Using immersive real-time collaboration environments to manage IP networks A thesis submitted for the degree of Doctor of Philosophy Warren Harrop, BEng(Hons)(Telecommunications and Internet Technologies) & BAppSc(Multimedia Technologies) (Swinburne University), Centre for Advanced Internet Architectures, Faculty of Science, Engineering and Technology, Swinburne University of Technology, Melbourne, Victoria, Australia. August 21, 2014 Declaration This thesis contains no material which has been accepted for the award to the candidate of any other degree or diploma, except where due reference is made in the text of the examinable outcome. To the best of the candidate’s knowledge this thesis contains no material previously published or written by another person except where due reference is made in the text of the examinable outcome; and where the work is based on joint research or publications, discloses the relative contributions of the respective workers or authors. Warren Harrop Centre for Advanced Internet Architectures (CAIA) - Faculty of Science, Engineering and Technology Swinburne University of Technology August 21, 2014 iii Publications arising from this thesis Some preliminary results and discussions in this thesis have been previously published in peer- reviewed literature: W. Harrop and G. Armitage, “Intuitive Real-Time Network Monitoring Using Visually Orthog- onal 3D Metaphors,” in Australian Telecommunications Networks & Applications Conference 2004 (ATNAC 2004), Sydney, Australia, 8-10 December 2004, pp. 276–282. [Online]. Available: http: //caia.swin.edu.au/pubs/ATNAC04/harrop-armitage-ATNAC2004.pdf W. Harrop and G. Armitage, “Modifying first person shooter games to perform real time network monitoring and control tasks,” in NetGames ’06: Proceedings of 5th ACM SIGCOMM workshop on Network and system support for games. New York, NY, USA: ACM, 2006, p. 10. W. Harrop and G. Armitage, “Real-time collaborative network monitoring and control using 3D game engines for representation and interaction,” in VizSEC ’06: Proceedings of the 3rd international work- shop on Visualization for computer security. New York, NY, USA: ACM, 2006, pp. 31–40. The development of Greynets, the motivating use case for visualisation, is documented in: W. Harrop and G. Armitage, “Defining and evaluating greynets (sparse darknets),” in LCN ’05: Proceedings of the The IEEE Conference on Local Computer Networks 30th Anniversary. IEEE Computer Society, 2005, pp. 344–350. W. Harrop and G. Armitage, “Greynets: a definition and evaluation of sparsely populated darknets,” in MineNet ’05: Proceeding of the 2005 ACM SIGCOMM workshop on Mining network data. New York, NY, USA: ACM Press, 2005, pp. 171–172. F. Baker, W. Harrop, and G. Armitage, “IPv4 and IPv6 Greynets,” RFC 6018 (Informational), In- ternet Engineering Task Force, Sep. 2010. [Online]. Available: http://www.ietf.org/rfc/ rfc6018.txt v Acknowledgements My supervisor Professor Grenville Armitage & associate supervisor Dr. Philip Branch, for providing valuable guidance and feedback throughout the creation of this thesis. Mitchell Harrop and Sebastian Zander for their feedback. Many thanks to all CAIA members past and present for creating an excellent research environ- ment. The following people helped greatly in recruiting usability experimentation participants: Mitchell Harrop, Bettina Harrop, Juniris Harrop and Peter Harrop. Thanks go to Daniel Trembath for creation of software to aid in data entry. This code saved numerous hours and allowed the accurate conversion of the approximately 200 pages of paper answer sheets to digital form. The Cisco University Research Program Fund provided support funding for the project “Anoma- lous Traffic Detection and Collaborative Network Configuration Using 3D Multiplayer Game En- gines”, Project Leader and Participants Grenville Armitage, Warren Harrop & Cisco Project Cham- pion, Fred Baker. This funding enabled the production of L3DGEWorld and thanks go to Lucas Parry for his year of software engineering on the project. (http://www.caia.swin.edu.au/urp/l3dge/) The Cisco Network Topology Icons are used in many diagrams in this thesis. (http://www.cisco.com/web/about/ac50/ac47/2.html) The auDA Foundation supplied a supporting grant for the development of the CAIA Greynets Toolkit – greynetd. (http://caia.swin.edu.au/greynets/) Trace file data of multi-player Quake III Arena game play from Chapter 6 is taken from data publicly available in the SONG collection, created by the Centre for Advanced Internet Architectures, Swinburne University of Technology (http://caia.swin.edu.au/sitcrc/song/). Monika Dieker for being there from start to finish. vii Contents Abstract 1 1 Introduction 3 1.1 A real-time collaborative environment . 