\chapter{Network management}
\label{ch:network}

This chapter discusses network management. Section~\ref{sec:configurationmanagement} describes network configuration management. Section~\ref{sec:securitymanagement} studies security management and network elements that are used to secure risky areas of networks. Section~\ref{sec:faultmanagement} studies fault management, including troubleshooting, fault localization, and testing methods. Section~\ref{sec:accountingmanagement} studies accounting management.


\section{Configuration management}
\label{sec:configurationmanagement}

Configuration management means initializing and shutting down parts of a network (for example routers, hubs, and repeaters) and reporting the changes. It is also concerned with maintaining, adding and updating the relationships among components and the status of components during network operation. Network traffic patterns and identified bottlenecks that reduce performance must be understood. Nowadays modern components and subsystems can be configured to support many different applications. The same device can be configured to act either as a router or as an end system node or both. When it is decided how a device is to be used, the appropriate software and a set of attributes and values are chosen for that device~\cite[page 481]{b32}. Reconfiguration may be necessary in case of fault isolation or when the network is expanded.

As the network scales up in physical size (capability and complexity), also the management capabilities must be enlarged. The aim is that these actions could be automated. It should also be possible to make on-line changes without affecting the entire element or network~\cite{b24}. Large-scale network management systems must be constructed to support diverse network elements. They must also be extensible and flexible enough to support new elements and the rapid deployment of new highly customized services.

Activities in network management can be divided into three groups~\cite{b10}:
\begin{itemize}
\item Activities, that do not affect the function of an element, 
\item Activities, that affect the function of an element (for example switching off an element in a subnetwork), and 
\item Activities, that make elements to desired activities (for example restarting an element).  
\end{itemize}

Dynamic updating of configuration needs to be done periodically to ensure that the existing configuration is known. This is essential for fault management as well.

Configuration management tools have reporting components. When network configuration changes, users must be informed about new network elements and resources. Configuration management is well organized when all the gathered information and operations are in statistical form.

There is a risk of spending money on hardware and services that remain underutilized. On the other hand the risk of underprovisioning is that there is loss of productivity which reflects to the service level~\cite{b4}. When the network is designed, it is essential to predict the growth of the network. The network should also be prepared to varying volumes of users.

By continuously addressing the cost of maintenance (Mean Time Between Failure (MTBF) and Mean Time To Repair (MTTR) statistics, costs associated with maintaining) the network as a system can be tuned~\cite{b27}.


\subsection{TCP/IP networks}

TCP/IP networks cause more work for system administrators than other networking systems. Administrators have to manually configure each computer for network use when it is added to the network, or when it is moved from one subnet to another. Each computer must manually be assigned a unique IP address and various configuration parameters must be set.

There is a need for tools that automatically assign addresses and set configuration parameters. Some client/server solutions are already available. Client machines find the details of other hosts on the network using the Domain Naming Systems (DNS) protocols, and can be told their network configuration using Bootstrap (BOOTP) protocol. Static allocation of IP addresses to particular machines can be chosen over dynamic allocation using the Dynamic Host Configuration
Protocol (DHCP)~\cite{rfc2132}.


\section{Security management}
\label{sec:securitymanagement}

Security management covers such areas as detecting, tracking and reporting security violations, and creating, deleting and maintaining security-related services such as encryption, key management, and access control. Distributing passwords and secret keys to bring up systems is also a function of security management~\cite[page 12]{b34}.

As computer-based communications and networks that link open systems continue to expand, security management becomes critical. Nevertheless, standardization of security properties has developed slowly. Security of devices and networks must be compared to possible threats and risks. If the risks are high, the devices and the networks must be provided with more reliable secure properties.

Basic security services that are defined in ITU-T (International Telecommunication Union - Telecommunication standards) Recommendation X.800 are:

\begin{itemize}

\item \textbf{Access control}

The property of controlling network and computer resources in such way that only legitimate users can access them within their limits. One approach is to attach to an object a list which explicitly contains the identity of all permitted users (an Access Control List (ACL))~\cite{rfc2196}. Access control tools are discussed on page~\pageref{subsec:accesscontroltools}.

