Capturing Network Traffic Dynamics Small Scales Rolf Riedi Dept of Statistics Stochastic Systems and Modelling in Networking and Finance Part II Dependable Adaptive Systems and Mathematical Modeling Kaiserslautern, August 26
Model and Physical Reality Queuing prediction Estimation of LRD Phenomenon Physical System User responsible for bursts at large scale Statistical Model LRD Self-similarity Large scales well understood Stochastic Model Convergence of ON-OFF to fbm Physical Model
Failure of classical prediction Interarrivaltimes Not exponential Not independent Paxson-Floyd, 1995
Multiscale Hurst
Measured Data Time series (A k,z k ) collected at gateway of LAN k= number of data packet A k = arrival time of packet B k = size of packet Work load until time t: Working arrival per m time units
Long Range Dependence High variability at large scales caused by correlation Auto-covariance function LRD Slowly decaying auto-covariance Cox: for ½ < H < 1 (presence of LRD) Var-time-plot: simple first diagnostics for LRD
ON-OFF: Physical Traffic Model (Taqqu Levy 1986)
fbm Historic facts Brown (182): observes particle motion Markov (19+): Markov chains Einstein (195): Heat equ for Brownian motion Wiener (1923): continuous Markov process Kolmogorov (193 s): theory of stochastic processes Kolmogorov (194): fbm Levy, Lamperti: H-sssi processes (1962) Mandelbrot & VanNess: integral representation (1965) Adler: fractal path properties of fbm Samorodnitsky & Taqqu: self-similar stable motion
Connection-level Analysis and Modeling of Network Traffic
Aggregate Traffic at small scales Trace: Time stamped headers Sender-Receiver IP!! Large scales Gaussian LRD(high variability) Small scales Non-Gaussian Positive process Burstiness Objective : Origins of bursts 45 4 35 number of bytes 3 25 2 15 1 5 Auckland Gateway (2) Aggregate Bytes per time x 1 5 3 2.5 2 1.5 1.5 histogram Gaussian: 1% Real traffic: 3% Gaussian: 1% Real traffic: 3% 99% 99%.5 1 1.5 2 2.5 3 2 4 6 x 1 5 time (1 unit=5ms) Mean Mean Kurtosis - Gaussian : 3 - Real traffic: 5.8
Bursts in the ON/OFF framework ON/OFF model Superposition of sources Connection level model Explains large scale variability: LRD, Gaussian Cause: Costumers Heavy tailed file sizes!! Small scale bursts: Non-Gaussianity Conspiracy of sources?? Flash crowds?? (dramatic increase of active sources)
Non-Gaussianity: A Conspiracy? Load: Bytes per 5 ms 99% Mean The number of active connections is close to Gaussian; provides no indication of bursts in the load Number of active connections 99% Mean Indication for: - No conspiracy of sources - No flash crowds
Non-Gaussianity: a case study Typical Gaussian arrival (5 ms time slot) Histogram of load offered in same time bin per connection: Considerable balanced field of connections Typical bursty arrival (5 ms time slot) Histogram of load offered in same time bin per connection: One connection dominates 1 Kb 15 Kb
Non-Gaussianity and Dominance Circled in Red: Instances where one connections contributes over 5% of load (resolution 5 ms) 99% Mean Dominant connections correlate with bursts
Non-Gaussianity and Dominance Systematic study: time series separation For each bin of 5 ms: remove packets of the ONE strongest connection Leaves Gaussian residual traffic 99% = Mean + Overall traffic 1 Strongest connection Residual traffic
Separation on Connection Level Definition: Alphaconnections: Peak rate > mean arrival rate + 1 std dev Betaconnections: Residual traffic Findings are similar for different time series Auckland (2+21), Berkeley, Bellcore, DEC 5ms, 5ms, 5ms resolution
Alpha Traffic Component There are few Alpha connections < 1% (AUCK 2: 427 of 64,87 connections) 3% of load Alpha connections cause bursts: Multifractal spectrum: Wide spectrum means bursty Alpha is extremely bursty Beta is little bursty Overall traffic is quite bursty Balanced (5% alpha) very bursty
Multifractal spectrum: Microscope for Bursts α=.7 α=.9 α=.8 Collect points t with same α : Large Deviation type result a
Beta Traffic Component Constitutes main load Governs LRD properties of overall traffic Is Gaussian at sufficient utilization (Kurtosis = 3) Is well matched by ON/OFF model 99% Mean Variance time plot Beta traffic Number of connections = ON/OFF
Simple Connection Taxonomy Careful analysis on connection level shows : this is the only systematic reason Bursts arise from large transfers over fast links. But: bandwidth = rate RTT
