NGI Project Quarterly Report 1Oct200 - 31Dec2000

RECIPIENT'S PROGRESS STATUS AND MANAGEMENT REPORT

Predictability and Security of High Performance Networks

For the period 01 October 2000 to 31 December 2000

Report #10

CDRL A001

CONTRACT N66001-98-2-8922

January 31, 2001

SUBMITTED TO Receiving Officer
SPAWARSYSCEN - SAN DIEGO
e-mail address: spendlov@spawar.navy.mil

Richard Laverty
PHONE 619-553-2918
FAX 619-553-1690
laverty@spawar.navy.mil

Frank Schindler
PHONE 619-553-2845
FAX 619-553-1690
schindl@spawar.navy.mil

SUBMITTED BY
University of California, San Diego (UCSD)
9500 Gilman Drive
La Jolla, CA 92093

Principal Investigator
Dr. Kimberly Claffy
PHONE 858-534-8333
FAX 858-822-0861
kc@caida.org

Contract/Financial Contact
Lynnelle Gehrke
PHONE 858-534-0243
FAX 858-534-0280
lgehrke@ucsd.edu

Quarterly Status Report

Predictability and Security of High Performance Networks

For the period 01 October 2000 to 31 December 2000
Contract N66001-98-2-8922
CDRL A001

1.0 Purpose of Report

This status report is the quarterly cooperative agreement report (CDRL A001) which summarizes the effort expended by the UCSD's Cooperative Association for Internet Data Analysis (CAIDA) program in support of SPAWARSYSCEN-SAN DIEGO and DARPA on Agreement N66001-96-2-8922.

2.0 Project Members

UCSD hours:
Dr. kc Claffy:	172
David Moore:	274
Other CAIDA Staff:	2625
University of Waikato hours:	32
Total Hours:	3103

3.0 Project Description

UCSD/CAIDA is focusing on advancing the capacity to monitor, depict, and predict traffic behavior on current and advanced networks, through developing and deploying tools to better engineer and operate networks and to identify traffic anomalies in real time. CAIDA will concentrate efforts in the development of tools to automate the discovery and visualization of Internet topology and peering relationships, monitor and analyze Internet traffic behavior on high speed links, detect and control resource use (security), and provide for storage and analysis of data collected in aforementioned efforts.

4.0 Performance Against Plan

CAIDA was granted a one year no cost extension to continue work on this award, which expands the official end date to July 15, 2001. Option 1 of this award was also obligated in April 2000. As a result of the no-cost extension and re-budgeting of the remaining funds, the original Tasks and schedule for completion have been re-defined as follows:

Task 1 still encompasses work on Coral OC48mon, and has expanded to include work on the Gigabit Ethernet Monitor. Both of these projects are scheduled for completion on or before July 15, 2001. We are working with Narus Inc. to port CoralReef analysis tools and libraries to their Gigabit Ethernet Analyzer systems.

Option 1, obligated in April 2000, continues to focus on the DNS Root Server Initiative and visualization of massive datasets. It has been expanded to include additional work on the Tomography Task, originally Task 2, and the Storage and Analysis Task, previously Task 4. Work on each element of Option 1 is scheduled for completion on or before July 15, 2001.

Task 3, the original security task, has been completed.

5.0 Major Accomplishments to Date

The following major accomplishments were achieved during Year 3, Quarter 2:

-We deployed an additional skitter monitor host at the "M" DNS root server location to bring the total up to 24 monitors collecting skitter data.

-We tested four prototype OC48mon boards on live network traffic at CAIDA/SDSC. The cards were also tested at Sprint Labs. Data was successfully collected.

-We are working on a generalized framework for dealing with large graphs. We began design and implementation of library Libsea (tentative name), which provides functionality for loading, saving, examining, and to a certain extent processing large graphs. Work is progressing on a Java implementation, and we also anticipate development of implementations for C/C++ and Perl.

-CAIDA made skitter data publicly available to all interested researchers via a Certificate Authority on the CAIDA web site. So far, we've made data available to researchers at MIT, UCLA, UIUC, Arizona State, Network Solutions, Caimis, University of Washington, University of Arizona, Telcordia, and Boston University. Each researcher signed an Acceptable Use Policy in order to gain access to

the data, and agreed to report results of their research directly to CAIDA. This is the most extensive publicly available resource for real macroscopic Internet topology data, which is vital to network research in the community.

