The New Web: Characterizing AJAX Traffic Fabian Schneider - - PowerPoint PPT Presentation

The New Web: Characterizing AJAX Traffic

Fabian Schneider

fabian@net.t-labs.tu-berlin.de

Sachin Agarwal Tansu Alpcan Anja Feldmann

Technische Universtit¨ at Berlin Deutsche Telekom Laboratories

Passive and Active Measurement Conference 2008/04/29

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 1 / 16

Introduction AJAX

AJAX vs. normal Web browsing

(a) Classic Web browsing User Browser Output Screen (DOM) Web- server User responses Get requests

• ver HTTP

Get reply data over HTTP Web browser (b) AJAX enabled Web browsing User Browser Output Screen (DOM) Web- server Get requests

• ver HTTP

Get reply data over HTTP JavaScript-enabled-browser (e.g. Firefox, IE, Safari) JavaScript Engine (Client side) User responses Pre-fetch Cache

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 2 / 16

Introduction Motivation

Motivation

• Network traffic generation has to be realistic for networking

experiments

• Real-world traffic characteristics change with the applications used
• Need to check if traffic models are still applicable, on a regular basis

⇒ Do new Web applications change the characteristics?

• We picked four popular representative of AJAX apps and studied their

traffic:

• Google Maps
• Google Mail
• gmx.de (popular German webmailer)
• lokalisten.de (popular German social network)

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 3 / 16

Introduction Outline

Outline

1 How AJAX applications work 2 Analysis approach 3 Measurement results 4 Conclusions

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 4 / 16

How AJAX applications work Google Maps internals

A brief overview of Google Maps internals

Google Maps . . .

• Is an AJAX application
• Prefetches tiles
• Opens multiple TCP

connections to various different servers

• Uses Cookies to identify users
• Transfers data via persistent and

pipelined HTTP

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 5 / 16

How AJAX applications work Google Maps internals

Challenges of identifying Google Maps related traffic

Identifying Google Maps related traffic by:

• Server IP’s: not precise enough
• Server name: very costly
• URL prefix: good enough

" / " (general) " /kh " (satellite) " /maps " (meta) " /mt " (map) " /mapfiles " (meta) " /mld " (route planning) " /intl " (meta) " /mapstt " (traffic) " /favicon.ico " (general)

Table: URL prefixes used in Google Maps requests.

We found similar methodologies for the other three AJAX applications.

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 6 / 16

Analysis approach Traces

Trace-based analysis

• Three HTTP (Port 80) full packet traces:

MWN-051: Munich, 2.5 TB, 24 h, weekday MWN-07: Munich, 2.4 TB, 32 h, weekend LBNL-07: Berkeley, 214 GB, 9h, weekday

• Two environments:
• Large scientific user populations, including student housing
• High bandwidth internet access
• Analysis Procedure:
• Bro for TCP stream reassembly and HTTP protocol analysis
• Extract one-line summaries per HTTP request/reply pair

1Google Maps started in 2005 nine month before the trace Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 7 / 16

Analysis approach Selecting AJAX traffic

Selecting AJAX traffic

• Identifying the complete AJAX-based traffic is not possible by looking

a the request/response stream only

• Need to chose Web applications that are AJAX-enabled
• We chose the 4 most popular AJAX applications that we found in our

traces:

• Google Maps
• Google Mail
• gmx.de (popular German webmailer)
• lokalisten.de (popular German social network)
• Compare AJAX vs. All-HTTP traffic

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 8 / 16

All-HTTP Our 4 AJAX apps

Measurement results Results

Results

• Parameters studied (more in paper):
• Number of bytes transfered (HTTP payload)
• Number of HTTP requests
• Inter-request-times
• Reported results are consistent over all data sets
• Results presented as CCDF and PDF
• Colors used:

red/pink All-HTTP green Google Maps

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 9 / 16

Measurement results Bytes per connection (HTTP payload)

Bytes per connection (HTTP payload)

MWN−07 All−HTTP 1 10 100 1K 10K 100K 1M 10M 100M P[HTTP payload data [bytes] > u] u [bytes] 100% 10% 1% 0.1% 0.01% 0.001%

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 10 / 16

All-HTTP: 90% of the Connections transfer less than ~45k

Measurement results Bytes per connection (HTTP payload)

Bytes per connection (HTTP payload)

MWN−07 All−HTTP MWN−07 Google Maps MWN−07 Google Mail MWN−07 GMX MWN−07 lokalisten 1 10 100 1K 10K 100K 1M 10M 100M P[HTTP payload data [bytes] > u] u [bytes] 100% 10% 1% 0.1% 0.01% 0.001%

