each node k a random variable Dk taking values in the positive real line R+ { } . Dk is the random delay that a packet could spend to traverse the link , f ,k ., k . L . D/ represents the delay on the root and by convention Dk +/. Dk + indicates a dropped packet along the link. The key hypothesis is that the independence of the measured delays along each link can be assumed. 2or this reason Dk are assumed to be independent. $t is possible to define the cumulative delay e#perienced along a path from the root to the node k, like the sum of each random variable Dk along the path, Xk = Dj .
j k

"ccording to the discreti3ation by &o Presti described in the Section %, each link delay is discreti3ed to a set 4+5/,q,6q,7,iq,)q,8, where q is the width bin, )9: is the number of possible bin, and represents the event of packet lost. The probability distribution of Dk is denoted by k e#pressed in the 1quation %.4 in the Section %, and is the set of distribution for each link k - e#pressed in the 1quation %.; in the Section %. " measurement is the one way delay from the root to the end receivers represented by the set 0,k.. The set of children of a generic node is denoted by d, .. &et us define X R = , X k . kR as the one way delay occurred on the way from the source to the receivers belonging to the set 0,k.. X R is also discreti3ed to the set 4. 2igure %.< in the Section %, depicts the space of X R , in which R +4#4. The 1quation %.:= in the Section % shows > k ,d . . ?sing the 1@ algorithm to ma#imi3e the likelihood function the way to obtain > k ,d . , with k- is L, X , DA . in the 1quation %.:B, the ma#imum likelihood estimate of

> k ,d . =

dQ

> ,d . nk ,d . n = k n nk ,d .

,;.:.

>k ,d . . Cnowing n >k ,d . for each d4, the &et us focus now on the computation of n probability distribution along the k-th link k ,d . can be obtained. $n the 1quation %.6< in the Section %, let us call the measurement xij depending on i, simply xR . This is the case, in which 0,k. is composed of two end receivers. $f there are more subsets of two end receivers of 0,k., it is necessary to introduce a summitry with i, inde#es. >k ,d . is quite complicated. The second step of 1@ algorithmDB,6=,6EF The computation of n >k ,d . can be computed. shows how n

;/

; "pplication of 'etwork Tomography in &"'s

>k ,d . = P n
m=:

DD > ,l . k

= d G X R = xmR F

xRR

D D = d G X R = xR F n, xR .P > ,l . k P ,l . D X R = xR G Dk = d F ,l . > > k ,d . n , x . R P , l . D X R = xR F xRR

>

=
,;.6.

>k ,id . for each iq4 can be calculated in the 1quation Having the link k fi#ed, the count n ;.6. The iterative algorithm is e#pressed by the distribution k computed at the step l . &et us focus the attention on each of the components of the 1quation ;.6. Computation of n,# 0 . xR is a 6 # n vector. n represents the number of packets pairs sent to the end receivers of the set 0. 1ach line of xR belongs to a finite space defined by R +4#4. n, xR . represents the number of times the same discreti3ed measurement is present in the vector xR . Computation of P > ,l . D X R = xR F and P > ,l . D X R = xR G Dk = d F This is the most comple# aspect of the computation. &et 0,k. the set of receivers descendent from the node k-. $f k0, there will be assumed 0,k.+5k8. &et us define YR , k . = ,Y j . jR , k . as the delay observed from receivers descendent from node k. &et Z R , k . = YR , k . Y f , k . be the delay measured from node f,k. down to the of three vertices, 2igure ;.: shows the
num , R , k .. receivers of k. &et us denote k , z R , k . A . = P .$f , D Z R , k . = z R , k . F , k-, z R , k .

for e#ample , the tree is composed corresponding z R , k . for a node k.

;:

1manuele !rlando

The k , z R , k . A . respects the following recursion

k , zR , k . A . = k , zR , k . . k , z R , k . A . = k ,d . j , z R , j . d A .
dQ jd , k .

k0 k0

,;.%. ,;.4.

$n the 1quation ;.4 z R , k . = , z R , j . . jd , k . .

0 f(k)

R(k)

2igure ;.:I 2or each k it is possible to calculate z R , k . . 2rom the total YR , k . delay from the root till the set 0,k. the Y f , k . is subtracted. D X R = xR F . $n fact, it is sufficient to There are the necessary instruments to calculate P > ,l . observe that YR = Z R ,:. , where : denotes the child node of the root node /. The 1quation ;.; shows that the delays observed at the receivers are equal to the delay e#perienced from the root down to the receivers of :, which represent the set 0.

Z R,:. = YR,:. Y f ,:. = YR,:. Y/ = YR

D X R = xR F as $t is possible then to define the computation of P > ,l .

,;.;.

;6

; "pplication of 'etwork Tomography in &"'s

P
,;.<.

> ,l .

> ,l . . = :, yR A > ,l . . D X R = xR F = :, zR,:. A

D X R = xR G Dk = d F can be obtained in a similar way, even if it is The computation of P > ,l . D X R = xR F , because the probability in this case is calculated by more complicated than P > ,l . conditioning to each possible value of d4 and for each measurement xR . The approach to compute this probability is the following I

> ,l .

D X R = xR G Dk = d F = P

> k ,d , l .

D X R = xR F

,;.B.

l. >, > ,l . ,d J. = : when d+d( and where the distribution > ,l . by setting k ,d is obtained from

> ,l . ,d J. = / otherwise. This process will be e#plained better in the ne#t section where it is described the practical application and the computation of these probabilities. $t is possible D X R = xR G Dk = d F asI to define the computation P > ,l .

P
,;.=.

DX R > ,l .

= xR G Dk = d F = P

> k ,d

,l .

l. >, D X R = xR F = :, yR A k ,d .

'ow all the probabilities in the 1quation ;.6 are computed. $t is vital to understand that >k ,d . must be calculated the 1quation ;.6 works, when a branch node k is chosen. Then n for each d. The computation of the 1quation ;.B is rather difficult, because it depends not only on the measurement but also on the current d. The implicit difficulty is that in order to calculate each probability, it is necessary to know the current distribution of the other link, which belongs to the path. $t must be calculated for each link, and this increases the computational burden of the inference algorithm. The 1quation ;.6 shows the recursion of > k ,l . ,d . represents the probability delay distribution of link k, the equation, where calculated in d and in the previous step. The choice of the initial distribution is vital if a fast convergence is required. $t is described in D<F. $t $f the tree is of small dimension, an arbitrary initial distribution can be chosen for each link. The convergence is verified by the consistence property of the algorithm D:%F. The only parameter which can vary is the number of necessary iterations to reach the steady solution of the distributions, that is the local ma#imum of the &ikelihood 2unction.

5.

!se"do #ode

;%

1manuele !rlando

The pseudo code to compute the link delay distribution will be described in the present section. $t is composed of the above mentioned 1@ algorithm. The variable l represents the current step. The variable threshold represents the parameter which allows the algorithm to know if the ma#imum is reached. $n fact, by comparing the current inferred estimate with the previous one, the difference between them, can be defined. This value is e#pressed by the variable threshold. $f the threshold is low, more iterations are necessary. The threshold defines the surface of the multidimensional ma#imum point. The ma#imum will be a point with a null surface, only if there is infinite equality of each component of the current estimate to each component of the previous one. $n this case the threshold is represented by the value 3ero. $n the practical application it is advisable to use a large threshold and then to decrease it until the computational burden will become too heavy and the number of the iterations be too high. ?sually, a threshold of one percent is sufficient. $f the tree has few nodes, it is possible to decrement the threshold. The problem can be contained in the appro#imation processes of the compiling program. The pseudo code implemented by 2rancesco &o Presti D6EF is depicted in the 2igure ;.6 . procedure main 5 l+/ A choose > ,l . A do 5 K computation of the e#pected counts for each kfor each d4

>k ,d . + / A n

for each xR R
l. >, compute L ,:, y , k ,d . > ,l . R >k ,d . 9 + n, xR . n ,d . > ,l . . k compute L ,:, y , R

end end end

Kcomputation of the current estimates for each kfor each d4

> k ,l +:. ,d . =
end end l 99A

>k , d . n A n

;4

; "pplication of 'etwork Tomography in &"'s

8 while G > ,l . > ,l :. G M threshold A 8 double function compute_ k! z! " 5 if ,k 0. >k , z. A return else return 8 2igure ;.6I The pseudo code.
dQ

> = > ,l . A

k ,d . compute L , j, zR, j . d , .A
jd , k .

