IPTV Traffic Monitoring System

with IPFIX/PSAMP

Shingo Kashima

NTT Information Sharing Platform Laboratories

3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Outline

Introduction
 Motivation
 IP Multicast Streaming Traffic

Issues in Existing Multicast Monitoring

Requirements

Relationship with the Other Works

Why IPFIX/PSAMP?

Our System: Qcast
 System Overview
 System Architecture

Requirement for Backbone Router

Summary

2 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Motivation

Multicast service has started in several provider
networks.
 Large number of broadband users leads to heavy demand for IP
multicast streaming services, such as IPTV.

Existing multicast tools work, but not well enough to

monitor streaming services in large-scale networks.
 Multicast ping, trace route, and multicast MIB.

Easy troubleshooting tools are required.

3 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 IP Multicast Streaming Traffic

Traffic volume of an IPTV channel: 10 Mbps, 0.9 kpps.
 Packet size: from 1300 to 1400 bytes.

IP multicast stream traffic includes two kinds of packets.
 Media packets and FEC (Forward Error Correction) packets.

IP multicast stream traffic includes RTP headers.
 Packet loss can be easily detected by keeping track of RTP seq. number.

About 100 channels pass through an ISP network.

Traffic volume [bps] Traffic volume [pps]

Media packets Media packets

FEC packets FEC packets

4 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Issues in Existing Multicast Monitoring

Multicast ping and trace route
 Detect fault point and check continuity by using test packets.
 Do not observe real packets.

→ Inadequate for detecting service quality deterioration and confirming

service quality.

Mirroring + packet capture

 Last resort for confirming service quality.
 But requires great care and is not suitable for always-on monitoring.

5 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Requirements

Requirement #1: Detecting service quality
deterioration (packet loss and delay variation)
 Because an IP multicast streaming service is sensitive to network
performance.

Requirement #2: Recognizing failure impact (which

subscribers and which IPTV channels are affected).
 In order to explain to customers and content providers.

Requirement #3: Localizing failure point

 In order to recover the failure with rapidity.

Requirement #4: Early applicability

 Because an IP multicast streaming service has already started.

6 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Relationship with the Other Works

In home network area:
 Forth-coming HGW and STB may have a function of measuring QoS
(Quality of Service) or QoE (Quality of Experience).

In core network area:
 Current router and switch do not have a capability of measuring QoS
because no effective method of measuring a lot of IPTV channel.

Channel#1 Channel#2

Core network area:

→ our scope

Home network area:

Nagoya Tokyo Hokkaido → have already been studied
7 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories
 Why IPFIX/PSAMP ?

PSAMP (Packet SAMPling)
 “Property Match Filtering” can focus the monitoring on IPTV traffic
by selecting on the basis of packet header value.
 “Systematic Time-based Sampling” can detect packet loss and packet
interval time by selecting continuous packets.

IPFIX (IP Flow Information Export)
 “Enterprise-specific Information Elements” can export not only UDP/IP
header information but also RTP header information.
Traffic measurement method in core network
NetFlow IPFIX/PSAMP
Specification Cisco Proposed Standard
Proprietary
Packet Only Random ・Random Sampling
Selection Sampling ・Property Match Filtering
・Time-based Sampling and so on
Export L3/L4 L3/L4 information and
Information information Enterprise-specific information
8 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories
 Our System: Qcast Overview

Probe: Captures traffic from mirror port, measures
IPTV traffic with PSAMP, and exports with IPFIX.
 Runs on a general-purpose personal computer.

Web-Console: Collects IPFIX information and shows it
to operators. Monitoring,
analyzing and
Web-Console checking
Channel#1 Channel#2
IPFIX
Operator
Probe Probe

Probe
Probe Probe
Probe

Nagoya Tokyo Hokkaido

Qcast (Quality of broadCASTing monitoring system)
9 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories
 Qcast Architecture
Today’s topic 1 Today’s topic 2 Today’s topic 3

Today we show
Web-Console a prototype of
Probe Packet Counter
view.

Router IPFIX View

IPFIX
Selector IPFIX
IF Loss Checker Collector Loss
Exporter
(PSAMP) Alert
Traffic
Interval Checker
Traffic
Summary
Operator
Traffic
Database
Traffic
Chart
IPTV-channel-based
Traffic
CSV File
Flow-based Traffic Data
Aggregator

Interface-based

10 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Topic 1: Packet Loss and Interval Time

Combination of PSAMP techniques in Probe
 Observe packets at input interface.
 Select multicast packet by “Property Match Filtering”.
 Example: “Destination IPv6 Address == FF38::/16”

 Extract them using “Systematic Time-based Sampling”.

 All input packets during the interval period are selected.

Interval Spacing Interval Spacing Interval

Start End Start End Start End ・Check packet loss by

Point Point Point Point Point Point
keeping track of RTP seq.
IF IPFIX Exporter number.
Observed ・Check interval time by
packets keeping track of receipt
timestamp.

Filtering Time-based
sampling
11 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories
 Topic 2: Exporting Traffic Data
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

IPv6 template 0 Set ID (0x0002) Length
 Flow key information 4 Template ID (0x0103) Field Count = 18 (0x0012)
8 octetDeltaCount (0x0001) Field Length (0x0004)
 Includes VLAN ID 12 packetDeltaCount (0x0002) Field Length (0x0004)
16 srcTransportPort (0x0007) Field Length (0x0002)
 Traffic volume information
20 dstTransportPort (0x000B) Field Length (0x0002)
24 srcIPv6Address (0x001B) Field Length (0x0010)
28 dstIPv6Address (0x001C) Field Length (0x0010)
 Packet loss information 32 droppedPacketDeltaCount (0x0085) Field Length (0x0004)
36 flowStartMilliseconds (0x0098) Field Length (0x0004)
40 flowEndMilliseconds (0x0099) Field Length (0x0004)
 Interval time information 44 vlanId (0x003A) Field Length (0x0002)
48 protocolIdentifier (0x0004) Field Length (0x0001)
 Uses “Enterprise-specific
52 ipVersion (0x003C) Field Length (0x0001)
Information Elements” 56 rtpIntervalAvgTime (0x8001) Field Length (0x0004)

Option template 60 ENTERPRISE NUMBER (0x000000D2)

64 rtpInternalMaxTime (0x8002) Field Length (0x0004)
0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
68 ENTERPRISE NUMBER (0x000000D2)
0 Set ID (0x0003) Length
72 rtpIntervalMinTime (0x8003) Field Length (0x0004)
4 Template ID (0x0106) Field Count (0x0003)
76 ENTERPRISE NUMBER (0x000000D2)
8 Scope Field Count (0x0001) exporterIPv4Address (0x0082) 80 rtpIntervalVariance (0x8004) Field Length (0x0004)
12 Scope 1 Length (0x0004) samplingTimeInterval (0x0133) 84 ENTERPRISE NUMBER (0x000000D2)

16 Field Length (0x0004) samplingTimeSpace (0x012E) 88 rtpPayloadType (0x8005) Field Length (0x0002)
92 ENTERPRISE NUMBER (0x000000D2)
20 Field Length (0x0004) flowActiveTimeout (0x0024)

24 Field Length (0x0002)

12 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Topic 3: View

Demonstration

13 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Demo Network
Ch001_FOX {[Link], ff3e::8000:1}
Ch002_BBC {[Link], ff3e::8000:1}
Ch003_MTV {[Link], ff3e::8000:1}
[VLAN_ID] VLAN configuration
Web-Console
Port mirroring
IPFIX delivery

VLAN untag

QProbe00

bit error

VLAN tagged

QProbe01 QProbe02 QProbe03

101-103 201-203 301-303
GE-PON GE-PON GE-PON
Zapping

14 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories

 Requirement for Backbone Router

To adopt a lot of probes in a large scale commercial
network is difficult for us.

Then we need a backbone router with IPFIX/PSAMP.
 Classification with Property Match Filter.
 RTP traffic -> Non Sampling

 The other traffic -> Random Sampling

Exporter (Router)
Collector/Mediator
Non Sampling
(or Time-based Sampling)
VoIP IPTV QoS
IPFIX VoIP IPTV
MAILVoIP Monitoring
Web IPTV IF
Property Mach Filter

Web MAIL Volume

IPFIX Web MAIL
Monitoring
Random
n-out-of-N Sampling
15 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories
 Summary

We presented a new traffic monitoring method for IP
multicast streaming services, such as IPTV, and the
implemented system using IPFIX/PSAMP (Qcast).

We showed the feasibility of the Qcast.

We want a router with IPFIX/PSAMP enabling QoS

monitoring.

16 3rd NMRG Workshop © 2010 NTT Information Sharing Platform Laboratories