High-rate large-sized (α) flows have adverse effects on delay-sensitive flows. Research-and-education network providers are interested in identifying such flows within their networks, and directing these flows to traffic-engineered QoS-controlled virtual circuits. To achieve this goal, a design is proposed for a hybrid network traffic engineering system (HNTES) that would run on an external server, gather NetFlow reports from routers, analyze these reports to identify α-flow source/destination address prefixes, configure firewall filter rules at ingress routers to extract future flows and redirect them to previously provisioned intra-domain virtual circuits. This paper presents an evaluation of this HNTES design using NetFlow reports collected over a 7-month period from four ESnet routers. Our analysis shows that had HNTES been deployed, it would have been highly effective, e.g., > 90% of α-bytes that arrived at the four routers over the 7-month period would have been redirected to virtual circuits. Design aspects such as whether to use /24 subnet IDs or /32 addresses in firewall filters, and which router interfaces' NetFlow reports to include in the HNTES analysis, are studied.

This paper describes traffic analysis undertaken to answer certain questions needed to design a hybrid network traffic engineering system (HNTES). The hybrid network in question consists of an IP-routed network and a dynamic virtual-circuit network, and the role of HNTES is to identify and redirect α-flows, which are defined as flows in which the number of bytes exceeds a threshold H (1 GB) over at least one α-interval (1 minute). NetFlow data from ESnet was analyzed. Our findings show that raw IP α-flows (identified by the 5-tuple) are mostly short-lived (80% are shorter than 2 minutes), which implies that HNTES should use an offline mechanism for identifying α-flows and preconfiguring policy-based routes to redirect packets for these flows to virtual circuits since setup delay is about 1 minute. An offline mechanism using prefix flow identifiers (/32 source and destination IP addresses or /24 source and destination subnets) appears to be highly effective because α-flow generating sources and sinks typically have static public IP addresses. For example, an analysis of two months of NetFlow data from an ESnet router shows that more than 94% of the total number of bytes from α-flows would have been redirected had a /24 based offline HNTES solution been deployed.

The goal of this work is to characterize scientific data transfers and to determine the suitability of dynamic virtual circuit service for these transfers instead of the currently used IP-routed service. Specifically, logs collected by servers executing a commonly used scientific data transfer application, GridFTP, are obtained from three US super-computing/scientific research centers, NERSC, SLAC, and NCAR, and analyzed. Dynamic virtual circuit (VC) service, a relatively new offering from providers such as ESnet and Internet2, allows for the selection of a path on which a rate-guaranteed connection is established prior to data transfer. Given VC setup overhead, the first analysis of the GridFTP transfer logs characterizes the duration of sessions, where a session consists of multiple back-to-back transfers executed in batch mode between the same two GridFTP servers. Of the NCAR-NICS sessions analyzed, 56% of all sessions (90% of all transfers) would have been long enough to be served with dynamic VC service. An analysis of transfer logs across four paths, NCAR-NICS, SLAC-BNL, NERSC-ORNL and NERSC-ANL, shows significant throughput variance, where NICS, BNL, ORNL, and ANL are other US national laboratories. For example, on the NERSC-ORNL path, the inter-quartile range was 695 Mbps, with a maximum value of 3.64 Gbps and a minimum value of 758 Mbps. An analysis of the impact of various factors that are potential causes of this variance is also presented.

A new breed of network intensive "e-science" applications are emerging that require a new perspective on how networks provide resources to the user. These e-science applications often have large raw capacity requirements (tens of gigabits/second) and require global reach. The discipline scientists expect this type of performance to be deterministic and repeatable, and available in conjunction with other resources such as sensors, instruments, computational clusters, storage arrays, and the like. The DRAGON project, an NSF funded testbed in the Washington DC metropolitan area, has been developing open source generalized multi-protocol label swapping (GMPLS) based service concepts that provide dedicated and deterministic network resources to the e-science application. Using the GMPLS control plane and DRAGON extensions, an entire "application specific topology" can be established in an automated fashion across administrative boundaries, across heterogeneous network technologies, and can be instantiated in seconds rather than weeks or months. This paper describes the technologies being developed by the DRAGON project and some of the ways application specific topologies are being applied to advanced networked applications.

Emerging network applications tend to be built over heterogeneous network resources spanning multiple management domains. Many such applications have dynamic demands for dedicated, deterministic, high-bandwidth connections. The generalized multi-protocol label switching (GMPLS) networks under development can address these kinds of demands by using policy-based resource management and service provisioning technologies. In this paper, we present the architecture and implementation for policy-based resource management and service provisioning as part of the work on the NSF funded dynamic resource allocation via GMPLS optical networks (DRAGON) Project. This work captures several critical features of service-oriented GMPLS networks, including a) collaborative interdomain resource management; b) interdomain end-to-end path computation; c) advance scheduled provisioning; and d) authentication, authorization and accounting (AAA). These features rely on the capability of exchanging and coordinating resource and policy information among multiple participating domains. In pursuit of this capability, we propose a three-dimensional (3D) resource computation model (RCM). The three broad dimensions of this model are traffic engineering (TE) constraints, time schedule constraints, and AAA policy constraints. The 3D RCM facilitates policy based resource allocation based on many specific constraints within these three broad categories. Based on this model we describe our approach to GMPLS interdomain end-to-end path computation, advance scheduled provisioning, and AAA policy based provisioning, respectively. Our current DRAGON implementation status is also reported in this paper.

Rapid progress in deployment of national and regional optical network infrastructures holds the promise to provide abundant, inexpensive bandwidth to scientific communities. The expectation is that this will provide a catalyst for innovation across a range of eScience applications. However, there remains considerable architecture and research work in order to allow such applications to access a common shared high-speed infrastructure efficiently and flexibly. This paper presents an experimental solution currently being designed and tested over the Dynamic resource allocation via GMPLS optical networks (DRAGON) and the Internet2 hybrid optical and packet infrastructure (HOPI). This implementation provides deterministic network services to high-end eScience applications in the form of Ethernet "circuits" using GMPLS to dynamically provision user specific VLAN based configurations. This requires addressing several research issues associated with multi-layer networks, interdomain routing, signaling, and multi-constraint path computation. The larger vision is that of a shared infrastructure consisting of multiple network technology layers over which an intelligent control plane can provide for a unified service model. The instantiation described here of Ethernet over WDM provides an ideal platform for both experimental research and, real services, and a migration path to a production infrastructure.

Inter-domain path computation, or the ability to compute end-to-end paths across multiple domains, is the next step toward wide deployment of a distributed control plane with support for traffic engineering. A key enabler to achieve this goal is the introduction of a Path Computation Element (PCE) in each domain. There are various ways these elements can collaborate to compute an end-to-end path; of particular interest to us in this paper is cooperative path computation, a scheme where PCEs exchange path information in the context of a specific end-to-end path computation instance, often prior to signaling the path. We show that depending on the information available to each PCE, cooperation can take one of two forms, which we call model-based and ad hoc. We demonstrate that model-based cooperation is essentially a multistage decision problem, and offer a probabilistic analysis which we believe is the key to understanding the problem and developing efficient inter-domain path computation heuristics. In particular, we argue that having an estimate of the blocking probability in each domain can be helpful in determining the path computation effort needed to find an end-to-end path.