Building Out the Basics with Hoplets

Abstract

Maintaining a performant Internet service is simplified when operators are able to develop an understanding of the path between the service and its end users. A key piece of operational knowledge comes from understanding when i) segments of a path contribute to a significant portion of the path’s delay ii) when these segments occur across end users. We propose hoplets, an abstraction for describing delay increases between an end-user and a content provider built on traceroutes. We present a mechanism for measuring and comparing hoplets to determine when they describe the same underlying network features. Using this mechanism, we construct a methodology to enable wide scale measurement that requires only limited contextual data.

We demonstrate the efficacy of hoplets, showing their ability to effectively describe round-trip-time increases observed from a global content delivery network. Additionally, we perform an Internet-scale measurement and analysis of the hoplets observed from this infrastructure, exploring their nature and topological features where we find that nearly 20% of bottlenecks occurred along paths with no visible alternative. Finally, we demonstrate the generality of the system by detecting a likely network misconfiguration using data from RIPE Atlas.

8 Appendix

1.1 8.1 Parameter Selection

Here, we provide a brief examination of the parameter selection process used in our development of the hoplets system. These parameters are ultimately a reflection of the underlying data and the desired sensitivity to processing that data. Alternative sources of data may find it necessary to repeat these experiments.

Alert Threshold. Recall that the alert threshold determines the deviation necessary for a differential RTT to trigger the creation of a hoplet. Here we consider our thresholds as a multiple of the standard deviation, as estimated using the MAD. Here we consider a range of values, from .2 to 10. Recall, that our minimum criteria also requires a differential RTT of at least 10 ms, a requirement we retain here.

Fig. 6.

(a) Increasing the alert threshold reduces the total number of hoplets found in the data. (b) For our ping measurements, $80\%$ of measurements see variation under $12\%$.

Figure 6a shows the number of extracted hoplets for each multiplier. Indeed, increasing the multiplier reduces the total number of hoplets detected, nearly linearly. Recall that hoplets do not represent a discrete event, i.e. a degradation, but instead are a description of the observed behavior. Lower sensitivity means the system will produce information only about the largest source of RTT, and higher sensitivity means it will provide information on more segments with a rider range of RTT deviations.

In order to manage this balance, we use a single standard deviation (i.e. a multiplier of 1), building hoplets only around hops which demonstrate large increases, but not requiring that they represent egregious outliers. Other alerting functions, for example based on the deviation percentile, may also perform well. An important constraint, however, is that the threshold be relative to the traceroute itself, though absolute criteria may prove valuable for operators in certain condition with tight constraints.

Carry-Through Tolerance. Next, we examine the selection of the $12\%$ variation which is permitted in the carry-through requirement. Here, we consider all traceroute measurements taken over a day as a series of independent ping measurements. We take all destinations (i.e. intermediate hops in the traceroute) for which we had at least 3 measurements, which leaves us with a total of 24, 916 measurements. We then compute the median measured RTT and the median deviation observed over those measurements.

Figure 6b shows a CDF of these deviations. Here we see that $80\%$ of our measurements had variation under .12. This suggests that while we see some differences over the course of our measurements, the true measurement noise is relatively small. Therefore an allowance of $12\%$ allows such measurements to still be used, while still maintaining our carry-through condition.