Entries by Raymond P. Burkholder

Medium Access Control protocol for Collaborative Spectrum Learning in Wireless Networks

Abstract—In recent years there is a growing effort to provide learning algorithms for spectrum collaboration. In this paper we present a medium access control protocol which alllows spectrum collaboration with minimal regret and high spectral efficiency in highly loaded networks. We present a fully-distributed algorithm for spectrum collaboration in congested ad-hoc networks. The algorithm jointly solves both the channel allocation and access scheduling problems. We prove that the algorithm has an optimal logarithmic regret. Based on the algorithm we provide a medium access control protocol which allows distributed implementation of the algorithm in ad-hoc networks. The protocol utilizes single-channel opportunistic carrier sensing to carry out a low- complexity distributed auction in time and frequency. We also discuss practical implementation issues such as bounded frame size and speed of convergence. Computer simulations compar- ing the algorithm to state-of-the-art distributed medium access control protocols show the significant advantage of the proposed scheme.

Keywords: Machine learning, Medium Access Control, Spectrum sharing

Rhythm is a Dancer: Music-Driven Motion Synthesis with Global Structure - I'm thinking this could be used to drive procedurally driven christmas light displays.

Abstract—Synthesizing human motion with a global structure, such as a choreography, is a challenging task. Existing methods tend to concentrate on local smooth pose transitions and neglect the global context or the theme of the motion. In this work, we present a music-driven motion synthesis framework that generates long-term sequences of human motions which are synchronized with the input beats, and jointly form a global structure that respects a specific dance genre. In addition, our framework enables generation of diverse motions that are controlled by the content of the music, and not only by the beat. Our music-driven dance synthesis framework is a hierarchical system that consists of three levels: pose, motif, and choreography. The pose level consists of an LSTM component that generates temporally coherent sequences of poses. The motif level guides sets of consecutive poses to form a movement that belongs to a specific distribution using a novel motion perceptual-loss. And the choreography level selects the order of the performed movements and drives the system to follow the global structure of a dance genre. Our results demonstrate the effectiveness of our music-driven framework to generate natural and consistent movements on various dance types, having control over the content of the synthesized motions, and respecting the overall structure of the dance.

Index Terms—Animation, Global Structure Consistency, Motion Motifs, Music-driven, Motion Signatures.

• USGv6-Revision-1 to define the specification
• USGv6 Tested Registry

I recently picked up some BeagleBoard Green devices to act as temperature/pressure/humidity/gas sensors with the BME680 sensor.

After proving everything works with an 'out-of-the-box' unit, the next step is to see how far this can be upgraded. The units I received are running Debian Buster (the now previously stable release).

There is a list of BeagleBoard.org Latest Firmware Images, which currently has newer Buster images, but with the GUI removed. This provides for more drive space for an upgrade cycle. (there was not enough space with the factory loaded image).

Installing consists of downloading the 'flasher' image, installing to an sdcard, power cycling the beagleboard, and allowing time for the re-flash to proceed. The notes indicate that:

• flashing takes power
• remove any sensors / attachments
• remove the ethernet as it has a power overhead
• connect to a power supply (I was attempting to use POE, and I'm not sure if that was adequate)

The programming notes suggest downloading an application called etcher to write the image to the sdcard. A much simpler way (from Instructions to flash an image to an SD card):

xzcat bone-eMMC-flasher-debian-10.3-iot-armhf-2020-04-06-4gb.img.xz | dd of=/dev/mmcblk0 bs=64k oflag=dsync status=progress

After the reflash, and a reboot, I found that quite a few packages could be updated.

apt-get update apt-get dist-upgrade

There is a note about Debian 11 (bullseye) Testing Images where the suggestion is to do an in-place dist-upgrade, or fall back to downloading an image from a testing repository.

It might be faster to download the image that it would be to download 651 packages and perform an installation.

It took a while, but the dist-upgrade worked. It did require a download only retrieval with a forced install for some firmware::

# apt -d install firmware-brcm80211         
# dpkg -i --force-overwrite firmware-brcm80211_20210315-3_all.deb 
(Reading database ... 88560 files and directories currently installed.)
Preparing to unpack firmware-brcm80211_20210315-3_all.deb ...
Unpacking firmware-brcm80211 (20210315-3) over (20190717-2rcnee1~buster+20200305) ...
dpkg: warning: overriding problem because --force enabled:
dpkg: warning: trying to overwrite '/lib/firmware/brcm/brcmfmac43455-sdio.clm_blob', which is also in package bb-bbai-firmware 1.20210923.2-0~buster+20211007
Setting up firmware-brcm80211 (20210315-3) ...