5.$ Application to the %o"ter Lab LAN

The goal of the present work is to apply 'etwork Tomography on a &"'. 'etwork Tomography is usually referred to $nternet Tomography because it focuses on a large scale network. The aim of this work is to test a delay probability distribution inference in a small scale network. "pplying the mentioned algorithm to a &"', the theory to an accessible and bordered network can be used. "ll the e#periments have be conducted in the 0outer &ab of the Nepartment of Nistributed System of the ?niversity of Ouer3burg ,Permany.. The physical network, to which the analysis of probability distribution delay is applied, is depicted in the 2igure ;.%
Latona
19.8.9.200

Ull

Hera

Zeus

Selene
Cat 2912 XL

19.10.10.10

19.10.10.254

19.8.240.1 19.8.9.100

Venus

Fast Ethernet IEEE 802.3u (100MBits/s) Ethernet V.21 eria! !ink (2MBits/s)

;;

1manuele !rlando

2igure ;.%I The physical tree is composed by the root ?ll and the end receivers &atona and -enus.

The host ?ll represents the root or the source. &atona and -enus are the end receivers. n packet pairs are sent from ?ll to &atona and -enus. 2igure ;.% shows the physical tree. "pplying the @odel Tree described in the Section %.6 , it is possible to make a graph of the logical tree shown in the 2igure ;.4. 1ach link is labeled with a number. The branch node 6 is k, and the node : is its parents f,k.. 0,k., the set of end receivers that will receive the packet pairs sent from the root, are nodes % and 4. 2igure ;.; shows the tree, to which the &o Presti algorithm will be applied. The algorithm works on the link separated by a branch node. $n this case the branch node is the number 6. The goal is to estimate the delay distribution for the links 6, % and 4.
Latona Ull Hera Zeus

4
R(k)

0
R""t

1
f(k)

2
k

3
Venus

2igure ;.4. &ogical tree. Nenote the node k, its parent f,k. and the set of receivers 0,k..

" packet pair is sent from root to host % and 4. The first member of the packet pair will reach the host 4 and the second member the host %. 2igure ;.< shows how the two members of the packet pair travel in the network. The inference strategy works on the common path

4 0 2 3

;<

; "pplication of 'etwork Tomography in &"'s

2igure ;.;I The logical tree is composed of three links. The goal is to estimate the probability delay distribution 6 , % and 4 .

the packet pairs crosses. $n fact, the algorithm cannot distinguish between the different links from root until node number 6, and considers the global link from the root to the host number 6. The branch nodes play a very important role in defining, which link can be analy3ed by the algorithm. The key sentence is that the inference strategy works on the common path of the packet pairs. The measurement represents the one way delay from the

4 0
2 1 #"$$"n %ath

2 3

2igure ;.<I The first member travels with direction of the node 4, and the second member to node %.

root to the set 0,6.. However, it is not necessary to work with this kind of measurement. $n the Section 4 it is shown that to obtain this measurements is not an easy task and a synchroni3ation between two hosts is required.

;B

1manuele !rlando

2igure ;.BI The red line show the one way direction, the black, show the coming back. $t is easy to note the same shared path between the two directions.

2igure ;.B helps to understand how the problem can be solved by means of applying the 0TT measurement. The first and second members cover the same path to go and to come back. 2or e#ample, the first member is directed to the end host 4, makes the trip /, 6,4 and comes back covering the same path, 4, 6 ,/. There is no difference between the application of the inference to the one way measurement and the 0TT, because the member makes the same way. $t is a specific case for this application, when there is the certainty that the packet member travels along the same path. This simplification makes the 0TT calculation preferable to calculating the one way delay. This computation can be made more easily applying one of the tools mentioned in the Section 4.