\item \textbf{Authentication}

The property of knowing that the data received is the same as the data that was sent and that the claimed sender is in fact the actual sender. Several authentication techniques have been developed, for example technologies that provide passwords that are only used once (commonly called one-time passwords), and Kerberos. Kerberos is software designed and developed at Massachusetts Institute of Technology (MIT) to perform distributed authentication in an open network environment.

\item \textbf{Confidentiality}

The property of communicating so that the intended recipients know what was being sent but unintended parties cannot determine what was sent. Encryption is commonly used to provide confidentiality.

\item \textbf{Integrity}

The property of ensuring that data is transmitted from source to destination without undetected alteration. One way to provide integrity is to produce a checksum of the unaltered file, store that checksum offline, and periodically (or when desired) check to make sure the checksum of the online file hasn't changed (which would indicate the data has been modified)~\cite{rfc2196}.

\item \textbf{Non-repudiation}

The property of a receiver being able to prove that the sender of some data did in fact send the data even though the sender might later desire to deny ever having sent that data~\cite{rfc1825}.
\end{itemize}

Effective security management must be involved in all steps of data storage and transfer process. Logs are important security tools and therefore security management is involved with the collection, storage and examination of the audit records and security logs. Increasing the level of network security will affect to the openness of the system and to the cost of maintaining the network.


\subsection{Authentication and authorization}

Almost all applications utilize user information and presume an authentication of users. Authorization is determining whether an identity is permitted to perform some action, such as accessing a resource~\cite{b15}. Passwords, smart cards and certificates are used to authenticate a user. A user may have a right to use more than one name and identities established by multiple organizations (such as universities and scholarly societies). There might be an advantage if all the user information is available in same directory. All the applications could then use the same information. Users have to log in only once to be able to use all the services and resources~\cite{b17}.

There are some basic requirements for authentication~\cite{b15}:
\begin{itemize}
\item Access management solution needs to work at a practical level,
\item The solution needs to be secure
\item It should make access easier, minimizing redundant authentication interactions and providing user-friendly information resources,
\item It needs to scale,
\item It needs to be robust, for example, a forgotten password should not be an intractable problem,
\item It must be able to recognize the need for a user to access a resource independent of his or her physical location (for example, a user must be able to connect to the internet via a commercial ISP, a mobile IP link, or a cable television Internet connection from home), and
\item There should be a simple and well-defined (standard) interface between resource operator and licensing institution.
\end{itemize}

The basic access management problem is licensing agreements for networked information resources. The situations where institutions agree to share limited access are difficult. There is a need for fine-grained access control where institutions want to limit resource access to only individuals registered for a specific class, for example, when a class may be offered to students at multiple institutions. At present, most access to network information resources is not controlled on a fine-grained basis. There is a danger that by accommodating all the needs for fine-grained access management into the basic access management mechanisms will produce a too complex and costly system~\cite{b15}.

Management data represents a problem in the current access framework. The problem is the conflict between private and public data. Most of the data has to be sorted out at the institutional policy level and it may involve making sacrifices in order to ensure privacy. Some institutions may be legally limited in their ability to collect certain management data.

Proxies and credential-based authentication (the user presents a credential to the operator as evidence that he or she is a member of the user community) schemes seem to be viable. Proxy servers will become a focal point for policy debates about privacy, accountability and the collection of management information. Successful operation of a proxy server means that the user trusts the licensee institution to behave responsibly and to respect privacy.

A cross-organizational authentication system based on a credential approach has the advantage of greater transparency. Resource operators can have a higher level of confidence in the access management mechanisms and a greater ability to monitor irregular access patterns. Privacy, accountability and collection of management statistics must be taken up for discussion among a larger group of parties.