Then, to bring the kernel up to date:

# apt-get autoremove
#
# cd /opt/scripts/tools/
# git pull
# ./update_kernel.sh 
# ./update_kernel.sh --lts-5_10

The update is performed twice: once to perform a simple upgrade (which will provide options), and then use the latest option to get current

Something to try later is to run a script to flash, rather than using a special image to self-flash: Flash Debian Bullseye on your BeagleBone Black, with more info at Beagleboard:Updating The Software.

• VeSoNet: Traffic-Aware Content Caching for Vehicular Social Networks based on Path Planning and Deep Reinforcement Learning - Vehicular social networking is an emerging application of the promising Internet of Vehicles (IoV) which aims to achieve the seamless integration of vehicular networks and social networks. However, the unique characteristics of vehicular networks such as high mobility and frequent communication interruptions make content delivery to end-users under strict delay constrains an extremely challenging task. In this paper, we propose a social-aware vehicular edge computing architecture that solves the content delivery problem by using some of the vehicles in the network as edge servers that can store and stream popular content to close-by end-users. The proposed architecture includes three components. First, we propose a social-aware graph pruning search algorithm that computes and assigns the vehicles to the shortest path with the most relevant vehicular content providers. Secondly, we use a traffic-aware content recommendation scheme to recommend relevant content according to their social context. This scheme uses graph embeddings in which the vehicles are represented by a set of low-dimension vectors (vehicle2vec) to store information about previously consumed content. Finally, we propose a Deep Reinforcement Learning (DRL) method to optimize the content provider vehicles distribution across the network. The results obtained from a realistic traffic simulation show the effectiveness and robustness of the proposed system when compared to the state-of-the-art baselines.
• Important Sentence Identification in Legal Cases Using Multi-Class Classification - The advancement of Natural Language Processing (NLP) is spreading through various domains in forms of practical applications and academic interests. Inherently, the legal domain contains a vast amount of data in text format. Therefore it requires the application of NLP to cater to the analytically demanding needs of the domain. Identifying important sentences, facts and arguments in a legal case is such a tedious task for legal professionals. In this research we explore the usage of sentence embeddings for multi-class classification to identify important sentences in a legal case, in the perspective of the main parties present in the case. In addition, a task-specific loss function is defined in order to improve the accuracy restricted by the straightforward use of categorical cross entropy loss.
• framework for comprehensible multi-modal detection of cyber threats - Detection of malicious activities in corporate environments is a very complex task and much effort has been invested into research of its automation. However, vast majority of existing methods operate only in a narrow scope which limits them to capture only fragments of the evidence of malware's presence. Consequently, such approach is not aligned with the way how the cyber threats are studied and described by domain experts. In this work, we discuss these limitations and design a detection framework which combines observed events from different sources of data. Thanks to this, it provides full insight into the attack life cycle and enables detection of threats that require this coupling of observations from different telemetries to identify the full scope of the incident. We demonstrate applicability of the framework on a case study of a real malware infection observed in a corporate network.
• Detecting Fake Points of Interest from Location Data - The pervasiveness of GPS-enabled mobile devices and the widespread use of location-based services have resulted in the generation of massive amounts of geo-tagged data. In recent times, the data analysis now has access to more sources, including reviews, news, and images, which also raises questions about the reliability of Point-of-Interest (POI) data sources. While previous research attempted to detect fake POI data through various security mechanisms, the current work attempts to capture the fake POI data in a much simpler way. The proposed work is focused on supervised learning methods and their capability to find hidden patterns in location-based data. The ground truth labels are obtained through real-world data, and the fake data is generated using an API, so we get a dataset with both the real and fake labels on the location data. The objective is to predict the truth about a POI using the Multi-Layer Perceptron (MLP) method. In the proposed work, MLP based on data classification technique is used to classify location data accurately. The proposed method is compared with traditional classification and robust and recent deep neural methods. The results show that the proposed method is better than the baseline methods.
• Catching Unusual Traffic Behavior using TF-IDF-based Port Access Statistics Analysis - Detecting the anomalous behavior of traffic is one of the important actions for network operators. In this study, we applied term frequency - inverse document frequency (TF-IDF), which is a popular method used in natural language processing, to detect unusual behavior from network access logs. We mapped the term and document concept to the port number and daily access history, respectively, and calculated the TF-IDF. With this approach, we could obtain ports frequently observed in fewer days compared to other port access activities. Such access behaviors are not always malicious activities; however, such information is a good indicator for starting a deeper analysis of traffic behavior. Using a real-life dataset, we could detect two bot-oriented accesses and one unique UDP traffic.

