A tool for RApid model parameterization and its applications

ABSTRACT

The utility of simulations and analysis heavily relies on good models of network traffic. However, it is difficult to model and simulate the Internet traffic because of the network's great heterogeneity and rapid change. The statistical properties of Internet traffic not only constantly change over time but also vary in other dimensions such as locations and directions. Previously we have developed a tool RAMP that supports rapid parameterization of traffic models from live network measurements. In this paper, we first extend RAMP to support near-real-time trace-driven simulation. Next, we demonstrate the applications of RAMP via three case studies: generation of realistic traffic model for simulation, generation of high bandwidth synthetic network traces, and analysis and modeling of malicious traffic. Finally, we discuss some lessons we learned from using RAMP for traffic modeling.

REFERENCES

• 1: Sally Floyd , Vern Paxson, Difficulties in simulating the internet, IEEE/ACM Transactions on Networking (TON), v.9 n.4, p.392-403, August 2001 [doi>10.1109/90.944338]
• 2: Kun-Chan Lan , John Heidemann, Rapid model parameterization from traffic measurements, ACM Transactions on Modeling and Computer Simulation (TOMACS), v.12 n.3, p.201-229, July 2002 [doi>10.1145/643114.643117]
• 3: V. Paxson, "Internet Traffic Archive, http://www.acm.org/sigcomm/ita/," 2000. {Online}. Available: http://www.acm.org/sigcomm/ITA/
• 4: P. Abry and D. Veitch, "Wavelet analysis of long-range-dependent traffic," IEEE Transactions on Information Theory, vol. 44, no. 1, pp. 2--15, 1998. {Online}. Available: citeseer.nj.nec.com/abry98wavelet.html
• 5: Anja Feldmann , Anna C. Gilbert , Polly Huang , Walter Willinger, Dynamics of IP traffic: a study of the role of variability and the impact of control, Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication, p.301-313, August 30-September 03, 1999, Cambridge, Massachusetts, United States
• 6: Polly Huang , Anja Feldmann , Walter Willinger, A non-instrusive, wavelet-based approach to detecting network performance problems, Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, November 01-02, 2001, San Francisco, California, USA [doi>10.1145/505202.505229]
• 7: F. J. Massey, "The kolmogorov-smirnov test of goodness of fit," Journal of the American Statistical Association, vol. 46, no. 253, pp. 68--78, Mar. 1951.
• 8: Walter Willinger , Vern Paxson , Murad S. Taqqu, Self-similarity and heavy tails: structural modeling of network traffic, A practical guide to heavy tails: statistical techniques and applications, Birkhauser Boston Inc., Cambridge, MA, 1998
• 9: Bruce A. Mah, An Empirical Model of HTTP Network Traffic, Proceedings of the INFOCOM '97. Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Driving the Information Revolution, p.592, April 09-11, 1997
• 10: Paul Barford , Mark Crovella, Generating representative Web workloads for network and server performance evaluation, Proceedings of the 1998 ACM SIGMETRICS joint international conference on Measurement and modeling of computer systems, p.151-160, June 22-26, 1998, Madison, Wisconsin, United States
• 11: Mark E. Crovella , Azer Bestavros, Self-similarity in World Wide Web traffic: evidence and possible causes, Proceedings of the 1996 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, p.160-169, May 23-26, 1996, Philadelphia, Pennsylvania, United States
• 12: F. Donelson Smith , Félix Hernández Campos , Kevin Jeffay , David Ott, What TCP/IP protocol headers can tell us about the web, Proceedings of the 2001 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, p.245-256, June 2001, Cambridge, Massachusetts, United States
• 13: Bruce A. Mah , Peter Sholander , Luis Martinez , Lawrence Tolendino, IPB: An Internet Protocol Benchmark Using Simulated Traffic, Proceedings of the 6th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems, p.77, July 19-24, 1998