An institution might choose to manage access by IP source address. IP source filtering means that packets are filtered on the basis of their source address. It does not seem to be a viable solution for access management. However, it may be very useful for some niche applications, such as supporting public workstations. It could be used more widely, although it cannot support remote users flexibly in its basic form. Most real-world access management systems are going to have to employ multiple approaches and IP source address filtering is likely to be one of them~\cite{b15}.


\subsection{Protocols and programs for network security}

Table~\ref{tab:protocolsandprograms} describes protocols and programs, that are developed to provide security over the Internet. Secure-HTTP (S-HTTP) is an application-level protocol that provides security services across the Internet. It provides confidentiality, authenticity, integrity, and non-repudiability. S-HTTP is limited to the specific software that is implementing it, and it encrypts each message individually~\cite{b30}.

\begin{table}[htb]
\begin{tabular}{|c|c|}\hline
\textbf{Level}			& 	\textbf{Protection Used}\\\hline
Application-level 		&	 S-HTTP, SSH, stelnet, S/MIME\\\hline
Transport-level (TCP, UDP) 	& 	SSL, PCT\\\hline
Network-level (IP) 		& 	IPSEC\\\hline
\end{tabular}
\caption{Protocols and programs developed to provide security over the Internet}
\label{tab:protocolsandprograms}
\end{table}

Secure Shell (SSH) and Secure telnet (stelnet) are programs that allow you to log in to remote systems and using an encrypted connection. SSH uses public-key cryptography to encrypt communications between two hosts, as well as for user authentication.

Secure Multipurpose Internet Mail Extension (S/MIME) is an encryption standard used to encrypt electronic mail, or other types of messages on the Internet. It is an open standard developed by RSA Data Security Inc.

Secure Socket Layer (SSL) is an encryption method developed by Netscape to provide security over the Internet. SSL is a protocol layer that is located between the network layer and applications, so that, in theory, it can be used with any application. However, it is vulnerable to poor application design. It provides data encryption, server authentication, message integrity, and optional client
authentication for a TCP/IP connection~\cite{b30}.

The Private Communication Technology (PCT) protocol is developed by the Microsoft company to be used mainly in their Internet Explorer browser.

IP Security Architecture (IPSEC) provides a standard security mechanism and services to the currently used IP version 4 (IPv4) and to the new IP version 6 (IPv6). IPSEC is less dependent of individual applications than SSL. It provides IP-level encryption by specifying two standard headers: IP Authentication Header (AH) and IP Encapsulating Security Payload (ESP). IP Authentication Header provides strong integrity and authentication. It computes a cryptographic authentication function over the IP datagram and uses a secret authentication key in the computation. IP Encapsulating Security Payload provides integrity and confidentiality for IP datagrams. It encrypts the data to be protected and places it in the data portion of the IP Encapsulating Security Payload.  However, these mechanisms do not provide security against traffic analysis.  Any specific protocol for key management is not provided by the architecture, only requirements for such systems to be used in conjunction are described~\cite{b35}.


\subsection{Simple Network Management Protocol (SNMP)}

The SNMP architecture makes a distinction between message security services (integrity, authentication and encryption) and access control services. Both message security and access control services can be provided by multiple security or access control models. The architecture allows coexistence of multiple models in order to allow future updates, in case the security requirements change or cryptographic protocols need to be replaced~\cite[pages 690--692]{b36}.

The User-based Security Model (USM) provides integrity, authentication and privacy, and is the standard security model currently used with SNMP version 3 (SNMPv3). The View-based Access Control Model (VACM) provides checking whether the users have proper access rights to access one or more objects in a Management Information Base (MIB) and perform operations on these objects. USM is discussed in RFC 2274 and VACM in RFC 2275.


\subsection{Access control tools}
\label{subsec:accesscontroltools}

Hubs, routers and firewalls can be used to limit the access to the networks or the parts of the networks.

