ENHANCING WATCHERS FOR USE OVER MULTICAST ROUTERS (A DISTRIBUTED ROUTER MONITORING TECHNIQUE)

Abstract

The work presented in this dissertation is related to the field of distributed Network Monitoring (more precisely, the router monitoring). The router is a very crucial component in the infrastructure of the today's Internet, and hence makes a good target for an attacker. An attacker in control of a router may disrupt the communication by dropping or misrouting packets passing though the router. The dissertation work deals with a protocol called WATCHERS which detects and reacts to the routers that drop or misroute packets. WATCHERS is based on the principle of conservation of flow in a network (i.e., all data bytes sent into a node, and not destined for that node are expected to exit the node). WATCHERS tracks this flow, and detects routers that violate the conservation of flow principle. The present version (henceforth we will refer to it as the earlier version) of this protocol has a drawback: it fails for the multicast routers. A multicast router can legitimately send out multiple copies of a single multicast packet destined for some multicast group. This event violates the conservation of flow principle, although there is nothing wrong with the router itself, and hence fails the protocol. In this dissertation a solution to this drawback has been proposed. Secondly, an economical mode of operation for WATCHERS has been suggested. In this mode, instead of monitoring the individual routers in an autonomous system, we divide the routers into groups and monitor the collective traffic flow of members in each group. This reduces the cost of operation of the protocol. Then, WATCHERS' response to several different types of bad router behaviors has been discussed. It is then demonstrated that in ideal conditions WATCHERS makes no false positive diagnosis...