Study of Bursty Internet Traffic (original) (raw)

Empirical modeling of Internet traffic at middle-level burstiness

Proceedings of the 12th IEEE Mediterranean Electrotechnical Conference (IEEE Cat. No.04CH37521), 2004

In this paper we use empirical data from Internet traffic measurements. Collected measurements are analyzed for different protocols, such as TCP and UDP. We perform statistical analysis through the correlation coefficients, covariance, and self-similarity degree i.e. Hurst parameter. Our experimental studies captured traffic with Hurst parameter around 0.7-0.75, which is near half way between values of 0.5 (it is not a self-similar) and 1 (strong selfsimilar properties). We use Maximum Likelihood approach to fit the obtained time series to existing distributions, such as Pareto and exponential distribution, where the first one is a self-similar process and the second is not. The analysis pointed out that Internet traffic with such values for the Hurst parameter could be modeled with similar accuracy using both Pareto and exponential distribution.

Using LiTGen, a realistic IP traffic model, to evaluate the impact of burstiness on performance

2008

For practical reasons, network simulators have to be designed on traffic models as realistic as possible. This paper presents the evaluation of LiTGen, a realistic IP traffic model, for the generation of IP traffic with accurate time scale properties and performance. We confront LiTGen against real data traces 1 using two methods of evaluation. These methods respectively allow to observe the causes and consequences of the traffic burstiness. Using a wavelet spectrum analysis, we first highlight the intrinsic characteristics of the traffic and show LiTGen's ability to reproduce accurately the captured traffic correlation structures over a wide range of timescales. Then, a performance analysis based on simulations quantifies the impact of these characteristics on a simple queuing system, and demonstrates LiTGen's ability to generate synthetic traffic leading to realistic performance. Finally, we conduct an investigation for a possible model reduction using memoryless assumptions.

Why is the Internet Traffic Bursty in Short Time Scales

Internet traffic exhibits multifaceted burstiness and correlation structure over a wide span of time scales. Previous work analyzed this structure in terms of heavy-tailed session characteristics, as well as TCP timeouts and congestion avoidance, in relatively long time scales. We focus on shorter scales, typically less than 100-1000 milliseconds. Our objective is to identify the actual mechanisms that are responsible for creating bursty traffic in those scales. We show that TCP self-clocking, joint with queueing in the network, can shape the packet interarrivals of a TCP connection in a two-level ON-OFF pattern. This structure creates strong correlations and burstiness in time scales that extend up to the Round-Trip Time (RTT) of the connection. This effect is more important for bulk transfers that have a large bandwidth-delay product relative to their window size. Also, the aggregation of many flows, without rescaling their packet interarrivals, does not converge to a Poisson stream, as one might expect from classical superposition results. Instead, the burstiness in those scales can be significantly reduced by TCP pacing. In particular, we focus on the importance of the minimum pacing timer, and show that a 10-millisecond timer would be too coarse for removing short-scale traffic burstiness, while a 1-millisecond timer would be sufficient to make the traffic almost as smooth as a Poisson stream in sub-RTT scales.

Burstiness predictions based on rough network traffic measurements

Magnetic Resonance in Chemistry, 2004

To dimension network links, such that they will not become QoS bottlenecks, the peak rate on these links should be known. To measure these peaks on sufficiently small time scales, special measurement tools are needed. Such tools can be quite expensive and complex. Therefore network operators often rely on more cheap, standard tools, like MRTG, which were designed to measure average traffic rates (m) on time scales such as 5 minutes. For estimating the peak traffic rate (p), operators often use simple rules, such as p = α · m. In this paper we describe measurements that we have performed to investigate how well this rule describes the relation between peak and average traffic rate. In addition, we propose some more advanced rules, and compare these to the simple rule mentioned above. The analyses of our measurements, which have been performed on different kinds of networks, show that our advanced rules more adequately describe the relation between peak and average traffic rate.

On the characteristics of internet traffic variability: Spikes and Elephants

2004

Analysing and modeling of traffic play a vital role in designing and controlling of networks effectively. To construct a practical traffic model that can be used for various networks, it is necessary to characterize aggregated traffic and user traffic. This paper investigates these characteristics and their relationship. Our analyses are based on a huge number of packet traces from five different networks on the Internet. We found that: marginal distributions of aggregated traffic fluctuations follow positively skewed (non-Gaussian) distributions, which leads to the existence of "spikes", where spikes correspond to an extremely large value of momentary throughput, (2) the amount of user traffic in a unit of time has a wide range of variability, and (3) flows within spikes are more likely to be "elephant flows", where an elephant flow is an IP flow with a high volume of traffic. These findings are useful in constructing a practical and realistic Internet traffic model.