\textbf{Hubs} used in LANs are provided with simple security properties. Hubs protect sensitive data on the network by checking destination addresses on each packet and sending readable packets only to authorized nodes. Hubs automatically detect and/or disable unauthorized log-on attempts and record the events at the management station. Hubs also track changes involving users and devices on the network, giving the manager a complete record. These security level operations can be restricted to a date or a time period.

\textbf{Routers} are provided with security properties as well. A router handles packets up through the IP layer. The router forwards each packet based on the packet's destination address, and the route to that destination is indicated in the routing table~\cite{b33}. Routers can improve network security, but also introduce new problems: Routing protocols are susceptible to security attacks, and routing mistakes may allow the entrance of unauthorized personnel into the network. Unlicensed remote and local operations of routers must be prevented by using usernames.

Traffic can be controlled with packet filtration based on the access control lists. On the access control lists it is defined what addresses and protocols to each interface can be routed. Properties such as network address translation (NAT), port address translation (PAT), and logging of events and alerts can be attached to the router. However, it has not been possible to expand the capacity of traditional routers as cost-effectively as the capacity of PC workstations or the network traffic volume~\cite{b12}.

\textbf{Firewall systems} control connections between closed networks and outside world. There are two major approaches used to build firewalls: packet filtering and proxy services. Packet filtering systems route packets between internal and external hosts, but they do it selectively. They allow or block certain types of packets in a way that reflects a site's own security policy. The type of router used in a packet filtering firewall is known as a screening router. 

Proxy services are specialized application or server programs that run on a firewall host: either a dual-homed host with an interface on the internal network and one on the external network, or some other bastion host that has access to the Internet and is accessible from the internal machines. These programs take users' requests for Internet services (such as FTP and Telnet) and forward them, as appropriate according to the site's security policy, to the actual services. The proxies provide replacement connections and act as gateways to the services. For this reason, proxies are sometimes known as application-level gateways~\cite{b57}.

There are three ways to put various firewall components together:

\begin{itemize}
\item{Dual-homed host architecture}

A dual-homed host architecture is built around the dual-homed host computer, a computer that has at least two network interfaces. Such a host could act as a router between the networks these interfaces are attached to; it is capable of routing IP packets from one network to another. Systems inside the firewall can communicate with the dual-homed host, and systems outside the firewall (on the Internet) can communicate with the dual-homed host, but these systems can not communicate directly with each other. IP traffic between them is completely blocked.

The diagram below shows the network architecture for a dual-homed host firewall. The dual homed host sits between, and is connected to, the Internet and the internal network~\cite{b57}.

\begin{figure}[htb]
\caption{Dual-homed host architecture}
\label{fig:firewall_1}
\end{figure}

\item{Screened host architecture}

Whereas a dual-homed host architecture provides services from a host that is attached to multiple networks (but has routing turned off), a screened host architecture provides services from a host that is attached to only the internal network, using a separate router. In this architecture, the primary security is provided by packet filtering. For example, packet filtering is what prevents people from going around proxy servers to make direct connections. The diagram below shows the network architecture for the screened host architecture~\cite{b57}.

\begin{figure}[htb]
\caption{Screened host architecture}
\label{fig:firewall_2}
\end{figure}

\item{Screened subnet architecture}

The screened subnet architecture adds an extra layer of security to the screened host architecture by adding a perimeter network that further isolates the internal network from the Internet. There are two screening routers, each connected to the perimeter net. The perimeter network is another layer of security, an additional network between the external network and the protected internal network. The perimeter net offers an additional layer of protection between attackers and the internal system. One screening router sits between the perimeter net and the internal network, and the other sits between the perimeter net and the external network (usually the Internet). To break into the internal network with this type of architecture, an attacker would have to get past both routers. The diagram below shows the network architecture for the screened subnet architecture~\cite{b57}.

\begin{figure}[htb]
\caption{Screened subnet architecture}
\label{fig:firewall_3}
\end{figure}

\end{itemize}


\subsection{Security problems of Internet}

The list below describes the security problems in the current Internet.

\begin{itemize}
\item \textbf{Weak authentication}

Passwords on the Internet can be cracked by a number of different ways. The two most common methods are cracking the encrypted form of the password, and monitoring communications channels for password packets.