6.0 Artifacts Developed During the Past Quarter

No artifacts were developed this past quarter.

7.0 Issues

7.1 Open issues with no plan, as yet, for resolution

We had considerable difficulty contacting our SPAWAR program manager over the last 5 months and were unable to schedule or conduct our quarterly status and progress meeting.

7.2 Open issues with plan for resolution:

The CAIDA project manager, Amy Blanchard, has left CAIDA. Theresa Boisseau is the new CAIDA project manager for DARPA and will take over these duties. Theresa can be reached at theresa@caida.org, 858-822-0956.

7.3 Issues resolved:

Starting next quarter, DARPA is funding CAIDA through two programs, NGI (Mari Maeda) and NMS (Sri Kumar). Therefore, we will be combining the reports for both projects into one quarterly report.

8.0 Near-term Plan

The material below reflects the activities planned during Year 3, Quarter 3 of this project, January 1, 2001-March 31, 2001. We have organized the information according to the categories identified in the Project Program Plan (see https://www.caida.org/funding/progplan/NGIprogplan98.xml). However, this program plan is a superset of CAIDA’s planned activities, not just DARPA activities.

A.General/Administrative Outreach and Reporting

The following Administrative Outreach and Reporting items are planned for Year 3, Quarter 3

-Submit Quarterly Report to SPAWAR covering progress, status and management

-Submit Quarterly Financial Status Report (UCSD Extramural Funds Dept. submits)

-Submit Quarterly Report of Federal Cash Transactions (UCSD Extramural Funds Dept. submits)

-kc claffy will attend NANOG 21 in Atlanta, Georgia, February 18-20, 2001 ( http://www.nanog.org/mtg-0102/index.html)

-Nevil and Andre will attend IETF 50 in Minneapolis, MN, March 18-23 (http://www.ietf.org/proceedings/01mar/index.html)

-kc claffy will visit various Network Modeling and Simulation researchers including ACIRI, ISI, CalTech, and Berkeley to discuss formats types for data needed by the NMS community. (see kc)

B. Task 1. Coral OC48mon and GigEther Monitor

The following work is planned for Task 1 during Year 3, Quarter 3:

- The University of Waikato DAG development team (http://dag.cs.waikato.ac.nz/), Ian Graham, David Miller, and Joerg Micheel, will deploy the initial prototype cards on OC48 links in Abovenet to test them under operational networking conditions

- Continue to refine the CoralReef requisite software suite (https://www.caida.org/tools/measurement/coralreef/), including the CoralReef

Report Generator tool ( https://www.caida.org/tools/measurement/coralreef/components.xml#HTML), and continue optimizing interoperability with Netramet and Narus software

- Continue discussions of OC48mon development and use with the community

-Develop and deploy a GigEther Monitor at the SD-NAP.

- David Moore will attend PAM (http://www.ripe.net/pam2001/) to present "The architecture of the CoralReef Internet Traffic monitoring software suite", (https://www.caida.org/publications/papers/).

- Developing Coral Apps paper for LISA 2001 (http://www.usenix.org/events/lisa2001/), Moore, D., R. Koga, et al, "The CoralReef software suite as a tool for system and network administrators", (https://www.caida.org/publications/papers/).

F. Option 1/DNS Root Server/Visualization of Massive Datasets/Tomography/Analysis

- Deploy additional skitter hosts at DNS root server locations

- Continue to collect and analyze data collected from skitter sources deployed in the field

- Continue to make skitter topology and performance data available to researchers via Certificate Authority for use in their research and monitor results (https://www.caida.org/tools/measurement/skitter/research.xml).

- Continue briefings to the Internet community on purpose and results of Skitter and solicit their inputs

- Redesign structure and interface of skitter daily summaries to improve quality of interaction (http://sk-summary.caida.org/cgi-bin/main.pl)

- Colleen Shannon will attend PAM to present "Characteristics of fragmented IP traffic on Internet links" ( https://www.caida.org/research/traffic-analysis/fragments/sdscposter.xml).

-Brad Huffaker will attend PAM to present "Macroscopic analyses of the infrastructure: Measurement and visualization of Internet connectivity and performance" (https://www.caida.org/publications/papers/) on Skitter visualization.

