Pinpointing Delay and Forwarding Anomalies Using Large-Scale Traceroute Measurements

TL;DR

This paper introduces new methods leveraging large-scale traceroute data to detect and analyze network disruptions, delays, and faulty routers, enhancing network monitoring and reliability insights.

Contribution

It presents a novel statistical approach and a packet forwarding model for detecting network anomalies using RIPE Atlas measurements, with comprehensive case studies.

Findings

Effective detection of real network disruptions

Identification of congested links and faulty routers

Insights into the location and impact of network events

Abstract

Understanding network health is essential to improve Internet reliability. For instance, detecting disruptions in peer and provider networks facilitates the identification of connectivity problems. Currently this task is time consuming for network operators. It involves a fair amount of manual observation because operators have little visibility into other networks. In this paper we leverage the RIPE Atlas measurement platform to monitor and analyze network conditions. We propose a set of complementary methods to detect network disruptions from traceroute measurements. A novel method of detecting changes in delays is used to identify congested links, and a packet forwarding model is employed to predict traffic paths and to identify faulty routers in case of packet loss. In addition, aggregating results from each method allows us to easily monitor a network and identify coordinated reports manifesting significant network disruptions, reducing uninteresting alarms. Our contributions consist of a statistical approach providing robust estimation for Internet delays and the study of hundreds of thousands link delays. We present three cases demonstrating that the proposed methods detect real disruptions and provide valuable insights, as well as surprising findings, on the location and impact of identified events.