1. 1 Network Simulation and Testing Polly Huang EE NTU http://cc.ee.ntu.edu.tw/~phuang phuang@cc.ee.ntu.edu.tw

2. 2 Traffic Papers V. Paxson, and S. Floyd, Wide-Area Traffic: The Failure of Poisson Modeling. IEEE/ACM Transactions on Networking, Vol. 3 No. 3, pp. 226-244, June 1995 W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson, On the Self- Similar Nature of Ethernet Traffic. IEEE/ACM Transactions on Networking, Vol. 2, No. 1, pp. 1-15, Feb. 1995 M. E. Crovella and A. Bestavros, Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes. IEEE/ACM Transactions on Networking, Vol 5, No. 6, pp. 835-846, December 1997 Anja Feldmann; Anna C. Gilbert; Polly Huang; Walter Willinger, Dynamics of IP traffic: A study of the role of variability and the impact of control. In the Proceeding of SIGCOMM '99, Cambridge, Massachusetts, September 1999

3. 3 Paper Selection (Pre-lecture) InterestingBoringEasyDifficult Failure of Poisson SS in Ethernet SS in WWW IP Dynamics

4. 4 Identifying Internet Traffic Failure of Poisson Self-similar Traffic Practical Model

5. 5 The Problem What is the traffic workload like? Call/packet arrival rate as a process What kind of process is it? Very old problem and a lot of work

6. 6 Because Traces are available Researchers care about –The validness of their assumption –The network traffic being independent Poisson Operation people care a lot about –The amount of buffer/bandwidth to provision for their networks –The profit comes from satisfying customers with minimum infrastructure cost

7. 7 Telephone Network Assumptions –Poisson call arrivals –Exponential call duration Wonderful Property –Poisson mixing with Poisson is still Poisson –Average rate well-characterize a call The whole queueing theory

8. 8 Data Network? Wide-Area Traffic: The Failure of Poisson Modeling V. Paxson, and S. Floyd IEEE/ACM Transactions on Networking, Vol. 3 No. 3, pp. 226-244, June 1995

9. 9 A Study of the Wide-Area Traffic Two units of examination –Connections vs. packets A sizeable number of traces –~4M connections, ~26M packets –Different location and different time Inter-arrival processes –TCP connections –Telnet packets –FTPDATA connections Going self-similar

10. 10 Unit of Observation Telephone network –Circuit-switched –The unit is circuit, i.e., a call –People picking up the phone and talk for a while Data network –Packet-switched –The unit is packet –Another unit is connection, comparable to call –People starting up an FTP connection and send data for a while

11. 11 Packet  Connection Hosts send/receive packets over a channel at the transport layer –Reliable: TCP –Non-reliable: UDP Packets from various channels multiplex at the the network layer –IP Routers switched on the packets

12. 12 Inter-Arrival Process: A Little Exercise Beginning SYN ACK&SYN ACK&Segment 1 End FIN ACK&FIN ACK Beginning ? ?

13. 13 TCP Connection Arrival Poisson? Depends

14. 14 Application Dependent TELNET –Users typing ‘telnet cc.ee.ntu.edu.tw’ FTP –User typing ‘ftp cc.ee.ntu.edu.tw’ FTPDATA burst –User typing ‘mget net-simtest-*.ppt’ FTPDATA –Each individual TCP transfer NNTP & SMTP –Machine initiated and/or timer-driven

15. 15 Independent and Poisson? Y/N TELNET FTP FTPDATA FTPDATA burst SMTP NNTP

16. 16 Quick Summary TELNET and FTP –Independent and Poisson –Both the 1-hour and 10-min scales FTPDATA bursts and SMTP –At the 10-min interval –Not ‘terribly far’ from Poisson –SMTP inter-arrival is not independent FTPDATA, NNTP –Clearly not Poisson

17. 17 Before One Can Explain Human-initiated process –Independent and Poisson Non-human-initiated process –Well, who knows

18. 18 Explanations I TELNET and FTP –User initiated –Users typing ‘telnet cc.ee.ntu.edu.tw’ –User typing ‘ftp cc.ee.ntu.edu.tw’ FTPDATA bursts –User typing ‘mget net-simtest-*.ppt’ –Closely-spaced connections… (<= 4 sec) FTPDATA –TCP connections

19. 19 Explanations II NNTP –Flooding to propagate network news –Arrival of news trigger another –Periodical and implementation/configuration dependent SMTP –Mailing list –Timer effects from the DNS queries

20. 20 TELNET Packets Poisson? No, heavy-tailed!