5.5 The #hoice of !ing

$n the Section 4 some tools to measure the 0TT of the packets pair along a path have been described. Ping, Traceroute and Pathchar are equivalent in the 0TT computation where the ambient to measure is a small area network, such as &"'. The path is relatively short and the computation of the 0TT is easy to conduct and its precision is reliable enough. The goal is to choose one of these three programs. The aim of the present work is to offer an inference instrument able to operate in all the &"'s. To obtain a universal instrument, it is preferable to focus on the most simple solutions. $n this case, Ping represents this simplest choice. Ping is an administrator(s tool that all hosts should implement. $t does not have any restrictions to work. Ping is a common tool and is really easy in use. Traceroute and Pathchar are focused on other specific goals apart from 0TT, such as the record of the routes, latency and bandwidth estimate. This information is not the sub ect of interest to the inference algorithm this work is devised to implement. )esides, Traceroute and Pathchar depend more heavily on the operative system of the machine in which they run. Ping, on the contrary, is a more transparent tool. $n a &"', the 0TT of Ping is reliable, because the path to test is short and is composed of few routers. The precision of the measurement is linked to the dimension of the bin si3e of the &o Presti algorithm. $n fact, why should be a higher degree of precision of the measurement required, if it will be eliminated during the discreti3ation processQ This e#ample shows, why measurements and inference strategies should be chosen ointly.

;=

; "pplication of 'etwork Tomography in &"'s

The 2igure 4.6 in the Section 4 shows an application of Ping. $t works simply by typing the destination host to ping and the number and the dimension of the packet to send D%/F. The goal is to obtain the 0TT for a packet pair described in the Section %. Two $*@P packets should be sent consequently to the respective end host destinations as 2igure ;.= e#plains. The 2igure %.6 in the Section % shows the trip of a packet pair along the path. The Ping program iputils-6//6/E6B is able to ping one host at a time. $t must ping two hosts at the same time. " first packet should be sent to the address of the first end node, and the second packet should be sent immediately after the first one to the address of the second node. The 2igure ;.= shows this request.

"ur#e I(M) "ur#e

2 1
t

&''ress 2 &''ress 1

&''ress 1

&''ress 2

2igure ;.=I Two $*@P packet should be sent in the time t: and t6 to the address : and 6.

$t is vital to define the processing gap P# =G t: t6 G as the current time between the first and the second $*@P. The inference strategy requires a P# / that is the second $*@P leaves immediately after the living of the first. )oth packets should travel one after another and come back in the same order to the source. "n P# / allows the packets to test the same state of the traffic network and is essential for the reliability of the measurement. The algorithm works on the common path the two packets cover. The second $*@P tests the congestion of the first one. This permits the second packet to be behind the first one with a high probability. This operation should be implemented by Ping. &et us focus the attention on the Ping iputils and its processing gap. Ping iputils allows to ping one host at a time and listen to the $*@P 1cho 0eply coming back. !nly after the answer is received, another $*@P 1cho 0equest is sent. This is a serious problem, because the Ping iputils allows to work only with one end host. There is not the possibility to initiali3e a sequence of two $*@P sending process to two different end hosts.

;E

1manuele !rlando

E#h" Re+1

E#h" Re%1E#h" Re+2

E#h" Re%2

,ar-et h"st 1

1 2

,ar-et h"st 2

2igure ;.EI The normal operation of Ping iputils. The second packet can be sent only after the source has received the answer of the first one.

The implementation shown in 2igure ;.= must be reached by modifying the original program. Ping iputils is able to implement the operation shown in the 2igure ;.E. The source sends the first packet and then, only after the 1cho 0eply is received, Ping sends another packet to the second host. This operation is rather difficult. $n practice, to change the address of the first end host in the address of the second end host means to initiali3e another Ping process. The 2igure ;.E shows how large is the processing gap. This cannot be a reliable measurement and it cannot be applied to the inference strategy. $t is necessary hence to modify the Ping iputils in a program able to work like the pseudo code depicted in the 2igure ;.:/. This pseudo code shows how the new modified Ping works. The icmp_se$ represents an inde# which will play an important role in the modified Ping. n represents the number of the packets pairs to send. The result of the measurements is a n # 6 vector xR . The original Ping program is replaced with the modified Ping program. for icmpLseq+: to n send Packet :,icmpLseq. to host : send Packet 6,icmpLseq. to host 6 print timestamp Packet :returned ,icmpLseq. from host : print timestamp Packet 6returned ,icmpLseq. from host 6 end 2igure ;.:/I The pseudo code represents the functioning of the modified Ping program.

Modified Ping The original Ping is the version iputils-6//6/E6B, written by @ike @uuss, ?.S. "rmy )allistic 0esearch &aboratory, in Necember :E=%.

