Macha Monitoring

From WirelessAfrica

Purpose

Rural wireless networks in developing regions often depend on slow satellite links for their Internet access. This paper will try to quanitify the traffic patterns and usage of a slow satellite internet link in a rural wireless network and compare this to recent studies of Internet uisage patterns in the developed world to understand key challenges. This will be used as a starting point for further work to try and optimize Internet usage over slow satellite links in developing regions.

Team Members

  • David Johnson
  • Elizabeth Belding
  • Kevin Almeroth
  • Gertjan van Stam


Idea description

Main challenges

Milestones

Changes made on machines in Macha to enable monitoring

Tools installed on my machine for analysis

Python tools fro analysing tcpdump files or live interface

  • pypcap
sudo apt-get install python-pypcap
dpkg --listfiles python-pypcap ... to see files that it installes
svn checkout http://dpkt.googlecode.com/svn/trunk/ dpkt-read-only
cd dpkt-read-only
sudo make install
cd /usr/share/doc/python-pypcap/examples
python test.py




Primary obstacles

Evaluation

Metrics that will be measured

  • Percentage of local traffic
  • Caching efficiency (ratio of incoming traffic to external destination to outgoing traffic to external destination)
  • DNS hit rate
  • DNS delays (can be quite significant) , % of DNS hit on local DNS
  • Up/Down Traffic usage over a 2 week loggin interval
  • Flow analysis
- TCP connection durations
- Number of simultaneous flows in the network over time
- Plot of bandwidth used per IP source address in the network - check if there are clear dominant users
- # Retransmissions
- TCP round trip times for ACKS
  • Breakdown of application classes using port numbers
- Peer-to-peer traffic
- Web
- video streaming ... protocols like RTSP have there own port - also IP based for flash sites like youtube
- VoIP ... prototocols like SIP and some known Skype ports - Skype is a challenge if using port 80
- Instant messaging ... could catch things like IRC but maybe IP addresses based again
- tunneling

Useful links

Monitoring tools

  • tshark

Scraping tcpdump files

To analyse packet size distribution:L tcpdstat -w out.log  <tracefile>

Understanding port numbers and other networky stuff


DNS analysis

  • Macha uses dnsmasq (uses a default of only 150 names in the cache)
dnsmasq -c --cache-size=<cachesize> 
- if cachesize=0 it disables it

Checking reboot commands issued

  • Check with
last reboot


Squid proxy analysis

This to be put in a new section - academic writing guide