Another problem with authentication results from some TCP or UDP services being able to authenticate only to the granularity of host addresses and not to specific users. For example, an NFS (UDP) server cannot grant access to a specific user on a host, it must grant access to the entire host. The administrator of a server may trust a specific user on a host and wish to grant access to that user, but the administrator has no control over other users on that host and is thus forced to grant access to all users (or grant no access at all).

\item \textbf{Ease of spying/monitoring}

When a user connects to his or her account on a remote host using TELNET or FTP, the user's password travels across the Internet unencrypted. Another method to break into systems is to monitor connections of IP packets bearing a username and password, and then use them to login normally. If an administrator-level password is captured, the job of obtaining privileged access is made much easier.

Electronic mail, as well as the contents of TELNET and FTP sessions, can be monitored and used to learn information about a site and its business transactions. Most users do not encrypt e-mail, yet many assume that e-mail is secure and thus safe for transmitting sensitive information.

The increasingly popular X Window System is also vulnerable to spying and monitoring. The system permits multiple windows to be opened at a workstation. Intruders can sometimes open windows on other systems and read keystrokes that can contain passwords or sensitive information.

\item \textbf{Host-based security does not scale}

Host-based security does not scale well: as the number of hosts at a site increases, the ability to ensure that security is at a high level for each host decreases. Secure management of just one system can be demanding, managing many such systems could easily result in mistakes and omissions. A contributing factor is that the role of system management is often short-changed and performed in haste. As a result, some systems will be less secure than other systems, and these systems could be the weak links that will break the overall security chain~\cite{b40}.
\end{itemize}


\section{Fault management}
\label{sec:faultmanagement}

Physical network problems account more than half of all network problems. Locating the origins of such problems as fiber cut, the earth is incorrect, adapter is broken or incorrectly joined, costs network providers time and money. Network management systems have also traditionally focused on the logical connection between the end user and the network destination, since many network problems have been a result of errors created by software applications~\cite{b24}. Finding and repairing failures of software applications is usually difficult, for example in such a case that the workstation sends but does not receive packets, too many collisions occur or frames are too short or too long.

Fault management is troubleshooting, fault localization, isolation and correction. Today, the process of fault management needs to be automated. Rapid and accurate correction of network problems has to be created by the network or by the end user. Even if the entire network was violated, the network management application should work.

Expert\label{expertsystems} systems provide an efficient and cost effective way of automating network fault management. By automating fault management, problems and possible diagnosis can be done faster and more efficiently. However, real-time performance represents a problem for expert systems~\cite{b8}. Bounds on response times are difficult to establish. There are also risks pushing the limits of automation through the introduction of new or only partially proven technologies.


\subsection{Transferring information}

There are two mechanisms of transferring network management information from a managed entity to a manager: \textbf{polling} and \textbf{sending alerts} (messages are initiated by managed network elements). Advantages and disadvantages exist within both methods. Most network management systems use an optimal combination of alerts and polling in order to maintain advantages of each and eliminate disadvantages of pure polling~\cite{rfc1224}.

Most systems poll the managed objects, search for error conditions and illustrate the problem in graphical format or as a textual message. Disadvantages of polling are the response time of problem detection and the increased volume of network management traffic. Having to poll many management information base (MIB) variables per machine on a large number of machines is itself a problem. The ability to monitor such a system is limited. Polling many objects on many machines increases the amount of network management traffic flowing across the network. It is possible to minimize this through the use of hierarchies (polling a machine for a general status of all the machines it polls). Anyway, the response time will be a problem~\cite{rfc1224}.

If a system fails shortly after being polled, there may be a significant delay before it is polled again. During this time, the manager must assume that a failing system is acceptable. While improving the mean time to detect failures, it might not greatly improve the time to correct the failure. The problem will generally not be repaired until it is detected.