Internet Traffic Tends Toward Poisson and Independent as the Load Increases

Lecture Notes in Statistics, 2003

Network devices put packets on an Internet link, and multiplex, or superpose, the packets from different active connections. Extensive empirical and theoretical studies of packet traffic variables-arrivals, sizes, and packet counts-demonstrate that the number of active connections has a dramatic effect on traffic characteristics. At low connection loads on an uncongested link-that is, with little or no queueing on the link-input router-the traffic variables are long-range dependent, creating burstiness: large variation in the traffic bit rate. As the load increases, the laws of superposition of marked point processes push the arrivals toward Poisson, the sizes toward independence, and reduces the variability of the counts relative to the mean. This begins a reduction in the burstiness; in network parlance, there are multiplexing gains. Once the connection load is sufficiently large, the network begins pushing back on the attraction to Poisson and independence by causing queueing on the link-input router. But if the link speed is high enough, the traffic can get quite close to Poisson and independence before the push-back begins in force; while some of the statistical properties are changed in this high-speed case, the push-back does not resurrect the burstiness. These results reverse the commonly-held presumption that Internet traffic is everywhere bursty and that multiplexing gains do not occur. Very simple statistical time series models-fractional sum-difference (FSD) models-describe the statistical variability of the traffic variables and their change toward Poisson and independence before significant queueing sets in, and can be used to generate open-loop packet arrivals and sizes for simulation studies. Both science and engineering are affected. The magnitude of multiplexing needs to become part of the fundamental scientific framework that guides the study of Internet traffic. The engineering of Internet devices and Internet networks needs to reflect the multiplexing gains. I. ARE THERE MULTIPLEXING GAINS? When two hosts communicate over the Internetfor example, when a PC and a Web server communicate for the purpose of sending a Web page from the server to the PC-the two hosts set up a connection. One or more files are broken up into pieces, headers are added to the pieces to form packets, and the two This paper is to be published in Nonlinear Estimation and Classification, eds.

Internet traffic modeling and future technology implications

2003

This paper presents the Poisson Pareto burst process (PPBP) as a simple but accurate model for Internet traffic. It presents formulae relating the parameters of the PPBP to measurable traffic statistics, and describes a technique for fitting the PPBP to a given traffic stream. The PPBP is shown to accurately predict the queueing performance of a sample trace of aggregated Internet traffic. We predict that in few years, natural growth and statistical multiplexing will lead to an efficient optical Internet.

A Traffic Engineering-QoS Approach to the Traffic Burstiness in Short-Time Scales

International Conference on Networking, International Conference on Systems and International Conference on Mobile Communications and Learning Technologies (ICNICONSMCL'06), 2006

The phenomenon of traffic burstiness is a big challenge in the switching equipments of the core of computer network, because it leads to more delay and jitter to be tolerated by users. Therefore, we should use all of the available facilities to improve the traffic behavior. In this paper, we present an idea based on delay management and QoS considerations to decrease the variances in short-time scales. Using our approach the impact of short-term burstiness will be decreased. Also, this idea can be implemented in MPLS ingress nodes or by delay management of paths in MPLS traffic engineering when we have congestion in the network.

Long-range dependence in a changing Internet traffic mix

Computer Networks, 2005

This paper provides a deep analysis of long-range dependence in a continually evolving Internet traffic mix by employing a number of recently developed statistical methods. Our study considers time-of-day, day-of-week, and cross-year variations in the traffic on an Internet link. Surprisingly large and consistent differences in the packet-count time series were observed between data from 2002 and 2003. A careful examination, based on stratifying the data according to protocol, revealed that the large difference was driven by a single UDP application that was not present in 2002. Another result was that the observed large differences between the two years showed up only in packet-count time series, and not in byte counts (while conventional wisdom suggests that these should be similar). We also found and analyzed several of the time series that exhibited more "bursty" characteristics than could be modeled as Fractional Gaussian Noise. The paper also shows how modern statistical tools can be used to study long-range dependence and non-stationarity in Internet traffic data.