Network traffic characterization A historical perspective 1 - - PowerPoint PPT Presentation
Network traffic characterization A historical perspective 1 Incoming AT&T traffic by port (18 hours of traffic to AT&T dial clients on July 22, 1997) N a m e port % bytes % packets bytes per packet w o r l d - w i d e
1
2
3
4
60-second spacing between consecutive packets
5
world-wide-web 80 56.75 44.79 74.58 12 819 11.2 netnews 119 24.65 12.90 1.20 210 1235 132.6 pop-3 mail 110 1.88 3.17 2.80 22 384 10.3 cuseeme 7648 0.95 1.85 0.03 1375 333 192.0 secure web 443 0.74 0.79 0.99 16 603 14.2 internet chat 6667 0.27 0.74 0.16 89 239 384.6 file transfer 20 0.65 0.64 0.26 47 659 30.1 domain name 53 0.19 0.58 10.69 1 210 0.5 . . .
6
7
8
Strictly traditional inference techniques Focus on choosing best-fitting model Obsession with „Squeezing a data set dry“
Black-box or operational models dominate No real need to talk to subject-matter experts Traffic is viewed as „just another time series...“ Main objective: „What can be analyzed?“
9
Abundance of traffic measurements; reproducibility
Data exhibits unusual features From statistical inference to scientific inference Networks are complex; need for subject-matter expertise
Need for physical-based or structural models Main objective: „What matters for performance?“
10
Have hardly changed for years and decades
Have evolved in a predictable manner
User population, services and applications Traffic mix, protocols, ... Data networks that don‘t change are suspicious Internet as an example of extreme heterogeneity
11
High-quality: Special-purpose traffic recorders High-volume: Terabyte storage devices Diversity: many large datasets from
Sensitivity: Who can record and collect what data?
Unusual behavior, constant surprises, ... What are interesting/relevant measurements?
12
13
1993: ... Hardly any WWW traffic on the Internet 1994: ... About 10% of total Internet traffic is WWW 95/96: ... Up to 60-70% of overall Internet traffic is
06/07: … Up to 60-70% of overall Internet traffic P2P
Games? IPTV?
14
Early 1989:
Early 1992:
Late 1996:
Now:
March 1991: 1.3* 1012 bytes/month March 1994: 1.1* 1013 bytes/month
15
About 1 million packets
About 2 Gigabytes of data
About 100 million packets
About 1 Terabyte of data
About 10 Terabyte of data
16
From millisecond to microsecond accuracy
Information about all layers in network hierarchy
Actively injecting traffic into the network
Passively monitoring network information
17
Signaling for each phone call Billing on a call by call basis Source, destination, start time, duration
Call arrival process Call holding time distributions Spatial calling patterns
Network planning, Dimensioning, etc.
18
Slow but mature packet network: 56 Kbps Running Signaling System 7 (SS7) protocol Measurements a the level of individual SS7 messages Variable length messages Days/weeks worth of data Hundreds of millions of messages
Call arrival process Call holding time distributions Spatial calling patterns
19
Network Service Customer registration
Network data for each
Customer care Email, Web hosting, E-commerce
20
Unless crucial for billing
Design of new protocols Design of network hardware Design of networks
Who Where How Impact on network
21
22
23
24
25
26
27
28
29
30
31
# of packets (bytes) per 10 mseconds # of TCP connections arriving per second # of modem sessions arriving per second
Time series: X1, X2, …, Xn Aggregated process: X(m) Stationary time series: