Date Added: Jan 2011
Detecting network path anomalies generally requires examining large volumes of traffic data to find misbehavior. The authors observe that wide-area services, such as peer-to-peer systems and content distribution networks, exhibit large traffic volumes, spread over large numbers of geographically-dispersed endpoints. This makes them ideal candidates for observing wide-area network behavior. Specifically, they can combine passive monitoring of wide-area traffic to detect anomalous network behavior, with active probes from multiple nodes to quantify and characterize the scope of these anomalies. This approach provides several advantages over other techniques: they obtain more complete and finer-grained views of failures since the wide-area nodes already provide geographically diverse vantage points; they incur limited additional measurement cost since most active probing is initiated when passive monitoring detects oddities.