• Survey of Human Activity Recognition in Smart Homes Based on IoT Sensors Algorithms: Taxonomies, Challenges, and Opportunities with Deep Learning - Recent advances in Internet of Things (IoT) technologies and the reduction in the cost of sensors have encouraged the development of smart environments, such as smart homes. Smart homes can offer home assistance services to improve the quality of life, autonomy and health of their residents, especially for the elderly and dependent. To provide such services, a smart home must be able to understand the daily activities of its residents. Techniques for recognizing human activity in smart homes are advancing daily. But new challenges are emerging every day. In this paper, we present recent algorithms, works, challenges and taxonomy of the field of human activity recognition in a smart home through ambient sensors. Moreover, since activity recognition in smart homes is a young field, we raise specific problems, missing and needed contributions. But also propose directions, research opportunities and solutions to accelerate advances in this field.
• Network Migration Problem: A Logic-based Benders Decomposition Approach Driven by Column Generation and Constraint Programming - Telecommunication networks frequently face technological advancements and need to upgrade their infrastructure. Adapting legacy networks to the latest technology requires synchronized technicians responsible for migrating the equipment. The goal of the network migration problem is to find an optimal plan for this process. This is a defining step in the customer acquisition of telecommunications service suppliers, and its outcome directly impacts the network owners' purchasing behaviour. We propose the first exact method for the network migration problem, a logic-based Benders decomposition approach that benefits from a hybrid constraint programming-based column generation in its master problem and a constraint programming model in its subproblem. This integrated solution technique is applicable to any integer programming problem with similar structure, most notably the vehicle routing problem with node synchronization constraints. Comprehensive evaluation of our method over instances based on six real networks demonstrates the computational efficiency of the algorithm in obtaining quality solutions. We also show the merit of each incorporated optimization paradigm in achieving this performance.
• Analysis of the Effectiveness of Face-Coverings on the Death Ratio of COVID-19 Using Machine Learning - The recent outbreak of the COVID-19 led to the death of millions of people worldwide. To stave off the spread of the virus, the authorities in the US employed different strategies, including the mask mandate order issued by the states' governors. In the current work, we defined a parameter called the average death ratio as the monthly average of the number of daily deaths to the monthly average number of daily cases. We utilized survey data to quantify people's abidance by the mask mandate order. Additionally, we implicitly addressed the extent to which people abide by the mask mandate order that may depend on some parameters like population, income, and education level. Using different machine learning classification algorithms, we investigated how the decrease or increase in death ratio for the counties in the US West Coast correlates with the input parameters. The results showed that for most counties there, the mask mandate order decreased the death ratio reflecting the effectiveness of this preventive measure on the West Coast. Additionally, the changes in the death ratio demonstrated a noticeable correlation with the socio-economic condition of each county. Moreover, the results showed a promising classification accuracy score as high as around 90%.
• Deep Learning Technique using Low Sampling rate for residential Non Intrusive Load Monitoring - Individual device loads and energy consumption feedback is one of the important approaches for pursuing users to save energy in residences. This can help in identifying faulty devices and wasted energy by devices when left On unused. The main challenge is to identity and estimate the energy consumption of individual devices without intrusive sensors on each device. Non-intrusive load monitoring (NILM) or energy disaggregation, is a blind source separation problem which requires a system to estimate the electricity usage of individual appliances from the aggregated household energy consumption. In this paper, we propose a novel deep neural network-based approach for performing load disaggregation on low frequency power data obtained from residential households. We combine a series of one-dimensional Convolutional Neural Networks and Long Short Term Memory (1D CNN-LSTM) to extract features that can identify active appliances and retrieve their power consumption given the aggregated household power value. We used CNNs to extract features from main readings in a given time frame and then used those features to classify if a given appliance is active at that time period or not. Following that, the extracted features are used to model a generation problem using LSTM. We train the LSTM to generate the disaggregated energy consumption of a particular appliance. Our neural network is capable of generating detailed feedback of demand-side, providing vital insights to the end-user about their electricity consumption. The algorithm was designed for low power offline devices such as ESP32. Empirical calculations show that our model outperforms the state-of-the-art on the Reference Energy Disaggregation Dataset (REDD).