-Marina Fomenkov is submitting a paper on Underserved DNS Clients to the ITC conference in Brazil

- Make improvements on the Walrus viewer (https://www.caida.org/tools/visualization/walrus/), including adding ability to load a more complete file format, add filtering and other interactive processing, and add rendering labels and other attributes for nodes and links

9.0 Completed Travel

The following travel occurred during Year 3, Quarter 2:

-kc claffy attended NANOG 20 in Washington DC, October 22-24, 2000, see http://www.nanog.org/mtg-0010/index.html.

-kc claffy, David Moore and Ken Keys traveled to San Francisco on October 30, 2000 to meet with Narus employees to discuss CoralReef interoperability with commercial tools.

-kc claffy, David Moore, Andre Broido attended IETF 49 December 10-15, see http://www.ietf.org/proceedings/00dec/index.html.

-kc claffy visited various Network Modeling and Simulation researchers including ACIRI, ISI, CalTech, and Berkeley to discuss formats types for data needed by the NMS community.

-Nevil Brownlee attended IEPG and presented a paper on root server availability https://www.caida.org/workshops/isma/0012/talks/nevil/

-kc claffy and Andre Broido presented "The Internet's 'Core': Top IPs, Prefixes, and Ases" at Compaq SRL and, AT&T labs on https://www.caida.org/workshops/isma/0012/talks/andre/

Other related travel occurred but was not charged to this award.

10.0 Equipment Purchases and Description

CAIDA purchased 8 Compaq 18 gigabyte ultra-scsi disks for the raid array for storage of skitter topology data sets.

11.0 Work Focus

Task 1. Coral OC48 Monitors/GigEther

Coral OC48 Monitor

The prototypes of the Dag4.1 boards were completed in October, and the boards were brought over to CAIDA in San Diego for testing in early November. The team for this testing consisted of Ian Graham, Joerg Micheel and David Miller.

A HP Kayak PC was purchased for testing, this machine has the required 64-bit 66 MHz PCI bus. Development in New Zealand has been on Kayaks, and so it was possible to bring over a complete software setup on disk.

The first Dag board was set up in SDSC on a POS OC48 link between a CISCO GSR 12000 and Juniper M20 router, running in CISCO HDLC mode. Although data rates on this link are not high it was sufficient for the purposes of debugging the firmware of the card. The board was tested successfully, and data was captured at about 22 MBits/sec link load. The system was left at SDSC so that it could be accessed remotely for further development.

In order to test the boards at higher data rates and to debug the time-stamp correction mechanism the team then moved to the Sprint ATL in Burlingame. Here two boards were set up on a POS link from a CISCO router that could take input from an Agilent OC48 router tester.

Measurements on the throughput of the Dag4.1 showed that with a 64-bit 33 MHz interface it could sustain 100 byte packets at full line rate, and 40 byte packets at 80% of full line rate.

The boards were also successfully synchronized to each other, and to a GPS time source.

The two boards were left at Sprint for further testing and development, but will be moved to a CAIDA measurement site in early 2001.

During the rest of November and December development of the Dag4 hardware and firmware design continued. An updated version of the hardware, the Dag4.11 was prototyped with the support of Sprint ATL.

In 2001 it is planned to continue the development of the firmware, especially in the areas of packet filtering, and to make performance enhancements. This design will meet the original performance requirements for an OC48 measurement board. While the team was constructing the prototype boards, they continued to use completed Dag 4.0 and 4.1p boards to develop firmware and software. The main aim in software development will be to integrate the Dag4 with CoralReef.

We now have four working prototype Dag4.1 capture cards that we will test on an OC48 link working with Brett Watson at Abovenet in February.

The Dag4.1 has the following characteristics:

-OC48 SMF optical interface.

-ATM and POS traffic capture

-Conditioned clock with GPS time pulse input for cell/packet timestamping

-1 Mbyte cell/packet FIFO

-Separate FPGA for cell/packet processing, with 2 Mbytes SSRAM

-64-bit 66 MHz PCI interface, standard PCI board form factor

-StrongARM 233 MHz processor with 2 Mbytes SSRAM

-LINUX device driver and applications software.