21. 21 Show in 4 Ways Distribution of packet inter-arrival time –Exponential processes ramp up significantly slower Packet arrival pattern in seconds and 10 seconds –Exponential processes are smoother at the 10sec scale Variance-time plot –Change of variance to time scale –Var of exponential processes decays quickly Packet arrival rate process in seconds –By the sole visual effect –Exponential processes are less spiky

22. 22 Full TELNET model? Poisson connection arrival Heavy-tailed packet arrival within a connection

23. 23 FTPDATA Connection arrival is not Poisson –Clustered in bursts Burst sizes in bytes is quite heavy-tailed –A 0.5% of bursts contribute to 50% of the traffic volume

24. 24 OK. We know it’s not Poisson. But what?

25. 25 Going Self-Similar Well, since other evidences suggest so And it’s the next good thing Go straight into producing self-similar traffic

26. 26 Producing Self-Similar Traffic ON/OFF sources –Fix ON period rate –ON/OFF period length heavy-tailed M/G/  –Customer arrival being Poisson –Service time being heavy-tailed with infinite variance Authors’ own model –Pseudo-self-similar –Not long-range dependent though

27. 27 Performance Implication Low-priority traffic starvation –Shall the high-priority traffic being long-range dependent (bursty) Admission control based on recent traffic failing –‘Congestions haven’t happened for a long while’ does not mean it won’t happen now

28. 28 The Real Message Poisson is no longer sufficient!

29. 29 Identifying Internet Traffic Failure of Poisson Self-similar Traffic Practical Model

30. 30 Self-Similar What? On the Self-Similar Nature of Ethernet Traffic Will E. Leland; Murad S. Taqqu; Walter Willinger; Daniel V. Wilson IEEE/ACM Transactions on Networking, Vol. 2, No. 1, pp. 1-15, Feb. 1995

31. 31 This One Easier Self-similarity in World Wide Web Traffic: Evidence and Possible Causes Mark E. Crovella; Azer Bestavros IEEE/ACM Transactions on Networking, Vol 5, No. 6, pp. 835-846, December 1997

32. 32 Definition X: a stationary time series X (m) : the m-aggregates –Summing the time series over non-overlapping blocks of m X is H-self-similar if –X (m) has the same distribution for all positive m

33. 33 Same Distribution? Same autocorrelation function –r(k) = E[(X t -  )(X t+k -  )]/  2 –Look familiar? r(k) ~ k -  –k   –0 <  < 1 Think variance

34. 34 Significance of k -  Long-range dependence –Just another way of characterizing the same thing Power-law decay –Slower than exponential decay –Therefore traffic does not smooth up  < 1 –r(k) does not converge –Sum of r(k) infinite, I.e., variance infinite

35. 35 Just FYI The Hurst parameter: 1-  /2

36. 36 Tests for Self-Similarity Variance-time plot –A line with slope -  > -1 R/S plot –Rescaled range grows as the number points included –A line with slope H an the log-log scale Periodogram –Power spectrum to frequency –A line with slope  - 1 at the log-log scale Whittle estimator –Confidence to a form –FGN or Fractional ARIMA

37. 37 Pareto Review Exponential –f(x) = ce -cx Heavy-tailed –F(x) ~ x -c, 0 < c < 2 –Hyperbolic Pareto –f(x) = ck c x -c-1 –F(x) = 1- (k/x) c –A line at the log-log scale of F(x) plot

38. 38 In Addition to the Theory A HUGE volume of Ethernet traces Show consistency of being self-similar in all sorts of tests Implication to traffic engineering A bombshell!