• Roadmap for Enabling a Future-Proof In-Network Computing Data Plane Ecosystem - As the vision of in-network computing becomes more mature, we see two parallel evolutionary trends. First, we see the evolution of richer, more demanding applications that require capabilities beyond programmable switching ASICs. Second, we see the evolution of diverse data plane technologies with many other future capabilities on the horizon. While some point solutions exist to tackle the intersection of these trends, we see several ecosystem-level disconnects today; e.g., the need to refactor applications for new data planes, lack of systematic guidelines to inform the development of future data plane capabilities, and lack of holistic runtime frameworks for network operators. In this paper, we use a simple-yet-instructive emerging application-data plane combination to highlight these disconnects. Drawing on these lessons, we sketch a high-level roadmap and guidelines for the community to tackle these to create a more thriving "future-proof" data plane ecosystem.
• Recommendations on using VPN over SATCOM - VPN are a secured tunnel that help service providers to exchange data over non-secured networks. There is a large variety of VPN solutions that have variable deployment impacts on the target architecture as well as performance limitations or opportunities. This technical report compares Wireguard and OpenVPN for various SATCOM deployment scenarios and topologies.
• How Developers and Managers Define and Trade Productivity for Quality - In this paper, we present the findings from a survey study to investigate how developers and managers define and trade-off developer productivity and software quality (two related lenses into software development). We found that developers and managers, as cohorts, are not well aligned in their views of what it means to be productive (developers think of productivity in terms of activity, while more managers think of productivity in terms of performance). We also found that developers are not accurate at predicting their managers' views of productivity. In terms of quality, we found that individual developers and managers have quite varied views of what quality means to them, but as cohorts they are closely aligned in their different views, with the majority in both groups defining quality in terms of robustness. Over half of the developers and managers reported that quality can be traded for higher productivity and why this trade-off can be justified, while one third consider quality as a necessary part of productivity that cannot be traded. We also present a new descriptive framework for quality, TRUCE, that we synthesize from the survey responses. We call for more discussion between developers and managers about what they each consider as important software quality attributes, and to have open debate about how software quality relates to developer productivity and what trade-offs should or should not be made.
• Algorithmic Theory of Metacognition in Minds and Machines - Humans sometimes choose actions that they themselves can identify as sub-optimal, or wrong, even in the absence of additional information. How is this possible? We present an algorithmic theory of metacognition based on a well-understood trade-off in reinforcement learning (RL) between value-based RL and policy-based RL. To the cognitive (neuro)science community, our theory answers the outstanding question of why information can be used for error detection but not for action selection. To the machine learning community, our proposed theory creates a novel interaction between the Actor and Critic in Actor-Critic agents and notes a novel connection between RL and Bayesian Optimization. We call our proposed agent the Metacognitive Actor Critic (MAC). We conclude with showing how to create metacognition in machines by implementing a deep MAC and showing that it can detect (some of) its own suboptimal actions without external information or delay.

Today, if you want to do a ransomware attack against a business, first you go on a wardrive, collect a pile of passwords, look for wifi networks of interesting businesses, and then start hacking their network from the inside. You will find plenty of information in the clear on the inside to mount a spearfishing attack, not to mention you will be able to collect a pile of hashes of passwords used on the internal network, and then find a pile of administrative passwords.

The most serious flaw shown here is the delusion that "inside" is more secure than "outside". The good old crunchy on the outside, chewy on the inside... If you are not managing your network with the assumption that the barbarians are already inside, then you are setting yourself for trouble.

Seen on cryptography mail list

My point is ... there is nothing out there on the Internet that needs data from my device - at least not for any reason useful to me - so there's no need for the device to be able to send packets. -- bear

Some recent suggestions I've encountered:

• SpamAssassin KAM Rules - Just a note that the much better way to use the rules is with the KAM Channel, see KAM Channel
• Sane Security Signatures

Rspamd is not a dead project and it can do all the stuff OpenDKIM+OpenDMARC+OpenARC can do (yes, even ARC signing and DMARC reporting). I have even added support of OpenDKIM style signing tables [1].

So far, Rspamd supports ed25519 and dual-signing out of the box. It also supports Hashicorp Vault to store (and rotate!) DKIM secrets [2]. In terms of DKIM signing there is also support of fast signing (with all content scan features disabled), so it is highly unlikely that it's performance can be beaten by any other signing tool in this mode [3].