CoralReef

Final development work for version 3.4.0 (major release) was done on CoralReef this quarter. This version will be released to members in January. We plan to release this to the public later next quarter.

CoralReef is a comprehensive software package from CAIDA for passive monitoring of ATM, POS, and other network interfaces and reading "crl" and pcap tracefiles. It includes FreeBSD drivers for Apptel POINT (OC12 and OC3 ATM) and FORE FATM (OC3 ATM) cards, support for WAND DAG (OC3 and OC12, POS and ATM) cards, programming APIs for C and perl, and software applications for capture, analysis, and reporting of ATM, IP, and TCP/UDP traffic.

Major new features in this release include:

* Support for DAG capture cards and file formats

* Support for POS, CHDLC, PPP (over POS, ATM, or Ethernet),

Bridged ethernet over PPP

* Tcpdump style packet filtering in all CoralReef packet applications

* t2_report++ can graph the top N applications (members only)

* crl_dnsstat - The crl_dnsstat application watches for DNS queries on UDP port 53 and counts numbers of messages and numbers of queries, aggregated by any of source IP, destination IP, opcode, query type, query class. The subjects of queries are never recorded. https://www.caida.org/tools/utilities/dnsstat/

For additional updates and fixes, see https://www.caida.org/tools/measurement/coralreef/doc/doc/CHANGELOG.

DNS Root Server/Visualization of Massive Datasets/Tomography/Analysis

DNS Root Server Initiative

In support of ICANN/RSSAC, CAIDA has co-located skitter monitors on several of the root servers and carries out macroscopic measurements of the root system on behalf of the RSSAC. We analyze these data in pursuit of answers to two questions:

(1) Are the current root server locations optimal or is there unnecessary redundancy that can be eliminated?

(2) Where should ICANN place additional root name servers?

We have developed a methodology for identifying and depicting sets of destinations with high latency from all instrumented root locations, and demonstrated the utility of this methodology if applied at all current and potential future root server locations.

Clusters of hosts that have particularly large latencies from all of the roots indicate a potential deficiency in the current Internet infrastructure. This high latency could be due to the location of the roots relative to the client or due to the local connectivity of the client. In order to identify target hosts that have high latency from the existing set of monitored root servers, we analyzed the daily distributions of RTTs seen by six root server skitter monitors. In each probe cycle we consider destinations whose RTTs are above the 90th percentile of the RTT distribution. We define a destination as having high latency during a given day if on that day if at least half of the probe packets sent from each of the root server monitors to that destination yield RTTs values above the 90th percentile of all RTTs. Typically, RTTs to such destinations are longer than 500 ms, sometimes as high as 1000 ms.

Figure 1.

Figure 1 illustrates the daily and monthly variability of the 90^th percentile values. For skitter monitor co-located with the F-root server, the graph shows the minimum and the maximum value of the 90^th percentile of RTT distributions observed in each day of the data. The graph shows a significant decrease in overall network latency (and hence likely congestion) during the weekends and/or holidays. For more details go to https://www.caida.org/~marina/DNS/.

Further examination with other tools is needed to determine the primary cause of this latency. If we can eliminate sites that have very low bandwidth at the client end of the path, we will have a subset of destinations that can guide the choice of new sites for root servers.

We started collecting data from three new skitter monitors including, "M" in Japan, "A", and the skitter box placed at the University of Oregon. Figure 2 is a list of all of the servers that CAIDA maintains and uses to collect research data. (http://sk-status.caida.org/cgi-bin/main.pl?mode=status)

hostname(ip)	status	org	loc	list
l-root.skitter.caida.org ( 198.32.64.30 )	A	ISI	Marina del Ray, CA, US	DNS Clients
e-root.skitter.caida.org ( 192.203.230.250 )	A	NASA	Ames Moffet Field, CA, US	DNS Clients
k-peer.skitter.caida.org ( 193.0.0.11 )	A	RIPE	Amsterdam, NL	DNS Clients
k-root.skitter.caida.org ( 193.0.14.253 )	A	RIPE	London, UK	DNS Clients
f-root.skitter.caida.org ( 204.152.184.98 )	A	VIX	Palo Alto, CA, US	DNS Clients
a-root.skitter.caida.org ( 216.168.227.250 )	A	Verisign	Herndon, VA, US	DNS Clients
m-root.skitter.caida.org ( 203.178.140.215 )	A	Wide	Tokyo, Japan	DNS Clients