• 14: M. Yuksel, B. Sikdar, K. S. Vastola, and B. Szymanski, "Workload generation for ns simulations of wide area net works and the internet," in Proceedings of Communication Networks and Distributed Systems Modeling and Simulation Conference (CNDS) part of Western Multi-Conference (WMC), San Diego, CA, 2000, pp. 93--98. {Online}. Available: http://www.cs.rpi.edu/~yuksem/
• 15: Lee Breslau , Deborah Estrin , Kevin Fall , Sally Floyd , John Heidemann , Ahmed Helmy , Polly Huang , Steven McCanne , Kannan Varadhan , Ya Xu , Haobo Yu, Advances in Network Simulation, Computer, v.33 n.5, p.59-67, May 2000 [doi>10.1109/2.841785]
• 16: Vern Edward Paxson, Measurements and analysis of end-to-end Internet dynamics, University of California at Berkeley, Berkeley, CA, 1998
• 17: K. Lai and M. Baker, "Measuring bandwidth," in INFOCOM (1), 1999, pp. 235--245. {Online}. Available: http://gunpowder.stanford.edu/~laik/projects/nettimer/
• 18: K. Lai and M. Baker, "Nettimer: A tool for measuring bottleneck link bandwidth," in Proceedings of the USENIX Symposium on Internet Technologies and Systems, Mar. 2001. {Online}. Available: http://gunpowder.stanford.edu/~laik/projects/nettimer/
• 19: N. Brownlee and kc claffy, "Understanding internet traffic streams: Dragonflies and tortoises," IEEE Communication, 2002. {Online}. Available: http://www.caida.org/outreach/papers/2002/Dragonflies/
• 20: P. Kamath , K. Lan , J. Heidemann , J. Bannister , J. Touch, Generation of High Bandwidth Network Traffic Traces, Proceedings of the 10th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems (MASCOTS'02), p.401, October 11-16, 2002
• 21: K. Lan, A. Hussain, and D. Dutta, "Effect of malicious traffic on the network," in PAM 2003, San Diego, CA, April 2003. {Online}. Available: http://www.isi.edu/~kclan/research.html
• 22: Gianluca Iannaccone , Christophe Diot , Ian Graham , Nick McKeown, Monitoring very high speed links, Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, November 01-02, 2001, San Francisco, California, USA [doi>10.1145/505202.505235]
• 23: K. Claffy, "Internet measurement: myths about internet data," in Usenix LISA 2001, San Diego, CA, Dec. 2001. {Online}. Available: http://www.caida.org/outreach/presentations/Myths2002/
• 24: Jaeyeon Jung , Emil Sit , Hari Balakrishnan , Robert Morris, DNS performance and the effectiveness of caching, Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, November 01-02, 2001, San Francisco, California, USA [doi>10.1145/505202.505223]
• 25: L. N.-P. packets since 1988, http://www.ln.net.
• 26: I. 2, http://www.internet2.edu.
• 27: Vern Paxson, An analysis of using reflectors for distributed denial-of-service attacks, ACM SIGCOMM Computer Communication Review, v.31 n.3, July 2001 [doi>10.1145/505659.505664]
• 28: H. Wang, D. Zhang, and K. Shin, "Detecting syn flooding attacks," in Proceedings of the IEEE Infocom. New York, NY: IEEE, June 2002, pp. 000--001. {Online}. Available: citeseer.nj.nec.com/508971.html
• 29: R. Govindan, C. Alaettinoğlu, and D. Estrin, "Self-configuring active network monitoring (SCAN)," Feb. 1997, white paper.
• 30: CAIDA, "Internet measurement infrastructure," 2002, http://www.caida.org/analysis/performance/measinfra/.
• 31: M. Mathis and J. Mahdavi, "Diagnosing internet congestion with a transport layer performance tool," in Proceedings of INET '96, Montreal, June 1996. {Online}. Available: http://www.psc.edu/~mathis/papers/
• 32: Y. Vardi, "Network tomography: Estimating source-destination traffic intensities from link data," The Journal of American Statistics Association, vol. 91, no. 433, pp. 365--377, Mar. 1996.
• 33: J. Cao, D. Davis, S. Wiel, and B. Yu, "Time-varying network tomography: Router link data," The Journal of American Statistics Association, vol. 95, no. 452, pp. 1063--1075, Feb. 2000. {Online}. Available: http://cm.bell-labs.com/cm/ms/departments/sia/cao/htmls/pub.html
• 34: J. Cao, S. V. Wiel, B. Yu, and Z. Zhu, "A scalable method for estimating network traffic matrices," Bell Labs Tech. Report, 2000. {Online}. Available: http://cm.bell-labs.com/cm/ms/departments/sia/cao/htmls/pub.html
• 35: Hari Balakrishnan , Mark Stemm , Srinivasan Seshan , Randy H. Katz, Analyzing stability in wide-area network performance, ACM SIGMETRICS Performance Evaluation Review, v.25 n.1, p.2-12, June 1997