Network Traffic Invariant Characteristics: Metering Aspects

International Journal of Business & Technology

With the rapid increase demand for data usage, Internet has become complex and harder to analyze. Characterizing the Internet traffic might reveal information that are important for Network Operators to formulate policy decisions, develop techniques to detect network anomalies, help better provision network resources (capacity, buffers) and use workload characteristics for simulations (typical packet sizes, flow durations, common protocols). In this paper, using passive monitoring and measurements, we show collected data traffic at Internet backbone routers. First, we reveal main observations on patterns and characteristics of this dataset including packet sizes, traffic volume for inter and intra domain and protocol composition. Second, we further investigate independence structure of packet size arrivals using both visual and computational statistics. Finally, we show the temporal behavior of most active destination IP and Port addresses.

2004

Analysing and modeling of traffic play a vital role in designing and controlling of networks effectively. To construct a practical traffic model that can be used for various networks, it is necessary to characterize aggregated traffic and user traffic. This paper investigates these characteristics and their relationship. Our analyses are based on a huge number of packet traces from five different networks on the Internet. We found that: marginal distributions of aggregated traffic fluctuations follow positively skewed (non-Gaussian) distributions, which leads to the existence of "spikes", where spikes correspond to an extremely large value of momentary throughput, (2) the amount of user traffic in a unit of time has a wide range of variability, and (3) flows within spikes are more likely to be "elephant flows", where an elephant flow is an IP flow with a high volume of traffic. These findings are useful in constructing a practical and realistic Internet traffic model.

Proceedings of the IEEE, 2002

One of the most significant findings of traffic measurement studies over the last decade has been the observed self-similarity in packet network traffic. Subsequent research has focused on the origins of this self-similarity, and the network engineering significance of this phenomenon. This paper reviews what is currently known about network traffic self-similarity and its significance. We then consider a matter of current research, namely, the manner in which network dynamics (specifically, the dynamics of transmission control protocol (TCP), the predominant transport protocol used in today's Internet) can affect the observed self-similarity. To this end, we first discuss some of the pitfalls associated with applying traditional performance evaluation techniques to highly-interacting, large-scale networks such as the Internet. We then present one promising approach based on chaotic maps to capture and model the dynamics of TCP-type feedback control in such networks. Not only can appropriately chosen chaotic map models capture a range of realistic source characteristics, but by coupling these to network state equations, one can study the effects of network dynamics on the observed scaling behavior. We consider several aspects of TCP feedback, and illustrate by examples that while TCP-type feedback can modify the self-similar scaling behavior of network traffic, it neither generates it nor eliminates it.

Local Computer Networks, 1999. LCN'99. …, 1999

A statistical analysis of Internet traffic measurements from a campus site is carried out to examine the influence of the constituent protocols and applications on the characteristics of the aggregate stream and on packet loss statistics. While TCP remains the dominant traffic protocol through all hours of the day, a mixture of both well-known (http, ftp, nntp and smtp) and less known applications contribute significant portions to the TCP traffic mix. Statistical tests show that the aggregate TCP packet arrival process exhibits both non-stationary and nonlinear features. By filtering a subset of the applications found to exhibit non-stationary features from the aggregate process, a stationary traffic stream is derived. This filtered traffic process is modeled using nonlinear threshold autoregressive processes. The traffic model is shown to provide good agreement with the measurement trace in the packet loss statistics. The proposed parametric model allows the design of traffic shapers and provides a simple and accurate approach for simulating Internet data traffic patterns.

Computer Networks, 2002

The statistical characteristics of network traffic -in particular the observation that it can exhibit long range dependence -have received considerable attention from the research community over the past few years. In addition, the recent claims that the TCP protocol can generate traffic with long rage dependent behavior has also received much attention. Contrary to the latter claims, in this paper we show that the TCP protocol can generate traffic with correlation structures that spans only an analytically predictable finite range of time-scales. We identify and analyze separately the two mechanisms within TCP that are responsible for this scaling behavior: timeouts and congestion avoidance. We provide analytical models for both mechanisms which, under the proper loss probabilities, accurately predicts the range in time-scales and the strength of the sustained correlation structure of the sending rate of TCP traffic. We also analyze an existing comprehensive model of TCP that accounts for both mechanisms and show that TCP itself exhibits a predictable finite range of time-scales under which traffic presents sustained correlations. Our claims and results are derived from analytical Markovian models that are supported by simulations. We note that traffic generated by TCP can be misinterpreted to have long range dependence, but that long range dependence is not possible due to inherent finite time-scales of the mechanisms of TCP.

