Passive Measurement of Network Quality

The importance and necessity of end-to-end fault and performance problem detection in wide area production networks increases with the complexity of the paths, the diversity of network components performance, and dependency on the network. Network monitoring provides insight into the state and performance of the network and whether it is behaving as expected and whether changes in the network have improved or degraded its performance. This is essential for a service provider like Open Systems, because they have to respect Service Level Agreements (SLAs) and want to optimize their systems, improve Quality of Service (QoS) as well as plan for the future. Open Systems is a leading provider of network security world-wide. To measure its network quality, it generates artificial traffic by active ICMP probing. But active monitoring doesn’t consider actual customer traffic and places additional load on the network. Thus, the goal of this Thesis is to implement a passive monitoring system which uses existing customer traffic to determine the network performance. This Thesis starts with a broad survey of known passive monitoring mechanisms. The analysis and classification points out the limits of passive measuring. Hence a short overview of existing active probing systems is presented. The research shows that only one of the proposed methods is well suited for the VPN networks. To develop new approaches of passive monitoring suitable for VPNs, the target VPN environment is analyzed in detail. The specification and implementation of a passive monitoring mechanism was based on these investigations. The prototype monitors and collects two different network metrics from VPN hosts around the globe: Round Trip Time (RTT) and Packet Loss. To identify network performance problems or anomalous variations in the traffic as well as to evaluate the designed monitoring techniques, many series of plots of the network metrics were done. The encouraging evaluation showed that passive Packet Loss detection and RTT form a sound basis for detecting network performance problems in VPNs.