sin.skitter.caida.org ( 192.122.134.235 )	D	SingAREN	Singapore, SG	prefix
iad.skitter.caida.org ( 209.249.118.254 )	D	ABOVE.NET	DC, US	Web
lhr.skitter.caida.org ( 216.200.119.243 )	A	ABOVE.NET	London, GB	IPv4space
nrt.skitter.caida.org ( 209.249.139.254 )	A	ABOVE.NET	Tokyo, JP	Web
sjc.skitter.caida.org ( 209.249.216.254 )	A	ABOVE.NET	San Jose, US	Routers
apan-jp.skitter.caida.org ( 203.181.248.27 )	A	APAN	Tokyo, JP	Web
skitter.kaist.kr.apan.net ( 192.249.24.30 )	D	APAN	Taejon, KR	Web
galahad.caida.org ( 204.212.46.2 )	D	CAIDA	Ann Arbor, US	Small
yto.skitter.caida.org ( 205.189.33.78 )	A	CANET	Ottowa, CA	Routers
chenin.caida.org ( 128.117.28.220 )	D	NCAR	Boulder, US	Small
nyc-engr-01.inet.qwest.net ( 205.171.17.253 )	D	Qwest	San Jose, US	Web
sjo-engr-01.inet.qwest.net ( 205.171.22.253 )	D	Qwest	San Jose, US	unknown
riesling-ether.caida.org ( 192.172.226.24 )	A	SDSC	San Diego, US	Web
skitter.uoregon.edu ( 128.223.220.56 )	A	University of Oregon	Eugene, Oregon, USA	IPv4space
waikato.skitter.caida.org ( 130.217.248.88 )	A	University of Waikato	Hamilton, NZ	IPv4space
champagne.caida.org ( 141.142.121.4 )	A	VBNS	Urbana/Champaign, US	Small
mw.skitter.caida.org ( 204.29.239.23 )	A	Worldcom	MAE-west San Jose, US	Small

Figure 2.

The DNS prefix list, which now has 58,312 destinations, is running on six root server monitor, as of November 2000. Our goal with this list is to merge destinations seen at the DNS servers and select a single IP within each network prefix. Currently, we have IP lists taken from packet traces at A, J, K, and L. All of these lists, except for L include the number of requests made by each IP source address. We used a BGP table from David Meyer's University of Oregon Route Views project taken Aug. 8th 2000 to map IP addresses to prefixes. This table contained a total of 87,408 prefixes. The combined list contained a total of 854,084 IP addresses. We were able to cover 46,844 prefixes by using the IP addresses in this list. In an attempt to cover the remaining 40,564 prefixes in the core tables, we augmented the original list with our own prefix list. We were able to incorporate an additional 9,463 prefixes that resulted in the DNS list containing a total of 56,307 IP addresses. (64.4% prefix coverage)

Visualization of Massive Datasets

New AS connectivity graph

In response to demand from the community, we have made a new version of this visualization using new data and we are visualizing a larger portion of the Internet. In the next quarter, we will animate this graph.

Figure 3 (https://www.caida.org/research/topology/as_core_network/AS_Network.xml)

The visualization shown in Figure 3 represents a macroscopic snapshot of the Internet for two weeks: 2-15 October 2000. The graph reflects 626,773 IP addresses and 1,007,723 IP links (immediately adjacent addresses in a traceroute-like path) of skitter data from 16 monitors probing approximately 400,000 destinations spread across over 48,302 (52%) of globally routable network prefixes.

We then aggregate this view of the network into a topology of Autonomous Systems (ASes), each of which approximately maps to an Internet Service Provider ("ISP"). We map each IP address to the AS responsible for routing it, i.e., the origin (end-of-path) AS for the best match IP prefix of this address in Border Gateway Protocol (BGP) routing tables collected by the University of Oregon's RouteViews project. The abstracted graph consists of 7,624 Autonomous System (AS) nodes and 25,126 peering sessions. For 61 ASes we could not provide geographical location. The resulting graph contains 7,563 AS (81% of all AS present in Oregon BGP tables of Oct. 15, 2000) and 25,005 peering sessions.