There are problems attached also to the second method, sending alerts: There is a possibility to lose of critical information and to over-inform the manager. An ideal management system would generate alerts to notify its management station of error conditions. However, alerts cannot usually be delivered when the managed entity fails or the network experiences problems. It is important to remember that failing machines and networks can not be trusted to inform a manager that they are failing. The manager should periodically poll to ensure connectivity to remote stations, and to get copies of alerts that were not delivered by the network~\cite{rfc1224}.

Alerts in a failing system can be generated so rapidly that they impact functioning resources. An "open loop" system in which the flow of alerts to a manager is fully asynchronous can result in an excess of alerts being delivered. There may be a situation where all available network bandwidth into the manager is saturated with incoming alerts, thus preventing the manager from disabling the mechanism generating the alerts. Methods are needed to limit the volume of alert transmission and to assist in delivering a minimum amount of information to a manager. Alarm correlation is done by filtering secondary alarms, e.g. using expert systems\footnote{Expert systems are discussed briefly on page~\pageref{expertsystems}}.

Many management tools also \textbf{log} events with different formats and different sources. These events should later be correlated using time stamp to identify the source of the problem. Also topology information is needed to identify the precise location of the problem.

Many devices have buffers reserved for logs.  When a buffer becomes full, new logs are written over the oldest ones. If the buffer becomes full quickly, some important logs may disappear before they are noticed.  Buffers also consume disk space that could be used for other purposes.

\subsection{Troubleshooting and fault localization}

Several diagnostic tools are used for troubleshooting and fault localization purposes. These include ifconfig, arp, netstat, ping, nslookup, dig, ripquery, traceroute, and etherfind~\cite[pages 260--262]{b33}.

\textbf{The packet inter net groper (ping)} tests whether a remote host can be reached. It sends an internet control message protocol (ICMP) loopback request packet to a target IP address. The receiver accepts the loopback request and issues a loopback response to the initiator of the Ping command. It cannot be determined with echo-response which one of the possible routes is violated, because loopback request and loopback response may use different routes. Ping can only be used to determine whether the target IP-address is available or not. Another usage of ping is to measure the response times of different packet sizes~\cite[page 33]{b4}.

Unlike ping, \textbf{traceroute} forces every router to send back an ICMP-control message. Most Traceroute applications send a sequence of User Datagram Protocol (UDP)-packets to a randomly selected UDP-port~\cite{b2}. Sometimes the firewalls filter these packets from the main traffic, in which case the tracing ends.

After detecting a fault, operators should as soon as possible find the root cause of the problem. Clearly defining the problem helps to isolate the root cause from symptoms~\cite{b22}. Operators must also determine what troubles it causes and to whom.

At first it is useful to find the parts of the network, where the fault can not be, by eliminating processes. These parts can be neglected. If the problem is very serious and difficult, the network can be divided into smaller parts to be inspected one by one. Connectivity tests are also used to find the violated devices. At the same time it can be detected whether the fault is local or widespread. By testing the data integrity it can be found out if a part of the packets are lost by transmission. Delays are also to be tested, because some faults result from excessive delays~\cite{b2}.


\subsection{Testing}

\textbf{Measuring the accessibility} of devices helps us to collect information about the status of the network. In general, some points are selected to measure connections. Measurements are done by a control device. After measurements, the results are interpreted.

Measuring the accessibility is not a complete method. For example, controlling only routers is not enough. If the router has been set up so that it gives preference to packet switching, it will send packets normally even if it is heavily loaded and perhaps can not answer to messages of the controlling device. Another example is that two devices that can be reached might not have a connection with each other.

Another method of testing is to \textbf{control routing tables}. Routing should change only when the topology of the network changes. If there are changes at other times, there is probably
something wrong with the network.

