Network Measurement

Overview

Network measurement underpins operations, research, and security. Techniques fall into two broad categories: active (inject probe traffic) and passive (observe existing traffic).

Active Measurement

Traceroute

Discovers the forward path from source to destination by exploiting TTL (Time-to-Live) behavior.

Classic traceroute:

Send packet with TTL=1 → first hop returns ICMP Time Exceeded
Send packet with TTL=2 → second hop returns ICMP Time Exceeded
...
Send packet with TTL=n → destination returns ICMP Port Unreachable (UDP)
                          or Echo Reply (ICMP)

Traceroute Variants

Paris Traceroute

Standard traceroute uses different source ports per probe, causing ECMP routers to hash probes to different paths. This produces false topology (diamonds, loops that do not exist).

Paris traceroute fixes the flow identifier (5-tuple hash) across all probes to a given destination, ensuring all probes follow the same path. MDA (Multipath Detection Algorithm) extension systematically discovers all load-balanced paths.

Bandwidth Estimation

Available Bandwidth

The unused capacity on a path at a given time.

Capacity (Bottleneck Bandwidth)

The maximum throughput a path can sustain.

Packet Pair / Train Dispersion

Sender:              Receiver:
|P1|P2|  →  link  →  |P1|  |P2|
back-to-back          spaced by bottleneck

Bottleneck capacity = packet_size / inter-arrival_gap

• Packet pairs estimate per-hop capacity.
• Packet trains (multiple packets) improve accuracy by averaging.
• Cross-traffic introduces noise; statistical methods filter it.

ping and RTT Measurement

• ICMP Echo Request/Reply measures round-trip time.
• Minimum RTT approximates propagation delay (no queuing).
• RTT variance indicates congestion or path changes.
• One-way delay requires clock synchronization (NTP/PTP) or GPS.

Passive Measurement

NetFlow / IPFIX

NetFlow (Cisco) and IPFIX (IETF standard, RFC 7011) export flow-level summaries from routers.

Flow definition: Unidirectional sequence of packets sharing:

• Source/destination IP
• Source/destination port
• IP protocol
• Ingress interface
• ToS/DSCP

Flow record fields:
  Source IP, Dest IP, Src Port, Dst Port, Protocol
  Packet count, Byte count
  Start time, End time
  TCP flags (OR of all packets)
  Input/Output interface
  Next-hop IP, Source/Dest AS

Sampling: At high link speeds, routers sample 1-in-N packets (e.g., 1:1000) and extrapolate flow statistics. Introduces estimation error but is necessary for performance.

sFlow

sFlow (RFC 3176) is an industry-standard sampling technology.

sFlow samples 1-in-N packets, copies the first 128 bytes (header), and exports immediately with interface counter snapshots. The collector reconstructs traffic statistics.

Packet Capture

Full packet capture for detailed analysis.

eBPF for Network Observability

eBPF programs attached at various kernel hooks provide programmable, low-overhead monitoring.

XDP (ingress) → TC (traffic control) → Socket → Application
   ↓                    ↓                  ↓
 eBPF programs collect metrics, trace events, filter traffic
   ↓
 Maps (hash, array, ring buffer) → userspace tools

• Tools: bpftrace, Cilium Hubble, Pixie, Retina.
• Can observe TCP state, retransmissions, RTT, connection events without packet capture.

Traffic Classification

Identifying application types from network traffic.

Classification Approaches

Flow Features for ML Classification

Encrypted Traffic Classification

With ubiquitous TLS, classifiers rely on:

• TLS handshake metadata: SNI (being encrypted via ECH), cipher suites, extensions.
• JA3/JA4 fingerprints: Hash of TLS ClientHello parameters identifies client software.
• Packet size sequences: Different applications produce characteristic size patterns.
• Timing patterns: Video streaming vs. web browsing vs. interactive apps.

Network Telescopes (Darknets)

A network telescope monitors traffic sent to routed but unused IP address space (dark space).

What Telescopes Observe

Internet → Traffic to unused IPs → /8 or /16 darknet → Capture and analyze

Analysis Applications

• DDoS measurement: Backscatter analysis estimates global DDoS activity. A /8 telescope observes ~1/256 of all backscatter.
• Worm detection: Sudden increase in scanning traffic indicates new worm propagation.
• Vulnerability scanning: Track scanning campaigns by source, port, protocol.

Notable Telescopes

Internet Topology Mapping

IP-Level Topology

• Use traceroute from many vantage points to discover router-level connectivity.
• CAIDA Ark: Distributed traceroute infrastructure with ~200 global monitors.
• RIPE Atlas: 12,000+ probes worldwide for traceroute, ping, DNS measurements.

Challenges

Alias Resolution Techniques

AS-Level Topology

Inferred from BGP data:

• BGP route collectors: RouteViews, RIPE RIS collect BGP updates from hundreds of peers.
• AS relationship inference: Classify links as customer-provider, peer-peer, or sibling using valley-free routing heuristics (Gao, 2001; CAIDA AS-rank).
• IXP detection: PeeringDB data combined with traceroute to identify exchange points.

Topology Metrics