A CASE-STUDY OF ETHERNET ANOMALIES IN A DISTRIBUTED COMPUTING ENVIRONMENT

Distributed computing systems, or networks, are notoriously difficult environments in which to detect and diagnose faults. Fault detection and diagnosis depend critically on good fault definitions, but the dynamic, noisy and nonstationary character of networks makes it hard to define what a fault is in a network environment. The work presented in this paper takes the position that a fault or failure is a violation of expectations. In accordance with empirically based expectations, operating behaviors of networks (and other devices) can be classed as being either normal or anomalous. Because network failures most frequently manifest themselves as performance degradations, or deviations from expected behavior, periods of anomalous performance can be attributed to causes assignable as network faults. The half-year case study presented here employed a system in which observations of distributed computing network behavior were automatically and systematically grouped into two classes: normal and anomalous. Anomalous behaviors were traced to faulty conditions. In a preliminary effort to understand and catalog how networks behave under various conditions, two cases of anomalous behavior are analyzed in detail. Examples are taken from the distributed file system network at Carnegie Mellon University. © 1990 IEEE