39. 39 Why Self-Similar? Theory suggests –Fix rate ON/OFF process –Heavy-tailed length Looking into the length –The ON time: transmission time –The OFF time: silent time

40. 40 Physical Cause Heavy-tailed transmission time –Heavy-tailed file sizes –Magic of the nature –E.g., book size in library

41. 41 Identifying Internet Traffic Failure of Poisson Self-similar Traffic Practical Model

42. 42 So, enough Math. Just tell me what to do! It depends!

43. 43 Cutting to the Chase The structural model –user level: Poisson arrival and heavy-tailed duration –network level: TCP closed-loop feedback control and ack clocking –Variability: delay and congestion Let simulators track the complex behavior

44. 44 Why not FGN? IP Traffic Dynamics: The Role of Variability and Control Anja Feldmann; Anna C. Gilbert; Polly Huang; Walter Willinger In the Proceeding of SIGCOMM '99, Cambridge, Massachusetts, September 1999

45. 45 Remember Wavelet Analysis? FFT –Frequency decomposition –f j, Fourier coefficient –Amount of the signal in frequency j WT: wavelet transform –Frequency (scale) and time decomposition –d j,k, wavelet coefficient –Amount of the signal in frequency j, time k

46. 46 Self-similarity Energy function –E j = Σ(d j,k ) 2 /N j –Weighted average of the signal strength at scale j Self-similar process –E j = 2 j(2H-1) C <- the magic!! –log 2 E j = (2H-1) j + log 2 C –linear relationship between log 2 E j and j

47. 47 ‘Shape’ of Self-Similarity Self-similar ?? RTT

48. 48 Wavelet Example 0 1 00 00 00 00 11 11 11 11 s1s2s3s4s1s2s3s4 d1d2d3d4d1d2d3d4 0 0 0 0 2 2 2 20 0 0 0 0 0 4 40 0 0 8 0 88

49. 49 Adding Periodicity packets arrive periodically, 1 pkt/2 3 msec coefficients cancel out at scale 4 10 00 00 00 s1s2s3s4s1s2s3s4 d1d2d3d4d1d2d3d4 1 0 0 0 1 0 1 20

50. 50 Visualization J=4 Adding Periodicity

51. 51 ’Shape' of self-similarity Self-similar Yes RTT!

52. 52 Large Scale Heavy-tailed connection duration

53. 53 Medium Scale TCP close-loop control RTT

54. 54 TCP Flow Control sourcesink RTT Time

55. 55 Variability Delay and congestion (bandwidth & load) SimulationMeasurement

56. 56 Internet Traffic is Weird! Different properties at different time scales –Large scales: self-similarity –Medium scale: periodicity –Small scale: ??? (possibly multifractal)

57. 57 New Queuing Theory? For chaotic Internet traffic Only pen and paper

58. 58 NO! Probably not in the near future Confirmed by experts

59. 59 A Few Reasons Not exactly self-similar (FGN - big no no) ’Shape' of self-similarity changes with the network conditions Don't know what self-similar processes add up to (mathematically intractable) Don ’ t know what those strange small-scale behavior is exactly

60. 60 Therefore The structural model –User level: Poisson arrival and heavy-tailed duration –Network level: TCP closed-loop feedback control and ack clocking –Variability: delay and congestion Let simulators track the complex behavior

61. 61 Paper Selection (Post-lecture) InterestingBoringEasyDifficult Failure of Poisson SS in Ethernet SS in WWW IP Dynamics

62. 62 Paper Review #1 Dues 13:59:59, Friday, 3/12

63. 63 On the Review Forms Novelty –New idea Clarity –The problem Reality (practicality) –Evaluation Importance, significance, relevance –How much impact? –Would things change?

64. 64 OK for Beginners Clarity –Easiest –Judging the writing Evaluation –Easy –Judging the experiments and technical content

65. 65 Challenging for the Advanced Novelty –Hard –Need to follow/read enough papers in the area Importance –Hardest –Need to have breadth and know enough development in the area