International Computer Engineering Conference, 2010

This paper attempts to characterize and model backbone network traffic, using a small number of statistics. In order to reduce cost and processing power associated with traffic analysis. The parameters affecting the behavior of network traffic are investigated and the choice is that inter-arrival time, IP addresses, port numbers and transport protocol are the only necessary parameters to model network

Computer Networks, 2000

Traditional Poisson or Markovian tra c models have been proven, by several studies, inappropriate for predicting the performance of networks with long{range dependent tra c. Thus, the use of conventional call admission control algorithms based on short{range dependent models cannot achieve the quality of service required by self{similar sources, since network performance is actually worse in terms of bu er over ow probability and delay. The variety of tra c types that depict long{range dependence creates the need for new models suitable for network design and congestion control mechanisms. In this paper, we present a Call Admission Control (CAC) scheme for tra c with self{similar behaviour based on the notion of e ective bandwidth. Our solution satis es the quality of service requirements of the source, expressed in terms of bu er over ow probability, while taking into account the long{range dependence property of the tra c through the Hurst parameter. We base our CAC mechanism on a Gaussian model initially studied by I. Norros. We show that this model performs well in the case of one source as well as in the case of many aggregated sources. Our scheme assumes homogenous sources, each one represented by a Fractional Gaussian Noise process characterised by the mean bit rate and the self{similarity parameters (H, ). We study the estimation of (H, ) from the real tra c and show the connection between their estimates. Finally, we present a way to calculate the equivalent capacity, which is necessary so that the aggregated stream will achieve the desired loss rate. In our simulation experiments, we used data collected from an IP over ATM high{speed link, connecting the National Research Network of Greece (GRnet) to the Trans{European Network backbone (TEN{34), a part of the global Internet.

IEEE Global Telecommunications Conference, 2004. GLOBECOM '04.

In this paper we present an Internet aggregate traffic analysis at the flow level, in both spatial and temporal dimensions. The data traces were collected from CTBC Telecom (a Brazilian Telecommunication Company) IP backbone routers in three notable periods: the hour of the highest, medium and lowest traffic intensity. The spatial analysis focuses on the participation of the different transport protocols and on the main applications in the overall traffic. The temporal analysis is focused on TCP and UDP traffic and deals with the main Internet traffic issues as the arrival process, the first and second moments of the traffic, and the self-similarity. To do so, we considered the dynamics of the Internet traffic using a methodology that applies the Poisson shot-noise process. This analysis suggests that, when a NSP is planning to deploy QoS or traffic engineering on its Internet backbone, it must pay attention to the differences between the traffic profiles at flow and octet levels.

Computer Communications, 2010

A new method of estimating some statistical characteristics of TCP flows in the Internet is developed in this paper. For this purpose, a new set of random variables (referred to as observables) is defined. When dealing with sampled traffic, these observables can easily be computed from sampled data. By adopting a convenient mouse/elephant dichotomy also dependent on traffic, it is shown how these variables give a reliable statistical representation of the number of packets transmitted by large flows during successive time intervals with an appropriate duration. A mathematical framework is developed to estimate the accuracy of the method. As an application, it is shown how one can estimate the number of large TCP flows when only sampled traffic is available. The algorithm proposed is tested against experimental data collected from different types of IP networks.

2004

The last decade has been a very fruitful period in important discoveries in network traffic modeling, uncovering various scaling behaviors. Self-similarity, long-range dependence, multifractal behavior and finally cascades have been studied and convincingly matched to real traffic. The first purpose of this paper is to provide a methodology to go beyond the naive analysis of the second-order wavelet-based estimators of scaling, by performing non-stationarity checks and relying on the information contained in the high-order properties of the wavelet coefficients. Then, we apply this methodology to study the scaling properties of the TCP flow arrivals based on several traffic traces spanning the years from 1993 to early 2002. Our study reveals that the second-order scaling properties of this process describe its dynamics quite well. However, our analysis also provides evidence that high-order scaling in this process appears due to pathological behaviors like rate limitation and nonstationarity.