Figure 4 explains that the position of each AS node is plotted in polar coordinates, pos (radius, angle) (pos(r,q)), where:

Figure 4.

The outdegree of an AS node is the number of `next hop' ASes that we observed accepting traffic from this AS.

Graphing dimensions of peering richness and geographic information reveals the highly `core-centric' nature of ASes based in North America. All except one of the top 15 ASes are based in the U.S., with one exception based in Canada. While ISPs in Europe and Asia have many peering relationships with ISPs in the U.S. there are few links directly between ISPs in Asia and Europe. Both technical (cabling and router placement and management) as well as policy (business and cost models, geo-political considerations) factors contribute to peering arrangements represented in this graph.

One of CAIDA's skitter project goals is to develop techniques to illustrate relationships and depict critical components of the Internet infrastructure.

Note:

Those familiar with CAIDA's earlier AS core poster may notice that we have included the complete AS graph this time, not just the core. Skitter coverage of the IP address space has increased significantly since then. We defined the core as those nodes for which we observed bidirectional connectivity with other nodes. However, with the increased coverage this property is no longer specific to a small subset of nodes. (In the limit of full coverage, every node will have bidirectional connectivity to any other node on the Internet). The complete AS graph shown here provides indication of relative position with respect to the core, and the larger quantity of data yields an increased differentiation by outdegree.

Graph Visualization Library

We are working on a generalized framework for dealing with large graphs. We began development on an implementation of this called Libsea (tentative name). It provides functionality for loading, saving, examining, and to a certain extent processing large graphs. It does not, however, provide functionality relating to the presentation of data, such as for laying out graphs. Its main purpose is to make graph data easily accessible to programs, and it should be able to handle graphs with around a million nodes, a few million links, and hundreds of thousands of paths (a path is a sequence of adjacent links) on a moderately powerful workstation with a few hundred megabytes of memory. Each element, such as a node, can also have user-specified attributes containing, for example, real-world measurement data. All data is stored in main memory rather than on disk in a database, although the latter should be possible in the current design with additional work. One of the main goals of the library is to serve as a means for different tools at different stages--collection, processing, and visualization--to share graph data. Work is progressing on a Java implementation, but we anticipate implementations for C/C++ and Perl.

Analysis

CAIDA did comprehensive analysis on several different facets of skitter and coral data, including definition of the most well connected part of the Internet, composition of the /24 address space, skitter destination list composition, and a feasibility study for identifying poorly served Root Server destinations. We also conducted analysis on packet fragmentation found at the NASA Ames Internet exchange. We describe the research in detail below.

We describe the fundamentals of analyzing Internet graphs at various layers, and problems in gathering and analyzing Internet routing and topology data in graph form. Using skitter topology data and Oregon Route Views BGP table data, we present IP graphs, their connected components, and the combinatorial core of Internet topology. We discuss techniques for assessing which portions of the global Internet are characterized by the highest degree of `connectivity', both in central/backbone and access/delivery components of the topology. We describe several combinatorial approaches, including:

1. extracting the core component of the Internet whose bi-directional connectivity most readily captured by measurement, even in observation conditions which are far from ideal

2. ordering `node centrality' by the lengths of shortest paths originating from them;

3. comparing access points by the size of the "access cone" - the number of nodes/prefixes/ASes and/or the size of address space that depend wholly or in part on this access point for their global connectivity.

Our analysis introduces several new concepts for graph-theoretic routing and topology analysis:

1. the "dual AS graph", that captures more policy constraints in the infrastructure than conventional (dimension 1) graph. In particular, a graph of AS adjacencies is a poor descriptor for peerings further than one hop due to the influence of policy.

2. the BGP atom, a unit of connectivity analysis that correspond to an equivalence class of IPv4 network prefixes that share the same set of AS paths.

3. connected subspaces of a prefix, a unit of IP level connectivity that allows us to avoid certain biases arising in straightforward compression of IP graph to prefix representation.

