Network Topology Estimation via PING Packet Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for estimating connection relationships between network devices are inefficient due to high resource consumption in adding packets to multiple adjacent devices, leading to low processing efficiency and increased network load.
Innovation Solution
An estimation system that uses a PING packet transmitted and returned between network devices to compare time-series data, reducing the need to add packets to all devices and optimizing resource usage by leveraging the 'Echo Request/Echo Reply' mechanism, allowing feature extraction in both directions with traffic applied in one direction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packets are added to each of multiple adjacent network devices for topology estimation, then connection relationship estimation can be performed, but resource consumption (CPU, memory) of the addition device increases significantly
Solution Approach 1:
The invention divides the network devices into two distinct functional groups: addition devices that generate and inject test packets, and estimation devices that analyze traffic patterns to determine topology. This segmentation allows the resource-intensive packet generation to be performed by dedicated addition devices while the analysis is performed by estimation devices, distributing the computational burden and avoiding concentrated resource consumption at a single device.
Solution Approach 2:
The invention introduces a traffic flow as an intermediary medium between the addition device and estimation device. Instead of directly analyzing complex packet interactions at multiple devices, the system uses the traffic flow itself as a carrier of topological information. The estimation device analyzes characteristics of this intermediary traffic flow (such as packet arrival patterns, data amounts, timing) to infer connection relationships, thereby reducing the need for direct resource-intensive packet manipulation at multiple network devices.
2Measurement precision
If packets are added to all network devices in a hierarchical network, then complete topology estimation can be achieved, but processing efficiency of the addition device decreases
Solution Approach 1:
The system segments the network devices into addition devices and estimation devices based on their functional roles. Addition devices are responsible for generating and injecting test packets into specific interfaces, while estimation devices collect and analyze traffic data from multiple sources. This functional segmentation allows the packet addition process to be optimized for efficiency while maintaining comprehensive topology coverage through coordinated analysis at estimation devices.
Solution Approach 2:
Instead of adding packets to all network devices uniformly, the system performs partial action by injecting test packets only at strategically selected addition devices and interfaces. The estimation devices compensate for this partial action by analyzing traffic patterns from multiple perspectives and using inference algorithms to reconstruct the complete topology, thereby achieving comprehensive estimation with reduced processing overhead.
3Measurement precision
If multiple packets are transmitted to multiple network devices for estimation, then connection relationships can be identified, but network load increases
Solution Approach 1:
The invention uses a carefully designed test packet flow as an intermediary that carries topological information efficiently. By analyzing characteristics of this intermediary traffic (such as packet timing, data amounts, and flow patterns) rather than generating excessive probing traffic, the system achieves accurate connection detection with minimized network load. The traffic flow serves as a compact information carrier that reveals topological relationships without requiring voluminous probe packets.
Solution Approach 2:
The system changes key parameters of the test packets, such as data amount and timing intervals, to optimize the balance between estimation accuracy and network load. By carefully controlling packet size and transmission timing, the system extracts sufficient topological information while keeping the overall traffic volume low. Parameter optimization allows the system to achieve detection accuracy without proportionally increasing network load.
Data Source
AI summary
In an estimation system 100 including an addition device 1 and an estimation device 3, the addition device 1 includes a storage section 11 which stores address information of each interface of one of at least two network devices connected to each other, and a transmission section 16 which transmits, at different times, a PING packet which is output to the other network device and is then returned to the one of the network devices to each interface of the one of the network devices by using the address information of the interface read from the storage section, and the estimation device 3 includes an estimation section 34 which compares, for each time, time-series data of a data amount of each interface of the one of the network devices which includes a data amount of the PING packet and time-series data of a data amount of each interface of the other network device which includes the data amount of the PING packet, and calculates a combination of the interfaces of which the data amounts at each time match each other.