Finger Pointing

The facility to be able to determine when there is a problem on the network using the event detection module will be extended to provide details of the location(s) that represent the cause of the problem(s) experienced.
For example, should a routed link suddenly become very congested due to cross traffic, this Finger Pointing facility will show that it is this particular network path rather than some of factor.
Bottleneck detection will become important in the future as network resources become more competitive as end-host link speeds increase.
Similarily, if a link goes down due to a cut fibre, this module will determine quickly and precisely that it was so.

We intend to develop a rudimentary 'finger pointing' module that will be used in conjunction with the event detection module to quickly identify the occurance and isolate the cause of the problem.
The implemenation of such a system will considerably reduce the time and effort required to localize and quickly determine the cause of the problem(s); the more precise the finger pointing can be, the more substantial the savings in time and effort.

The implemenation of such a system requires detailed information from the numerous independent systems end-to-end.
By utilizing the software bus and external modules to systematically collect historical data and possibly initiately new tests, a logical deduction of the cause of the event will be determined.
This will most likely need to then be cross correlated against comparable (or even non-comparable) tests such that confidence can be given to the deduction.

We expect to require detailed historical information in order to make such a system successful; topology information to provide the network path, performance data using multi-domain systems such as perfSONAR, historical changes in node configurations and also the end-to-end performance data such as that from IEPM-BW.
Such data will be provided into the LHC-MI system via the various modules which will collect such data to be stored into persistent data stores from which this Finger Pointing module will interoperate through.

We imagine that concise reports will be generated that will provide all relevant performance data and logical deductions to the root of the problem so that network engineers and managers can provide feedback in the capability of the system and enable us to evolve the system further.

We are currently exploring the application of specific network tools (such as PathNeck [PATHNECK]) and using federated services such as perfSONAR to develop mathematical and systematic isolation techniques to discover bottlenecks in the real Internet.
We are also working with the Internet2 piPES [PIPES] program and wish to extend our involvement in the project by utilizing our expertise in network monitoring and event detection.




[Yee: probably fits better with the event detection; but need to correlate with Tickets given out by the various network providers to determine whether an event was expected or not]