</

; "pplication of 'etwork Tomography in &"'s

The most important modifications conducted in the process of the present work areI :. Nuplicating the buffers, the structures and the necessary variables to describe an $*@P packet. The task of a second buffer is to allocate the packet direct to the second host. 6. Nuplicating the necessary variable to count the $*@P packet sent. %. "dding a control to be able to specify in the command line the second host which has to be pinged. 4. "dding a code responsible to traduce the hostname string in the format network-byteordered. ;. @aking a second socket ,icmp_sock%.. <. @odifying the send_pro&e " function, so that it can send two messages by using the sendms' " function, to the two different sockets. !ne socket is for the end host : and the second is for the end host 6. B. Nuplicating the checksum " function able to check the right returned second packet. These are the most important steps of an accurate work of modificating. $n fact, each step contains the defining the new variables, descriptors and functions. The modified Ping has been elaborated and tested in the Ouer3burg at 0outer &ab of the % Nepartment of $nformatics,Permany.. 2igure ;.:: shows an application of the modified Ping. "ll the options of the Ping iputils-6//6/E6B are maintainedD%/F. The most interesting options are the following. The option (c responsible for managing the number of packet pairs to send. This quantity is represented by n in the pseudo code in the 2igure ;.:/. The other option is )s responsible to declare the dimension of the $*@P packet to send. The *hapter < describes the results of the inference algorithm obtained by changing the dimension of the packets sent. $t is very important, because the necessary delay to cover a path is proportional to the dimension of the packet and depends on the speed of the path.

<:

1manuele !rlando

)I.* /at"na(19.8.9.200)Venus(19.8.9.100) 051 23te 14 23tes fr"$ 19.10.10.10 t" 19.8.9.200 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.100 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.200 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.100 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.200 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.100 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.200 t" 14 23tes fr"$ 19.10.10.10 t" 19.8.9.200 t" 0 i#$%4se+50 tt!5255 0 i#$%4se+50 tt!5255 0 i#$%4se+51 tt!5255 0 i#$%4se+51 tt!5255 0 i#$%4se+53 tt!5255 0 i#$%4se+53 tt!5255 0 i#$%4se+54 tt!5255 0 i#$%4se+54 tt!5255 ti$e50.298 $s ti$e50.312 $s ti$e50.310 $s ti$e50.332 $s ti$e50.310 $s ti$e50.354 $s ti$e50.313 $s ti$e50.351 $s

2igure ;.::I "n application of the modified Ping program. The end host &atona and -enus are pinged. '+4 and the dimension of the packet is ;< byte.

The icmp_se$ is vital for the right functioning of this new tool of measurement. $t represents the current packet pair sent. $t can check the right order of each member of the packet pair. 2or e#ample, the 2igure ;.:: shows how the right order of the two members is achieved. This is really an important inde#, because it allows to notice if the second member goes past the first during the trip. The icmp_se$ RlabelsS the member of the packet pair, making recogni3able its arrival to the source. "nother advantage is that the icmp_se$ can be used as a pointer in the construction of the vector xR . 1ach line of xR corresponds to a same icmp_se$, and the columns, to the first and second member of the same packet pair. "ll the measurements in this work are obtained by applying the modified Ping.

5.& 'mplementation
This section e#plains how the modeling delay can be applied to the logical tree depicted in the 2igure ;.;. The set of the nodes k is composed of node 6, % and 4. $t is possible to define only a 0,6., because the nodes % and 4 do not have children nodes. That is why the only node satisfying the condition k0 is the node number 6. The 1quations ;.% and ;.4 can be written in the following wayI

% , zR,%. A . = % , zR,%. . 4 , zR,4. A . = 4 , zR,4. .

k+%0

,;.E.

k+40

,;.:/.

<6

; "pplication of 'etwork Tomography in &"'s

6 , zR,6. A . = 6 ,d . 6 , zR,6. d A .
dQ jd ,6.

k+60

,;.::.

2rom the 1quation ;.: it is possible to estimate the value of the delay probability for each value of d4 as

> k ,d . =

>k , d . n n

k+56,%,48

,;.:6.

> k ,/. Choice of initial distributions The logical tree is of a small dimension. The typical initial delay probability >%,/. , and > 6,/. , > 4,/. can be chosen. The most advisable choice is the distribution uniform probability distribution depicted in the 2igure ;.:6. 1ach value d4 at the step 3ero has the same probability.