• Use of Signing Table
• DKIM signing using Vault
• Optimizing Signing Only Mode

Rspamd (embedded in a Mailu installation) for low-maintenance operation. That packages includes several mechanisms to score messages and handle them according to score intervals. This does a relatively good job but isn't really able to detect persistent spammers using their own IP ranges.

Are you aware of its reputation module? In conjunction with selector system you can build reputation on wide range of parameters without touching Lua. Beside its IP reputation i use sender's eSLD, IPnet & ASN reputation with score limited to not be enough for rejection.

If spammer uses not related IP, ASN and/or senders (snowshoe), you still can use its bayes and/or fuzzy checks. But basically the reputation module with RBL scoring does good job and in last year i do not remember any false negative mail and small amount of false positives, especially from gmail, these false positives are mostly not due reputation, but due SPF/DKIM/DMARC ignorance of our eshop systems.

I have small python script, which gets reputation data from rspam's redis DB and fill dynamic blocklist for exim, to block persistent spammers at MTA level (RCPT stage).

Anyway, I document what I do in a blog post: Zimbra AntiSpam Best Practices

The post describes how we rely on several layers of protection (including those provided by Postfix, which I know you are not using), as well as our adjustments to Amavis and SpamAssassin. I hope there are some techniques in the blog post that will be helpful to you.

For Let's Encrypt certificates, I use these awesome scripts, they are written as bash shell scripts and they are infinitely better than the official certbot tool, they can be used without a web server, by using DNS API integration. They are highly recommended:

• acme.sh
• dehydrated

For the first one, it no longer defaults to LE, it uses zerossl, because its rights are now owned by them. You can re-enable LE as default though by:

acme.sh --set-default-ca --server letsencrypt

I use Bruce Guenter's mailfront for my incoming mail so I had to add SNI support. It wasn't very hard. [when using SNI to differentiate between certificates]

if one abuses any of 25|465|587 they are blocked on all of 25/465/587 with a lengthy filter time

if one abuses any of 110|143|993|995 they are blocked on all of 110/143/993/995 with a slightly shorter filter time

A while ago, there is/was an article called Gartner Says SDN Has Left the Building – Say Hello to Network Automation. I'm wondering if that is a patato/potato semantics problem: both things say the same thing. Mostly.

One might say that SDN (Software Defined Network) may have been shoehorned into a corner with the era associated technologies such as OpenFlow and the heavy Java tooling used to manage it.

In a similar vein, Network Automation has, in my mind, mostly simple meaning: push out configs programmatically rather than pounding them in with a keyboard. At that level, conceptually you have the identical problem of managing individual configs, but having a faster way of doing things. It does provide config version control management from a push perspective rather than a post gatherer with Rancid.

On the other hand, in the comments following the article, there was a third addition to the typical data/control plane terms: management plane. It is in the management plane where the fun begins. And this isn't in terms of human managers, this is in the auto-collection of network wide data to automatically define operational configurations for devices which push packets. Google's network is such an animal: with metrics backfeeding configuration, they can reach link utilization of over 90% without congestion issues.

So have these for future reference, some sites I used for obtaining better pricing on my energy (natural gas and electricity):

• Utilities Consumer Advocate - natural gas / electricity rate research & comparison shopping
• How to Switch Your Energy Retailer - when switching providers, it is best to explicitly cancel, else they may charge fees, just because they can
• Alberta Utilities Commission - more rate and provider information [ also useful for micro-generation/solar regulations and processes ]

NAT exists in IPv6:

• IPv6-to-IPv6 Network Prefix Translation exists (RFC 6296, June 2011).

NATing between IPv6 and IPv4:

• Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (RFC 6146, April 2011)
• Mapping of Address and Port using Translation (MAP-T) (RFC 7599, July 2015)

Delivering a virtual IPv4 link over IPv6:

• Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion (RFC 6333, August 2011)
• 464XLAT: Combination of Stateful and Stateless Translation (RFC 6877, April 2013)
• Mapping of Address and Port with Encapsulation (MAP-E) (RFC 7597, July 2015)

As for firewalls see:

• Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service (RFC 6092, January 2011)
• Thousands of ISP’s are using these RFCs to deliver working IPv4 and IPv6 to their customers today. Often the customer doesn’t even know they are using them.

If you don’t want to do a forklift upgrade deploy routers which support these RFCs as the old ones die and slowly migrate to a IPv6-only IPV4AAS model. Nobody has ever said that forklift upgrades where required.