Routing tables express the topology of the network. Finding out the network topology from routing tables is more difficult than controlling accessibility~\cite{b2}. In order to get information from routing tables of routers, routers must be Simple network management protocol (SNMP) compatible, dynamic routing tables must support sending request or routing information must be tapped from a routing protocol. These requirements are not necessarily realized although SNMP is a commonly used protocol. Analysis of the routing tables can concentrate on the parts of the network which are most susceptible to failures.


\section{Accounting management}
\label{sec:accountingmanagement}

Accounting management deals with information that concerns individual users, including following issues:
\begin{itemize}

\item \textbf{Usage measurement}

Usage measurement is collecting data for charging, and processing the data. It has to be reliable, and sometimes it has to be done in real time.

\item \textbf{Tariffing/pricing}

A tariff is a set of data used to determine the charges for services used. It depends on the service, origination and destination, tariff period, and day.

\item \textbf{Collections and finance}

This includes administration of customer accounts, informing customers, payment dates, payment amount, and collection of payments.

\item \textbf{Enterprise control}

Enterprise control is responsible for proper financial management of an enterprise. It includes identifying and ensuring financial accountability of officers. Also checks and balances needed for financial operation of an enterprise are included~\cite[pages 64--66]{b34}.
\end{itemize}

A system, which generates data for accounting purposes, is called an accounting management agent. Accounting managers are systems, which interrogate accounting management data or obtain it in other ways. If accounting management is distributed across various systems, all systems may be required to control their own area themselves. Furthermore, a system may request information from other systems in order to square its accounts~\cite[pages 188--189]{b42}.

Accounting data is sensitive information. The collector must provide confidentiality at the point of collection, through transmission and up to the point where the data is delivered. The delivery function may also require authentication of the origin and the destination and provision for connection integrity (if connections are utilized). Security services can be provided for example by SNMPv3\footnote{See section~\ref{sec:snmp} for Simple Network Management Protocol (SNMP).}.


\subsection{Internet pricing}

Internet pricing contains four basic elements (see figure~\ref{fig:pricing}). An access-fee is usually a monthly charge for using an access link of the network. The price depends on the capacity of the link. Setting up connections or making reservations can be charged separately. Usage-fee can be used to charge services on time-, volume-, or QoS-basis. This fee determines the actual resource usage of a customer. Content-fee depends on the application content. It may be omitted (e.g., telephony, fax, e-mail services where the content is provided by the user), billed separately (e.g., Helsingin Sanomat on-line edition), or integrated into the telecommunications charging system (e.g., commercial 0900 numbers in Finland)~\cite{b47}.

\begin{figure}[htb]
\begin{center}
\epsfxsize.5\textwidth
\epsfbox{kuvat/pricing}
\caption{Components of Internet pricing~\cite{b47}}
\label{fig:pricing}
\end{center}
\end{figure}

The current pricing model is based on an assumption of a single best-effort service model that provides similar service to all customers. Service provider and customer do not have a direct control over the actual service in terms of parameters determining volume, connection time\footnote{Connection time for connectionless communications would be difficult to measure (except for dialup access).}, and QoS.

Accounting is usually based on mechanisms offered by commercially available routers and switches. The most commonly used approach employs packet filtering and statistical sampling. However, it is difficult to charge for usage-based traffic since the granularity of these methods is too coarse and the measurement overhead significant~\cite{b47}.

Another problem concerning accounting data collection in routers is whether packets should be counted on entry to or on exit from a router\footnote{The nature of IP is that not every packet received by a router is actually passed to an output port, but can be discarded for example at times of congestion.}~\cite{rfc1272}.

For volume measurements the IETF Real-time Traffic Flow Measurement (rtfm) working group has proposed standards to meter flows and to distribute this accounting information via SNMP~\cite{b47}.

The Remote Authentication Dial-In User Service (RADIUS) is a protocol specified by the IETF radius working group. It helps managing the Internet access links. Since these links are sensitive to security and accounting, a protocol is provided to authenticate dial-in users and negotiate configuration data. RADIUS services are implemented by most router manufactures. Accounting data can be collected on a time-, packet-, or octet-basis for a particular service~\cite{b47}.