1/(B61) + 2+ 3+ i+7+/2 B+ i+6+/2 '

i+

2igure ;.:6I 1ach value belonging to the set 4 has the same probability.

The algorithm works iteratively, and the distribution will change until the stationary probability distribution is reached. The algorithm models the distributions, giving more weight to the event of delay with more probability to be verified. The value of delay with a null probability represents a delay that cannot ever be tested on the link. "fter a number of iterations, the algorithm reaches the steady solution and the distributions can be analy3ed.

<%

1manuele !rlando

D X R = xR F Computation of P > ,l . This computation is obtained by using the 1quation ;.< and the recursion of the 1quation ;.::. The 2igure ;.:% shows the graphical procedure of the computation.

> ,/.

D X R = ,6d ,%d .F = 6 ,/.T% ,6d .T 4 ,%d . + 6 ,d .T% ,d .T 4 ,6d . + + 6 ,6d .T% ,/.T 4 ,d .
1/5 0 ' 2' 3' 4' 1/5 2' ' 0 1/5 3' 2' ' 0 d d d

,;.:%.

D X R = xR F 2igure ;.:%I " graphical approach to the computation of P > ,l .

> ,l .

D X R = xR F is calculated for each measurement x , and it does not depend on the value R

d, but only on the specific value of xR . )esides, the computation depends on the step l. 1ach iteration of the algorithm changes the previous distributions, and a new computation of P ,l . D X R = xR F must be calculated with the new distributions.
>

D X R = xR G Dk = d F Computation of P > ,l .
This computation is the most complicated. There is not only the dependence by the measurement, but also by the value of d. This is a conditioned probability, which is

<4

; "pplication of 'etwork Tomography in &"'s

the probability that a measurement assumes the value xR along the path, by conditioning to a measured delay equal to d over the link k of the path. $t is vital then to compute this probability d4 and xR measured. This is the most difficult part of the algorithm, because the comple#ity increases if the bin si3e decreases and ) augments. The computation is obtained by using the same strategy as for the computation of P ,l . D X R = xR F . $t is necessary to compute the new probability distribution > P
> k ,d ,l .

D X R = xR F mentioned in the 1quation ;.B . $t is obtained by setting the distribution

> k ,d J. = : , where d(+d and > k ,d J. = / otherwise. > 6 ,6d . = :

0 ' 2' 3' 4' 1/5 2' ' 0 1/5 3' 2' ' 0

> 6 is set for d(+6d and the P> ,l . D X R = ,6d ,%d . G D6 = 6d F 2igure ;.:4. The can be found. D X R = xR G Dk = 6d F , the distribution 2or e#ample, if the goal is to estimate P > ,l .

> k ,d J = 6d . = : and the 1quation ;.:: can be applied. The 2igure ;.:4 shows the graphical approach to understand the computation. $n this case, given the measurement X R +,6d,%d. the probability P ,l . D X R = ,6d ,%d . G D6 = 6d F is obtained by setting the distribution > 6 ,6d . = : .
>

2igure ;.:4 shows a particular computation for d(+6d, given the measurement xR . $n this case the probability is e#pressed by the 1quation ;.:4.

<;

1manuele !rlando

> ,/.

D X R = ,6d ,%d . G D6 = 6d F = P

> 6,d ,/.

D X R = xR F = % ,/. T 4 ,d .

,;.:4.

D X R = xR F is obtained Ohen all the probabilities are computed d4, the set of P > k ,d ,l . D X R = xR F and and can be used in the 1quation ;.6. )y changing the node k the P >%,d ,/. P
> 4,d ,/.

D X R = xR F are computed.

>k ,d . easy. The pseudo code described above makes the computation of n The simplest example >k ,d . given the one The following is a theoretical e#ample that shows the computation of n way measurement. n+4 , the bin si3e q+/.: ms and )+;. The case of value is omitted. The algorithm is implemented in the @atlab language. Nefine a vector of the measurement as X me*s +D/.:6%,/.6:A/.64,/.6=:A/.:6%,/.6%A/.6B,/.%<BF Choice of the discrete set Q The first step is the discreti3ation to the set 4+5/,/.:,/.6,/.%,/.48 following the procedure e#plained in the 2igure 4.6 the discreti3ed X me*s vector is the vector X R I X R +D:,6A6,%A:,6A%,4F. Choice of the initial probability delay distribution The probability distribution at step l+/ has a uniform shape for each link. The 2igure ;.:; shows the uniform distribution.