Seen 2021/09/14 mailing list

Some articles I've been collecting for observability / distributed tracing:

• How to maximize span ingestion while limiting writes per second to Scylla with Jaeger - Jaeger primarily supports two backends: Cassandra and Elasticsearch. Here at Grafana Labs we use Scylla, an open source Cassandra-compatible backend. In this post we’ll look at how we run Scylla at scale and share some techniques to reduce load while ingesting even more spans. We’ll also share some internal metrics about Jaeger load and Scylla backend performance.
• The Cost of Containerization for Your Scylla - There is, however, a performance payoff for the operational convenience of using containers. This is to be expected because of the extra layer of abstraction (the container itself), relaxation on resource isolation, and increased context switches.
• Hacking your way to Observability — Part 3 - A distributed tracing quick start with Jaeger and OpenTelemetry

2021/09/26 - Two different links from two different lists talking about the same thing but differently:

• Five years evolution of open-source distributed tracing - provides temporal context for Hawkular, Zipkin, OpenTracing, Jaeger, OpenTelemetry, Hypertrace, Grafana Tempo and SigNoz
• Observability: The 5-Year Retrospective - how to find answers to unknown-unknowns.

2021/10/28 Hacker News - OpenTelemetry

• OpenTelemetry was OpenCensus, and before that it was OpenTracing
• OpenTelemetry is a collection of tools, APIs, and SDKs. Use it to instrument, generate, collect, and export telemetry data (metrics, logs, and traces) to help you analyze your software’s performance and behavior.
• OpenMetrics relates to the metrics part of OpenTelemetry, where the latter is currently in alpha/experimental phase. OpenTelemetry has a statement on being interoperable with OpenMetrics for both accepting, forwarding and generating in the OpenMetrics format [0]. So they are two separate CNCF projects where OpenMetrics has overlap with a part of OpenTelemetry.

There are some useful pieces of information from a recent twitter thread on 'figuring out how systems are functioning'.

• "Three Pillars" implies some sort of definition. But "metrics, logs and traces" are a random grab bag! Two primitive data storage types (one of which should never be used anymore) and one visualization layer (for third type which isn't named!) -- Charity Majors
• I think the "Three Pillars of Observability" is an odd way to look a things. Pillars, by their nature are related only by what they hold up. Metrics nor tracing, should be pillars. All events should be traced and have metrics attached to them. -- Michael Wilde
• There are no three pillars of observability -- Charity Majors
• You want to know why observability is playing catch up? Because the EVENT is the execution path of your code through the system. It is the correct lens through which to understand your systems from the inside out. Without it, you are toast -- Charity Majors
• The event is the connective tissue for metrics, logs and tracing, because you can derive the first two from events and you can visualize the third from events. But it doesn't go in reverse: you can never work backwards from metrics, logs, and/or traces to get your event back -- Charity Majors
• Context is EVERYTHING in debugging, yet people have been happily discarding it all irretrievably at write time because they were so stuck in the mindset of metrics, logs and traces. This shit matters, man. How we frame it in our brain informs what we build going forward.-- Charity Majors
• A system is observable iff you can determine the behaviour of the system based on its outputs -- Greg Poirier
• Monitoring is the action of observing and checking the behaviior and outputs of a system and its components over time -- Greg Poirier

What hasn't been mentioned is 'high cardinality is king' and helps with context (if not, is the context).

2021/08/24 - Going off on a tangent: Observability: A New Theory Based on the Group of Invariance:

[Reviewed by Bill Satzer, on 10/31/2020 ]

Observability is a critical concept in control theory. Loosely speaking, the state of a system is observable if knowledge of its inputs and outputs during a given time interval permit determination of that state. For linear time-invariant systems, there is a simple criterion for observability: that the observability matrix (conceptually straightforward and easy to compute) should have full rank. For more general systems with all the inputs known there are similar criteria. But for nonlinear systems with unknown inputs, the problem is a good deal harder. This monograph offers a new approach to observability in nonlinear systems, one that was developed by the author.

The primary problem that the theory of observability studies is determining whether an input-output system provides the information necessary to estimate the state. Such information comes from sensors that provide measurements of system inputs and outputs. One way to formulate this problem quantitatively is to ask whether it is possible to determine the initial state of a system given system inputs and outputs over a given time interval.

How to get stats at all of the different points in the stack to track down reasons for dropped packets:

• ethtool -S for h/w and driver
• tc -s for drops by the qdisc
• /proc/net/softnet_stat for drops at the backlog layer
• netstat -s for network and transport layer
• ip -s