BGP Atoms

In pursuit of greater insight into the structure and dynamics of the Internet's inter-domain routing system, we have studied the notion of AS path equivalence for IP addresses. An IP path taken by a packet is to some extent (e.g. in its core or backbone portion) determined by BGP AS path, so we consider the possibility of using AS path characteristics to predict a packet's kinematics (RTT) and dynamics (loss). If it were possible, many important path properties currently found via measurement, observation and lots of other effort, could be compiled in readily available tables inferred from BGP data. Essentially we could obtain a triumph over the currently necessary combinatorial approach to network measurements.

But even if we cannot completely predict kinematic and dynamic properties of the Net by combinatorial speculation, AS path equivalence of IP addresses may still considerably reduce the scope coverage, and frequency of measurements necessary. As routing tables continue to grow (and their growth appears to be accelerating), it becomes more important to understand the sources of growth, and if any can be mitigated. We observe that many prefixes have exactly the same AS path (As of Aug.2000, there are 8 times as many prefixes as AS paths in a complete BGP table.) It is natural to ask in this context, how many prefixes share a common system of AS paths, and how many are in fact routed differently? We have found that it is possible to redistribute IP addresses in such a way that global routing tables would contain less than 20,000 prefixes, without any change to the system of AS paths in current use.

Yet another product of this line of thought is the introduction of an intermediate level of granularity between prefix and AS, at which we can study and analyze Internet routing and topology. There are twice as many IP address equivalence classes (atoms) as ASes, and there are about five times as many prefixes as address equivalence classes. The partition of IP address space into AS path equivalent subsets can be compared with a hand-made quilt, sewn with rectangular strips of cloth of varying size and color. It remains to be seen whether the stripes with the same color have indeed the same performance characteristics.

11.2 Significant Events

-CAIDA met with new SPAWAR representative, Derek Wong, to discuss reporting procedures.

-CAIDA was granted and NMS award.

-New version of AS network poster was produced showing current state of connectivity in the Internet

- On December 7-8, 2000, CAIDA hosted an Internet Statistics and Metrics Analysis (ISMA) workshop concerning the correlation and visualization of core routing tables and macroscopic topology data sets. This meeting engaged researchers and practitioners experienced in data analysis, data visualization, and Internet operations fields. https://www.caida.org/workshops/isma/0012/

Publications:

The following papers were submitted to PAM

Bradley Huffaker, Marina Fomenkov, David Moore and kc claffy, Macroscopic analyses of the infrastructure: Measurement and visualization of Internet connectivity and performance, accepted by PAM 2001, April 2001.

Nevil Brownlee, KC Claffy, Margaret Murray and Evi Nemeth, Methodology for Passive Analysis of a University Internet Link, accepted by PAM 2001, April 2001.

Colleen Shannon, David Moore and k claffy, Characteristics of fragmented IP traffic on Internet links, accepted by PAM 2001, April 2001.

Nevil Brownlee and kc claffy, IP Streams, Flows and Torrents: Measuring Stream Distributions in Real Time, accepted by PAM 2001, April 2001.

Ken Keys, David Moore, Ryan Koga, Edouard Lagache, Michael Tesch and K. Claffy, The architecture of the CoralReef Internet Traffic monitoring software suite, accepted by PAM 2001, April 2001.

Margaret Murray and K.C. Claffy, Measuring the Immeasurable: Global Internet Measurement Infrastructure, accepted by PAM 2001, April 2001.

Several CAIDA images were published in "Mapping Cyberspace", a book by Martin Dodge and Rob Kitchen published by Routledge with a related website at http://www.MappingCyberspace.com.

Anaylsis efforts in progress can be found at https://www.caida.org/~broido/overview.html.

FINANCIAL INFORMATION:

Contract #: N66001-98-2-8922

Contract Period of Performance: 16Jul1998 to 15Jul2001

Ceiling Value: $6,655,449

Current Obligated Funds: $2,971,812

Reporting Period: 1Oct2000 to 31Dec2000

Actual Costs Incurred:

Current Period:

Labor Hours	3103	$ 89,308
ODC's		$ 60,795 (includes Waikato Subcontract Cost $18,333)
IDC's		$ 48,030

TOTAL COST:		$ 198,133
Cumulative to date:

Labor Hours	27525	$ 916,528
ODC's		$ 619,583
IDC's		$ 525,063

TOTAL COST:		$ 2,061,174

Note: additional financial information in tabular form, including breakdown by subcontract and estimated expenditures for Quarter 10, is attached to report.