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 10 / 16

AJAX Apps: most connections transfer more bytes than ALL-HTTP All-HTTP: largest connections transfer an

• rder of

magnitude more bytes

Measurement results Session Tracking

Session Tracking

• Session: set of connections related to a user browsing on a webpage
• AJAX traffic:
• Track the cookie of connections to the entry pages
• Connections with the same user identification cookie are grouped into

a session

• All-HTTP traffic:
• All connections where the 3-tuple (server IP, server Port, client IP) is

identical are group into a session

• For both All-HTTP and AJAX sessions, an inactivity timeout of 10

minutes was applied

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 11 / 16

Measurement results Bytes per session (HTTP payload)

Bytes per session (HTTP payload)

HTTP payload data [bytes] probability 0.0 0.05 0.10 0.15 0.20 0.25 MWN−07 All−HTTP MWN−07 Google Maps MWN−07 Remaining 3 0.0 0.05 0.10 0.15 0.20 0.25

10kB

1 1 10 100 1K 10 100 1K 10K 10K 100K 1M 10M 100K 1M 10M 100M 1G 100M 1G

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 12 / 16

PDF with logarithmic x-axis: interprete as smoothed histogram with logarithmic bin sizes

Measurement results Bytes per session (HTTP payload)

Bytes per session (HTTP payload)

HTTP payload data [bytes] probability 0.0 0.05 0.10 0.15 0.20 0.25 MWN−07 All−HTTP MWN−07 Google Maps MWN−07 Remaining 3 0.0 0.05 0.10 0.15 0.20 0.25

10kB

1 1 10 100 1K 10 100 1K 10K 10K 100K 1M 10M 100K 1M 10M 100M 1G 100M 1G

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 12 / 16

AJAX Apps: transfer more bytes per session

Measurement results Requests per session

Requests per session

CCDF

u [#requests] MWN−07 All−HTTP MWN−07 Google Maps MWN−07 Google Mail MWN−07 GMX MWN−07 lokalisten.de 1 10 100 1K 10K P[#HTTP requests > u] 100% 10% 1% 0.1% 0.01% 0.001% Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 13 / 16

All-HTTP: significantly less requests per session

Measurement results Requests per session

Requests per session

CCDF

u [#requests] MWN−07 All−HTTP MWN−07 Google Maps MWN−07 Google Mail MWN−07 GMX MWN−07 lokalisten.de 1 10 100 1K 10K P[#HTTP requests > u] 100% 10% 1% 0.1% 0.01% 0.001%

PDF

#HTTP requests probability 0.0 0.2 0.4 0.6 MWN−07 All−HTTP MWN−07 Google Maps MWN−07 Remaining 3 LBNL−07 Google Maps 0.0 0.2 0.4 0.6 1 1 10 10 100 100 1K 1K 10K 10K Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 13 / 16

All-HTTP: 50% of the sessions consist of only two requests All-HTTP: significantly less requests per session

Measurement results Inter-Request-Times

Inter-Request-Times

probability 0.0 0.05 0.10 0.15 0.20 MWN−07 All−HTTP MWN−05 All−HTTP MWN−07 Google Maps LBNL−07 Google Maps 0.0 0.05 0.10 0.15 0.20

1sec

1µs 10µs 1µs 10µs 100µs 100µs 1ms 10ms 100ms 1ms 10ms 100ms 1s 1s 10s 100s 1000s 10s 100s 1000s inter request times

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 14 / 16

User induced Automated

Measurement results Inter-Request-Times

Inter-Request-Times

probability 0.0 0.05 0.10 0.15 0.20 MWN−07 All−HTTP MWN−05 All−HTTP MWN−07 Google Maps LBNL−07 Google Maps 0.0 0.05 0.10 0.15 0.20

1sec

1µs 10µs 1µs 10µs 100µs 100µs 1ms 10ms 100ms 1ms 10ms 100ms 1s 1s 10s 100s 1000s 10s 100s 1000s inter request times

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 14 / 16

AJAX Apps: reduction of user induced requests AJAX Apps: shift towards automated requests

User induced Automated

Conclusions Summary

Summary

• On average AJAX apps transfer more bytes per connection/session
• The number of requests per session is higher for AJAX apps
• Significantly shorter inter-request-times

⇒ Larger sessions and burstier traffic is upcoming with AJAX applications ⇒ Existing traffic models are still applicable, but need new parameterization

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 15 / 16

Conclusions End

Questions?

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 16 / 16