Press Release

August 30, 2001

NTT Develops "ENCORE": the World's First Internet-based Automatic Diagnostic System for Analysis of Routing Failures Between Multiple ISPs

Nippon Telegraph and Telephone Corp. (NTT) has developed "ENCORE" (*1), a system for automatic analysis of failures on the Internet that affect several Internet Service Providers (ISP) at once. This is the first system of its kind in the world. ENCORE is an intelligent diagnostics system developed by NTT Network Innovation Laboratories to grasp the behavior of inter-ISP information that changes form as it is transmitted over the broad range of the Internet. It does this by distributing agents (*2) that monitor routing information for each individual ISP, combining this information and inferring the behavior of routing information, and analyzing the causes of routing failures. In this way, the system allows automatic early discovery and analysis of failures in routing information across multiple ISPs, which had been difficult to accomplish from individual ISPs, and facilitates the construction of highly stable Internet environments. In order to demonstrate the effectiveness of the ENCORE system, NTT Network Innovation Laboratories installed monitoring agents in Japan and in New York State, on the East Coast of the U.S., and began evaluation tests on a global scale in June of this year. Given that the accuracy of the system's diagnoses can be improved by increasing the number of monitoring agents, NTT plans to further expand the scale of these evaluation tests in the future in cooperation with NTT Communications. < Background of Development > The Internet is a massive collection of networks operated by companies, universities, and ISPs, referred to as autonomous systems (ASs). IP packets (*3) sent from a given AS arrive at the destination AS via numerous other ASs; when this happens, the IP packet forwarding route is determined according to the route table for the routers (*4) inside each AS. The route tables are set through reference to the route information exchanged between ASs, and at that time the route information is transmitted to networks throughout the world while being rewritten within each AS according to the route information management policies (*5) for the AS in question. Each As has its own original route information management policy, however, making inconsistencies in policy between ASs a common occurrence. Furthermore, router settings based on these policies are carried out manually, so setting errors can occur easily as well, causing route instability, and at times resulting in large-scale losses in connectability (Ref. Fig. 1). These problems could be resolved if it were only possible to trace the routing information, but as it stands, difficulties arise because it is impossible to determine from monitoring of the originating AS alone how the reported route information has been processed and used in IP packet forwarding control. To counter these difficulties, NTT Network Innovation Laboratories has conducted analyses based on operational tests in actual networks and investigations of examples of actual failures, established technologies for solving these problems using cooperative analysis functions and distributed fixed monitoring of multiple agents located outside of the AS, and developed diagnostic systems that will achieve these goals. < Key Points of the Technology > (Ref. Fig. 2) 1) Autonomous monitoring and verification based on cooperation between intelligent agents distributed among multiple autonomous systems We have adopted a method of integrating information monitored from outside the originating AS and inferring the movement of routing information so as to verify that the routing information is being transmitted according to the intent of the originating AS. Specifically, in the ENCORE system, agents are distributed in multiple autonomous systems; routing information is observed autonomously in the environment of each individual AS, and observed information is shared among agents to verify that the information is in keeping with the intent of the originating AS. 2) Route failure discovery and cooperative analysis Each agent conducts statistical analysis of the monitored information and quantifies local events and trends specific to the AS to seek out signs of failure occurrences. If a sign of a failure is discovered, a comparison is made with previously registered hypotheses to elicit and verify the potentially correct hypothesis. If necessary for this process, the agent in question will cooperate with other agents to run diagnostic tools and exchange information, carrying out an integrated analysis of information derived from multiple perspectives. 3) Diagnostic knowledge based on examples of actual failures Diagnostic knowledge based on experience in actual AS operation / management and examples of failure analysis are used in the discovery of signs of failure occurrences, narrowing down the target of diagnosis, and the selection of verification rules. < Effects Derived from Implementing ENCORE > In the past, manual analysis by experts was the only method of analyzing route failures between ASs. Furthermore, it was difficult for network operators to continually observe huge volumes of changing route information for verification of actual IP packet forwarding behavior and early discovery of failures. By implementing this system, ISPs--even network operators without specialized knowledge of routing information--will be able to verify that the movement of traffic is in accordance with design intentions, and discover failures at an early stage. When a certain class of failures occur between autonomous systems, the ISP is able to conduct automatic failure analysis; in the case of analysis for more complex inter-AS failures, the system notifies the operator immediately and provides data required for analysis, thus facilitating reduced analysis costs for the operator. < Future Developments > NTT is currently conducting evaluation tests of the ENCORE system on a global scale, using monitoring points installed in Japan and on the East Coast of the United States (Ref. Fig. 3). Given that ENCORE is a technology that can derive more accurate diagnostic results by increasing the number of observation agents, we plan to expand the scale of tests in the future in cooperation with NTT Communications, using an increasing number of monitoring points. Furthermore, based on the knowledge derived from these evaluation test environments, we will promote research into autonomous network management environments that use intelligent agents created though extensions of the ENCORE system. < Explanation of Specialized Terminology > (*1) ENCORE An Inter-AS diagnostic ensemble system using cooperative reflector agents. (*2) Agent In the context of computer networks, "agent" refers to a function that autonomously gathers information and makes judgments on conditions to allow execution of appropriate processing activities without the need for user operations. (*3) IP Packet Unit for transmission of information over the Internet. Information is broken down into small packets, and destination information is attached to each packet. (*4) Router A device installed in Internet environments to select the most appropriate route for transfer of IP packets. (*5) Policy Refers to the operating rules that determine how actual IP Packet transmissions are controlled.

- Figure 1: A typical example of routing anomalies - Figure 2: ENCORE system - Figure 3: Evaluation environment on a global scale

For further information, contact:         Kimihisa Aihara, Hirofumi Motai         Planning Division         NTT Science and Core Technology Laboratory Group         Tel: 046-240-5152         E-mail: st-josen@tamail.rdc.ntt.co.jp

NTT NEWS RELEASE