Cwnd or RTT? 1 2 Colorado State University trace, 3, packets 1 5 Beta Alpha Beta Alpha 1/RTT (1/s) 1 1 1 1-1 1 3 1 4 1 5 1 6 peak-rate (Bps) Correlation coefficient=.68 cwnd (B) peak rate 1/RTT 1 3 1 4 1 5 1 6 peak-rate (Bps) Correlation coefficient=.1 RTT has strong influence on bandwidth and dominance. 1 4 1 3 1 2 cwnd
Examples of Alpha/Beta Connections one beta connection one alpha connection (9678, 196, 8, 59486) 14 14 12 12 1 1 packet size (bytes) 8 6 4 2 forward direction packet size (bytes) 8 6 4 2 forward direction reverse direction -2.4.6.8 1 1.2 1.4 1.6 1.8 2 2.2 2.4 packet arrival time (second) -2 reverse direction 41.3 41.35 41.4 41.45 packet arrival time (second) Notice the different time scales Alpha connections burst because of short round trip time, not large rate
Physical Model Modeling Network Traffic Traffic (user): superposition of ON/OFF sources requesting files with heavy tailed size Network: heterogeneous bandwidth variable sending-rates (fixed per ON/OFF source) Explains properties of traffic: LRD: heavy tailed transfer of beta sources (crowd) Bursts: few large transfers of few alpha sources Mathematical Model accommodate this insight within ON-OFF?
Modeling of Alpha Traffic ON/OFF model revisited: High variability in connection rates (RTTs) Low rate = beta High rate = alpha + + + = = fractional Gaussian noise Non-Gaussian limit??
Modeling of Alpha Traffic ON/OFF model revisited: High variability in connection rates (RTTs) number of bytes 2 1.5 1.5 x 1 5 Low rate = beta 2 4 6 time (1 unit=5ms) fractional Gaussian noise number of bytes High rate = alpha 2.5 2 1.5 1.5 x 1 5 3 2 4 6 time (1 unit=5ms) Non-Gaussian limit
Towards mathematical models Renewal reward processes
Parameters: Stable distributions Equivalent definitions: Stable Limit of iid sums Known special cases: Gaussian Cauchy Characteristic fct
High Multiplex vs Large Scale
Different Limits for ON-OFF model Recall limits of ON-OFF sources multiplexed Possible limits of renewal reward aggregate Willinger Paxson R Taqqu
ON-OFF traffic model revisited
Modeling of Alpha Traffic ON/OFF model revisited: High variability in connection rates (RTTs) Low rate = beta High rate = alpha + + + = = fractional Gaussian noise stable Levy noise
Impact: Simulation Simulation: ns topology to include alpha links Simple: equal bandwidth Realistic: heterogeneous end-to-end bandwidth Congestion control Design and management
Inpact: Understanding Multifractal Smalltime scale Network topology Control at flow level Simulation LRD Largetime scales approx. Gaussian Client behavior Bandwidth over Buffer packet scheduling round-trip time session lifetime network management < 1 msec msec-sec minutes hours Structure: Multiplicative Additive Model: hybrid tree Mixture of Gaussian - Stable
Impact: Performance Beta Traffic rules the small Queues Alpha Traffic causes the large Queue-sizes (despite small Window Size) Total traffic Queue-size overlapped with Alpha Peaks Alpha connections
Self-similar Burst Model Alpha component = self-similar stable (limit of a few ON-OFF sources in the limit of fast time) This models heavy-tailed bursts (heavy tailed files) TCP control: alpha CWND arbitrarily large (short RTT, future TCP mutants) Analysis via De-Multiplexing: Optimal setup of two individual Queues to come closest to aggregate Queue Beta (top) + Alpha De-Multiplexing: Equal critical time-scales Q-tail Pareto Due to Levy noise
ON-OFF Burst Model Alpha traffic = High rate ON-OFF source (truncated) This models bi-modal bandwidth distribution TCP: bottleneck is at the receiver (flow control through advertised window) Current state of measured traffic Analysis: de-multiplexing and variable rate queue Beta (top) + Alpha Variable Service Rate Queue-tail Weibull (unaffected) unless rate of alpha traffic larger than capacity average beta arrival and duration of alpha ON period heavy tailed
On-off parameters Free parameters in on-off model? File size = duration * rate : these variables are dependent Assuming two of them are independent leads to following models: Power model File size and rate independent Patience model: File size and duration independent Real trace Real trace Simulation using observed size and rate independently Simulation using observed size and duration independently Simulation: same behavior for entire traffic results in poor match. Different models (power/patience) for alpha and beta?
