Measurements made for web data, media (IP Radio and TV, BBC Iplayer: Port 80 TCP) and VoIP (Skype: Port UDP) traffic.

Transcription

1 Real time statistical measurements of IPT(Inter-Packet time) of network traffic were done by designing and coding of efficient measurement tools based on the Libpcap package. Traditional Approach of measuring IPT was based on filtering connections based on the ports associated with measurements. Traffic flows Ai and Ci were measured together. This resulted in less-detailed Poisson statistics. Newer Approach of measuring IPT on an individual traffic flow basis. Traffic flows Ai and Ci are measured individually. This approach gives the real IPT statistics showing protocol specific network behaviour. Measurements made for web data, media (IP Radio and TV, BBC Iplayer: Port 80 TCP) and VoIP (Skype: Port UDP) traffic.

2 PDFs (Probability Density Functions) and CDFs (Cumulative Distribution Functions) of IPT were plotted for each traffic flow measurement for fairly large amount of IP packets of a particular type of traffic. Higher Order Statistics (Joint Density) were also plotted. These plots are significantly important and useful as they explain the behaviour of the network sources and packet sequences in greater detail than when compared to the PDF. Example shows Joint Density result for VoIP traffic on Port indicating elements of periodicity on the network.

3 PDF and CDF for IPT of VoIP Traffic on Port Joint Density result for IPT of VoIP Traffic on Port 15010

4 Example of a 3 state Markov Model Probabilistic models defining a stochastic process with finite number of states observing the Markov Property. Transitions occur with a fixed transition rate Rij. States can model activities of traffic sources on a network. Inter-Arrival times or Inter-Packet times are exponentially distributed. Packet Level statistics are obtained from Markov Monte Carlo Simulations. Higher order statistics can also be produced using Markov Models.

5 Simple two state Markov Model confirms analytical understanding of model and other primitive features of measured network results. Symmetric and Asymmetric cases considered. Analytical and Numerical Monte-Carlo results agree with each other. Results show Poisson first and higher order statistics. Similar results observed for higher N-state Markov Models where every state emits packets. General Eq. for PDF (N-state) = V1 P1(t)+ V2 P2(t) + V3 P3(t)... + VN PN(t) Simple 2 state Markov Traffic Model

6

7

8 Modified Markov Traffic Model with inclusion of uneventful state to explore possibility of producing unique features other than usual Poisson statistics. Inter-Packet time is sum of known and unknown exponential times spent in States 1 and 2 respectively. PDF shows a peak. Maximum no longer at origin. PDF is convolution of state occupation probability densities.

9 PDF for Modified Two State Symmetric Model Joint Density - Modified 2 State Asymmetric Model

10 Modified Markov Model can be evolved further with inclusion of more number of non-packet emitting states. (N-state Loop model) As number of states increase, peak gets pushed further away from origin. Since PDF is sum of N exponentially distributed random variables, model can be simplified by using a Gamma distribution. N = No. of states, R = Common rate parameter Using a Gamma distribution, N-state loop model (with one emission state) can be reduced to 1 state with a Gamma occupation probability density. As shown, a 30 state Model can be simplified into a 3 state Gamma Markov Model.

11 PDF s for N=1-10 Loop Markov Model 30 state Model vs. 3 state Gamma Model (PDF)

12 30 state Model simplified into a 3 state Gamma Markov Model

13 While there is nothing wrong with using Gamma Markov Models, an obvious limitation to the Gamma distribution is the difficulty in adjusting the peak height and width in contrast to a Gaussian distribution. Gamma Markov Models can be further reduced to Gaussian Markov Models. In the general equation of the Gamma distribution, as N approaches infinity, the gamma distribution can be approximated by a Gaussian distribution. where and

14 Each peak in the measured results can be associated with a state of the Gaussian Markov Model. The parameters µ, σ and V associated with each Gaussian component can be estimated using an appropriate maximum-likelihood estimation algorithm. (EM algorithm) As shown, a six-state (an additional state with negligible occupation time is needed to generate visiting probabilities) Gaussian Model fits the measured statistics for Port VoIP results. PDFs Measured, Statistical fit and Gaussian Markov Monte Carlo Results

15 CDFs - Measured and Markov Monte Carlo Numerical results

16 Modeling a PDF does not necessarily mean that all details of the network behaviour are captured. Consider two kinds of Gaussian Markov Models emitting packets A, B and C. Markov Model 1 consists of packets emitted in any random order, whereas Markov Model 2 consists of packets emitted in a strict sequence. Visiting probabilities are the same for each. As observed, PDFs are the same for both the cases. PDFs IPT Gaussian Markov Model 1 and 2

17 While the PDFs of both the Markov Models are the same, the Joint Density results reveal critical differences. The Joint Density for the Markov Model 1 shows a symmetric structure of 9 peaks indicating the 9 possible sequence pairs of IPT times, as any of the three packets follow any of the three. The Joint Density for the Markov Model 2 shows an asymmetric structure with three peaks representing packets A,B and C in sequential order. Good example showing how two different Markov traffic models have the same PDF and yet different joint densities.

18 Joint Density Results for Markov Model 1 Joint Density Results for Markov Model 2

19 Observed first and higher order statistics of network traffic measurements and explored the use of Markov Models to model the features observed in the measurements. Confirmed that the analytical understanding of the Markov Traffic Models agrees with the numerical results obtained from the Monte-Carlo Simulation of the models. Studied simple and complex N-state Models and observed good candidacy for applications with Poisson Traffic. Modified the N-state Markov Model to observe unique features such as a Gaussian peak. Extended the modified N-state Markov Models to create simplified Gaussian Markov Models which can be used to model the network measurement results. Observed that by fitting the Markov Models to the PDF, the Internet Traffic Modeling community merely models the first order statistics of the network but not the actual behaviour of the network. Observed how two different Markov Traffic Models with different packet sequences have the same PDF but different Joint Densities. While the PDFs do not show this, the Joint Densities clearly reveal the packet sequence knowledge for the network concerned. Network Measurement results have been found to be largely symmetrical in nature.

20 Future Work Final stages of work will examine the detailed modeling of real network traffic statistics. Work will address the question of the extent to which traffic can be characterized and identified.