Diagnosing network disruptions with network-wide analysis Export

@article{citeulike:4618346, abstract = {To maintain high availability in the face of changing network conditions, network operators must quickly detect, identify, and react to events that cause network disruptions. One way to accomplish this goal is to monitor routing dynamics, by analyzing routing update streams collected from routers. Existing monitoring approaches typically treat streams of routing updates from different routers as independent signals, and report only the "loud" events (i.e., events that involve large volume of routing messages). In this paper, we examine BGP routing data from all routers in the Abilene backbone for six months and correlate them with a catalog of all known disruptions to its nodes and links. We find that many important events are not loud enough to be detected from a single stream. Instead, they become detectable only when multiple BGP update streams are simultaneously examined. This is because routing updates exhibit network-wide dependencies.}, address = {New York, NY, USA}, author = {Huang, Yiyi and Feamster, Nick and Lakhina, Anukool and Xu, Jim J.}, citeulike-article-id = {4618346}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=1269899.1254890}, citeulike-linkout-1 = {http://dx.doi.org/10.1145/1269899.1254890}, doi = {10.1145/1269899.1254890}, issn = {0163-5999}, journal = {SIGMETRICS Perform. Eval. Rev.}, keywords = {abilene, anomaly-detection, pca}, number = {1}, pages = {61--72}, posted-at = {2009-05-24 09:25:58}, priority = {2}, publisher = {ACM}, title = {Diagnosing network disruptions with network-wide analysis}, url = {http://dx.doi.org/10.1145/1269899.1254890}, volume = {35}, year = {2007} }

TY - JOUR ID - citeulike:4618346 L3 - citeulike-article-id:4618346 N2 - To maintain high availability in the face of changing network conditions, network operators must quickly detect, identify, and react to events that cause network disruptions. One way to accomplish this goal is to monitor routing dynamics, by analyzing routing update streams collected from routers. Existing monitoring approaches typically treat streams of routing updates from different routers as independent signals, and report only the "loud" events (i.e., events that involve large volume of routing messages). In this paper, we examine BGP routing data from all routers in the Abilene backbone for six months and correlate them with a catalog of all known disruptions to its nodes and links. We find that many important events are not loud enough to be detected from a single stream. Instead, they become detectable only when multiple BGP update streams are simultaneously examined. This is because routing updates exhibit network-wide dependencies. IS - 1 JF - SIGMETRICS Perform. Eval. Rev. SN - 0163-5999 AD - New York, NY, USA EP - 72 TI - Diagnosing network disruptions with network-wide analysis PB - ACM VL - 35 SP - 61 KW - abilene KW - anomaly-detection KW - pca AU - Huang, Yiyi AU - Feamster, Nick AU - Lakhina, Anukool AU - Xu, Jim PY - 2007/// UR - http://dx.doi.org/10.1145/1269899.1254890 ER -