Free parameters: statistical analysis Beta users: rate determines file size Alpha users are free Alpha Beta Duration and Rate (Alpha) 12 Duration and Rate (Beta) 9 Duration -Rate Rate (bytes per sec) 1k 1k 1 8 6 4 Rate (bytes per sec) 1k 1k 8 7 6 5 4 3 2 2 1 1.1 1 1 Duration (s) 1.1 1 1 Duration (s) Filesize and Rate (Alpha) Filesize and Rate (Beta) Size -Rate Rate (bytes per sec) 1k 1k 16 14 12 1 8 6 4 Rate (bytes per sec) 1k 1k X 9 8 7 6 5 4 3 2 2 1 1 1 1k 1k 1M Size (bytes) 1 1 1k 1k 1M Size (bytes)
Free parameters: SIMULATION Total Bytes x 1 5 9 8 7 6 5 4 3 2 1 Real Trace Bytes per time (overall) 1 2 3 4 5 6 7 Time bin (1 unit = 5ms) Bytes Scheme RD: Rate Duration independent 8 6 4 2 x 1 5 Bytes per time (overall) 2 4 6 Time bin (1 unit = 5ms) Bytes 3 2.5 2 1.5 1.5 Scheme SD: Size Duration independent x 1 7 Bytes per time (overall) 2 4 6 Time bin (1 unit = 5ms) Bytes Scheme SR: Size Rate independent 8 6 4 2 x 1 5 Bytes per time (overall) 2 4 6 Time bin (1 unit = 5ms) Alpha x 1 5 9 8 7 Bytes per time (Alpha) 8 x 1 5 Bytes per time (Alpha) 6 x 1 7 Bytes per time (Beta) 8 x 1 5 Bytes per time (Alpha) Bytes 6 5 4 3 2 Bytes 6 4 2 Bytes 5 4 3 2 Bytes 6 4 2 1 1 2 3 4 5 6 7 Time bin (1 unit = 5ms) 2 4 6 Time bin (1 unit = 5ms) 1 2 4 6 Time bin (1 unit = 5ms) 2 4 6 Time bin (1 unit = 5ms) Beta Bytes x 1 5 9 8 7 6 5 4 3 Bytes per time (Beta) Bytes 8 6 4 x 1 5 Bytes per time (overall) Bytes x 1 6 1 8 6 4 Bytes per time (Beta) Bytes 8 6 4 x 1 5 Bytes per time (Beta) 2 1 1 2 3 4 5 6 7 Time bin (1 unit = 5ms) 2 2 4 6 Time bin (1 unit = 5ms) 2 2 4 6 Time bin (1 unit = 5ms) 2 2 4 6 Time bin (1 unit = 5ms)
Network-User Driven Traffic model Bytes x 1 5 9 8 7 6 5 4 3 2 1 Bytes per time (overall) Bytes Bytes per time (overall) x 15 9 8 7 6 5 4 3 2 1 1 2 3 4 5 6 7 Time bin (1 unit = 5ms) 1 2 3 4 5 6 7 Time bin (1 unit = 5ms) Original trace (Bellcore) Alpha (SR) + Beta (RD) CONCLUSION: Rates for alpha drawn to be large, beta drawn to be small but: Alpha: power model: Rate independent of Size Beta: patience factor: Rate independent of Duration New limiting results needed for novel ON-OFF settings
Model and Physical Reality Queuing prediction Detection of alpha users Phenomenon Physical System User responsible for bursts at large scale Statistical Model Small scales sufficiently understood. Choice of physical model not clear ON-OFF with asympt. regimes. Renewal Reward. Two component model (alpha/beta users) Stochastic Model Self-similar limits are fbm (multiplexed beta) or Levy stable (fast alpha)