6 1.2 Usability experimentation . 9 1.3 Network resource consumption . 9 1.4 Thesis outline . 10 2 Techniques for Immersive and Collaborative Management 11 2.1 The role of visualisation . 12 2.1.1 Reasons for the visualisation of data networks . 13 2.1.2 Past and present . 14 2.2 The diversity of metering, transfer and collection methods . 15 2.2.1 Network observation points - collecting frames . 16 2.2.2 Network layers - example network metrics . 16 2.3 The diversity of network control & service discovery methods . 19 2.3.1 Example network control methods . 19 2.4 Network data interpretation . 21 2.4.1 Text based . 22 2.4.2 2D – static and interactive . 22 2.4.3 3D – static and interactive . 22 2.4.4 3D – immersive . 23 2.5 Collaboration . 23 2.6 Taxonomy . 24 2.6.1 User control over presented information . 24 ix x CONTENTS 2.6.2 Real-time dynamic update of data into a system . 24 2.6.3 Historical data access . 25 2.6.4 Interaction with running network configuration . 25 2.6.5 Visual presentations and metaphors used . 25 2.6.6 Concurrent presentation of network variables . 25 2.6.7 Collaboration . 26 2.6.8 Scalability . 26 2.7 Network visualisation evolution – a review of notable examples . 26 2.7.1 Textual visualisations . 27 2.7.2 Static 2D visualisations . 30 2.7.3 Interactive 2D visualisations . 35 2.7.4 Interactive 3D visualisations . 38 2.7.5 Immersive 3D visualisations . 41 2.8 Visualisations using game engines . 44 2.9 Conclusion . 45 3 Proposal & Methodology 46 3.1 Leveraging a FPS game engine . 48 3.2 Historical data access . 49 3.3 Evaluation Methodology . 50 3.3.1 Usability experiments . 50 3.3.2 Network resource consumption experimentation . 52 4 Towards a Visual Environment 54 4.1 Motivating use case – visualising greynet data . 54 4.2 Early prototyping - 3VEN . 56 4.3 Cube engine . 57 4.4 Example usage . 58 4.4.1 Multiple monitoring points . 58 4.5 L3DGEWorld . 60 4.5.1 Collaboration . 61 4.5.2 Drill down . 63 4.6 Experiment architecture . 64 CONTENTS xi 4.7 L3DGEWorld extensions/modifications . 65 4.8 Conclusion . 67 5 Usability Evaluation 68 5.1 Methodology . 69 5.2 Results & Discussion . 73 5.2.1 Participant demographics & experience . 73 5.2.2 Navigation within L3DGEWorld . 74 5.2.3 Object movements and the concepts they convey . 76 5.2.4 Visual orthogonality . 79 5.2.5 Participants’ ability to detect in-world events . 81 5.2.6 Participants’ in-world positions . 82 5.2.7 Participant’s sensitivity to latency . 82 5.2.8 Final open-ended questions . 83 5.2.9 Professional network administrators . 83 5.3 Conclusion . 84 6 Network Resource Consumption 85 6.1 Experiment setup . 86 6.2 Client connection establishment and teardown . 87 6.3 Data propagation process . 88 6.4 Continuous operation traffic . 90 6.4.1 Attribute update affect on snapshot size . 91 6.5 L3DGEWorld server data propagation delay . 92 6.6 Multiple client L3DGEWorld - usability traffic analysis . 93 6.6.1 Command traffic . 94 6.6.2 Snapshot traffic . 95 6.7 L3DGEWorld limitations . 98 6.7.1 Under-sampling . 98 6.7.2 Packet loss . 98 6.7.3 Acknowledgments . 99 6.8 L3DGEWorld performance over uncontrolled paths . 99 6.9 Conclusion . 101 xii CONTENTS 7 Conclusion 104 7.1 L3DGEWorld . 105 7.2 Usability . 105 7.3 Network Resource Consumption . 106 A Ethics clearance 108 B Questionnaire 110 C Answer sheets 124 D Hardware accuracy 129 D.1 Methodology . 129 D.2 Results . 130 D.2.1 Alloy 8 port switch (GS-08DXI) . 130 D.2.2 Alloy 5 port switch (NS-05CR) . 131 E Synthetic Packet Pairs 132 References 133 List of Figures 2.1 A section of the modern London underground map - still based on Beck’s original 1933 design . ..