Connection-level analysis and modeling of network traffic

ABSTRACT

Most network traffic analysis and modeling studies lump all connections together into a single flow. Such aggregate traffic typically exhibits long-range-dependent (LRD) correlations and non-Gaussian marginal distributions. Importantly, in a typical aggregate traffic model, traffic bursts arise from many connections being active simultaneously. In this paper, we develop a new framework for analyzing and modeling network traffic that moves beyond aggregation by incorporating connection-level information. A careful study of many traffic traces acquired in different networking situations reveals (in opposition to the aggregate modeling ideal) that traffic bursts typically arise from just a few high-volume connections that dominate all others. We term such dominating connections alpha traffic. Alpha traffic is caused by large file transmissions over high bandwidth links and is extremely bursty (non-Gaussian). Stripping the alpha traffic from an aggregate trace leaves a beta traffic residual that is Gaussian, LRD, and shares the same fractal scaling exponent as the aggregate traffic. Beta traffic is caused by both small and large file transmissions over low bandwidth links. In our alpha/beta traffic model, the heterogeneity of the network resources give rise to burstiness and heavy-tailed connection durations give rise to LRD. Queuing experiments suggest that the alpha component dictates the tail queue behavior for large queue sizes, whereas the beta component controls the tail queue behavior for small queue sizes.

REFERENCES

• 1: Will E. Leland , Murad S. Taqqu , Walter Willinger , Daniel V. Wilson, On the self-similar nature of Ethernet traffic (extended version), IEEE/ACM Transactions on Networking (TON), v.2 n.1, p.1-15, Feb. 1994 [doi>10.1109/90.282603]
• 2: R. H. Riedi, M. S. Crouse, V. Ribiero, and R. G. Baraniuk, "A multifractal wavelet model with application to TCP network traffic," IEEE Trans. Inform. Theory, vol. 45, no. 3, pp. 992-1018, April 1999.
• 3: Ashok Erramilli , Onuttom Narayan , Walter Willinger, Experimental queueing analysis with long-range dependent packet traffic, IEEE/ACM Transactions on Networking (TON), v.4 n.2, p.209-223, April 1996 [doi>10.1109/90.491008]
• 4: F. Brichet, J. Roberts, A. Simonian, and D. Veitch, "Heavy traffic analysis of a fluid queue fed by a superposition of ON/OFF sources," COST, vol. 242, 1994.
• 5: M. Taqqu and J. Levy, Using renewal processes to generate LRD and high variability. In: Progress in probability and statistics, E. Eberlein and M. Taqqu eds., vol. 11, Birkhaeuser, Boston, 1986, pp 73389.
• 6: Mark E. Crovella , Azer Bestavros, Self-similarity in World Wide Web traffic: evidence and possible causes, IEEE/ACM Transactions on Networking (TON), v.5 n.6, p.835-846, Dec. 1997 [doi>10.1109/90.650143]
• 7: Walter Willinger , Murad S. Taqqu , Robert Sherman , Daniel V. Wilson, Self-similarity through high-variability: statistical analysis of Ethernet LAN traffic at the source level, IEEE/ACM Transactions on Networking (TON), v.5 n.1, p.71-86, Feb. 1997 [doi>10.1109/90.554723]
• 8: A. Feldmann , A. C. Gilbert , W. Willinger, Data networks as cascades: investigating the multifractal nature of Internet WAN traffic, Proceedings of the ACM SIGCOMM '98 conference on Applications, technologies, architectures, and protocols for computer communication, p.42-55, August 31-September 04, 1998, Vancouver, British Columbia, Canada
• 9: NLANR, "Auckland-II trace archive," http://moat.nlanr.net/Traces/Kiwitraces, 2000.
• 10: S. Sarvotham, R. Riedi, and R. Baraniuk, "Connection-level analysis and modeling of network traffic," Tech. Rep., ECE Dept., Rice Univ., July 2001.
• 11: LBL, "Internet traffic archive," http://ita.ee.lbl.gov/html/traces.html.
• 12: K. Fall and K. Varadhan, "ns notes and documentation," http://www-mash.cs.berkeley.edu/ns, 2000.
• 13: S. McCane and S. Floyd, "ns- network simulator," http://wwwmash.cs.berkeley.edu/ns.
• 14: J. Levy Vehel and R. Riedi, "Fractional Brownian motion and data traffic modeling: The other end of the spectrum," Fractals in Engineering, pp. 185-202, Springer 1997.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations
          Subjects: Network monitoring

Additional Classification:
  C. Computer Systems Organization
  C.4 PERFORMANCE OF SYSTEMS
      Subjects: Performance attributes

General Terms:
Performance

Keywords:
animal kingdom, network traffic modeling