<<

; "pplication of 'etwork Tomography in &"'s

1/5 d

0 ' 2' 3' 4'

2igure ;.:;. The initial delay probability distribution is an uniform discrete probability distribution.

D X R = xR F Computation of P > ,l .

D X R = xR F is "pplying the 1quation ;.<, the vector P > ,/.

: 6 X0 = : %

6 % 6 4

/./:</ /./64/ P ,/. D X R = xR F = > /./:</ /./%6/

,;.:;.

D X R = xR G Dk = d F Computation of P > ,l .
D X R = xR G D6 = /F with k+6 isI "ccording to the 1quation ;.B, the vector P > ,/.
: 6 X0 = : %

6
% 6 4

/./4// /./4// P ,/. D X R = xR G D6 = /F = > /./4// /./4//

,;.:<.

>k ,d . Computation of n >6 ,/. can be computedI )y applying the 1quation ;.6, the count n

<B

1manuele !rlando

>6 ,/. = n

P ,/. D X R = xR G D6 = /F ,/. > > 6 ,/. +:.;=%% n , xR . P ,/. D X R = xR F xRX R

>

,;.:B.

>6 ,id . for / U i U ), the vector n >6 ,d . will ?sing the 1quation ;.:< and ;.:B to calculate n be obtained in one step.
:.;=%% :.;=%% >6 , d . = n /.;=%% /.6;// /

,;.:=.

The new delay probability distribution after one step is obtained by applying the 1quation ;.:6. /.%E;= /.%E;= > 6,:. ,d . = /.:4;= /./<6; /

,;.:E.

> 6,/. and > 6,:. shows how in the process of the iteration of the The first comparison of algorithm the distributions trying to reach the steady solution are modeled. >%,:. and "ll the computations are made for the nodes k+%, 4 and the distributions are the followingI > 4,:.

<=

; "pplication of 'etwork Tomography in &"'s

/.%E;= /.%E;= >%,:. = /.:4;= /./<6; / Congruence

/ /.%E;= > 4,:. = /.%E;= /.:4;= /./<6;

,;.6/.

$n a probability distribution the congruence property must be constantly referred to. The congruence means that the summitry of each component of a probability distribution must be unitary. $t is necessary to control each step of the process. Accuracy and number of steps The accuracy is e#pressed by the threshold defined by the pseudo code. The advisable value is of :/e-6. The program works until this threshold is passed. The number of necessary steps to reach the steady solution changes and depends on the choice of the threshold. Results Threshold+ :/e-6 Step+B /.;// /.6;/ > 6,B. = /.6;/ / /

/.//: /.EEE >%,B. = / / /

/ /.//6 > 4,B. = /.EE= / /

,;.6:.

These results represent the steady solution of the delay distribution probability along the links 6,%, and 4. *ertainly, it is a really simplified e#ample, and the shape of the distributions is readable enough. 'e#t *hapter shows some e#periments on a large time interval with a high number of bin. $n this case the number of necessary iterations increases. The 2igures ;.:< ,;.:B and ;.:= show the probability delay distributions obtained by @atlab.

<E

1manuele !rlando

Delay Probability Distribution - Link 2

0.5
0.5

Probability a2(d)

0.4

0.3

0.25

0.25

0.2

0.1

0 -0.5

0.5

1.5

2.5

3.5

Delay d (ms)

2igure ;.:<I Nelay Probability Nistribution along link 6.

Delay Probability Distribution - Link 3

1 0.9

0.8

0.7

Probability a3(d)

0.6

0.5

0.4

0.3

0.2

0.1

0 -0.5

0.5

1.5

2.5

3.5

4.5

Delay d (ms)

2igure ;.:BI Nelay Probability Nistribution along link 6.

B/

; "pplication of 'etwork Tomography in &"'s

Delay Probability Distribution - Link 4

1 0.9

0.8

0.7

Probability a4(d)

0.6

0.5

0.4

0.3

0.2

0.1

0 -0.5

0.5

1.5

2.5

3.5

4.5

Delay d (ms)

2igure ;.:=I Nelay Probability Nistribution along link 6

B: