Tracking down Traffic Dario Bonfiglio Marco Mellia Michela Meo - PowerPoint PPT Presentation

Tracking down Traffic Dario Bonfiglio Marco Mellia Michela Meo Nicolo’ Ritacca Dario Rossi

Agenda • A few words about Skype – Known facts – Preliminary definitions • Investigate Skype “Traffic” – Voice traffic • Reaction to network performance degradation – Signaling traffic • Signaling patterns & peer selection – Users’ behavior • Please, see the paper

Why Skype ? • Skype is very popular – More than 100M users, 5% of all VoIP traffic – Easy to use, many free services • voice / video / chat / data transfer over IP • Understanding Skype is a challenging task – Closed design, proprietary solutions – Almost everything is encrypted – Uses a P2P architecture – Lot of different flavors

Skype for Dummies • Architecture – P2P design

Skype for Dummies • Architecture – P2P design • Service traffic – Voice calls – Video calls – Chat – Data transmission

Skype for Dummies • Architecture – P2P design • Service traffic – Voice calls – Video calls – Chat – Data transmission – Skypeout/Skypein

Skype for Dummies • Architecture – P2P design • Service traffic – Voice calls – Video calls – Chat – Data transmission – Skypeout/Skypein • Signaling traffic – Login & auth. – Look for buddies – … .

Methodolody • Service traffic – Small scale active testbed – Controlled bandwidth, packet loss – voice service, many Codecs, TCP/UDP traffic • Signaling traffic – Passive measurement technique – Adopt a black-box approach – Inspect and quantify UDP signaling – Classification framework: 300 . 10 3 7000 hosts external D.Bonfiglio, M.Mellia, M.Meo, D.Rossi, P.Tofanelli, peers 1700 peers Revealing Skype Traffic: When Randomness Plays with You , SIGCOMM'07

Preliminary Definition • Useful information Skype flow – At installation, Skype chooses – A sequence of packets a port at random originated from a Skype peer (and destined to – The port is never changed another skype peer) (unless forced by the user) – All traffic multiplexed over the – Flow starts when the first same socket (UDP preferably) packet is observed Skype peer – Flow ends when no packet is observed for a given – A Skype peer can be identified inactivity timeout (200s) by its endpoint – Consider only peers that were ever observed making a call (IP addr, UDP port)

Skype Source Model Sk Skyp ype Mess ssage ge TC TCP/ P/UD UDP IP IP

Service traffic Codec Impact

Service Traffic: Normal Condition 250 ISAC Smooth iLBC iPCM-WB Transient PCM 200 G729 Bitrate Normal [kbps] 150 Behavior Aggressive 100 Startup 50 0 0 10 20 30 40 50 60 Time [s]

Service Traffic: Normal Condition 300 ISAC 200 100 G729 100 50 Message 300 iLBC Payload 200 [Bytes] 100 iPCM-WB 900 600 300 PCM 600 400 200 0 10 20 30 40 50 60 Time [s]

Service Traffic: Normal Condition 70 ISAC iLBC 60 iPCM-WB PCM E2O G729 50 IPG [ms] 40 30 20 10 0 0 10 20 30 40 50 60 Time [s]

Service traffic Transport Layer Impact

Service Traffic: TCP vs UDP B - UDP 80 B - TCP 60 40 20 0 90 IPG - UDP IPG - TCP Time [s] TCP/UDP have no impact 60 30 0 L - UDP 250 L -TCP Time [s] 200 150 100 50 0 0 10 20 30 40 50 60 Time [s]

Service traffic Network Impact

Service Traffic: Bandwidth Limit 100 Average Throughput 80 Bandwidth limit 60 40 20 0 100 Framing 80 Time [s] 60 Skype performs congestion control 40 20 0 300 Skype Message Size 250 Time [s] 200 150 100 50 0 0 30 60 90 120 150 180 210 240 270 300 Time [s]

Service Traffic: Packet Loss Loss % 60 10 50 8 Inter-Pkt 40 6 Gap [ms] 30 4 Aggressively tries 20 to deal with losses… 2 10 0 0 Skype performs loss recovery 0 100 200 300 400 500 500 10 Loss profile 400 8 Payload 300 6 [Bytes] 200 4 ...by multiplexing old 100 2 and new voice blocks 0 0 0 100 200 300 400 500 Time [s]

Service traffic Video Traffic

Service Traffic: Video Source 800 B 600 400 200 0 IPG 80 Time [s] Video messages 60 Skype multiplexes different sources 40 are Bigger Voice messages 20 are the same 0 L Usual IPG for 900 Time [s] Back-to-back video pure audio messages 600 Massages => frame 300 0 0 10 20 30 40 50 60 Time [s]

Signaling traffic

Signaling Traffic: Activity Pattern 1500 • Legend Out – Consider a single client 1000 – Each dot is a packet – Top: outgoing, 500 Bottom: incoming – For every new peer, 0 increment the ID -500 – For every old peer, use the previous ID -1000 In Rather different patterns -1500 emerge from the plot 0 6 12 18 24 Time [Hr]

Signaling Traffic: Activity Pattern 1500 • Probes Out – Single packet 1000 – Sent toward unknown peers – Reply possibly follows 500 – No further traffic between the same peers pair 0 – Majority of the flows -500 -1000 Peer discovery is a In continuous task -1500 0 6 12 18 24 Time [Hr]

Signaling Traffic: Activity Pattern 1500 • Non-Probes Out – Flows longer than one packet 1000 – Series of single-packet flows – Sent toward the same peer 500 – Carry most signaling bytes 0 -500 -1000 Talk to super peers, notify In buddies of status change, -1500 … 0 6 12 18 24 Time [Hr]

Signaling Traffic: All Peers 1500 • Probes Out – Majority of the flows 1000 • Non-probes 500 – Carry most signaling bytes • Signaling bandwidth 0 – 95% generate <100 bps – Only 1% exceeds 1 Kbps -500 • Signaling spread -1000 – 95% of peers contact In <40 peers (in 5 min) -1500 – 1% exceeds >75 (in 5 min) 0 6 12 18 24 Time [Hr]

Conclusions • Service traffic • User Characterization – Active testbed – Number of calls per unit of time – Skype implements a congestion control – Call duration for different services • Aggressive with losses – Peer Lifetime • Conservative with bottlenecks Details are in the paper, not in this talk  • Signaling traffic – Passive measurement • Future Work – Two different threads – Extensive measurement in shapes the overlay different networks • Probes • Campus LAN • Non-Probes • ADSL installation – Signaling rate and spread • Cellular Network • Very limited bitrate • Large number contacted peers

Signaling Traffic: Peer Selection • RTT distance pdf Non-Probe 0.012 Probe – RTT between first 0.008 request-reply packets – Probe RTT smaller w.r.t. 0.004 non-probe traffic 0 10 100 1000 Round Trip Time [ms] • Geolocation breakdown Non-Probe 60% Probe – Probes favor discovery 40% of nearby hosts – Non-probes driven by 20% social network 0% Europe North Asia South Africa Oceania America America

Signaling Traffic: Peer Selection 80 70 60 50 Latitude 40 30 20 10 0 -150 -100 -50 0 50 100 150 Longitude

Signaling Traffic: Inferring Churn 0.08 Peer Lifetime PDF Peer Deathtime 0.07 0.06 0.05 0.04 0.03 0.02 0.01 0 6 12 18 24 Time [h]