1. Connection-level Analysis and Modeling of Network Traffic understanding the cause of bursts control and improve performance detect changes of network state

2. R. RiediSpin.rice.edu Explain bursts Large scale: Origins of LRD understood through ON/OFF model Small scale: Origins of bursts poorly understood, i.e., ON/OFF model with equal sources fails to explain bursts Load (in bytes): non-Gaussian, bursty Number of active connections: Gaussian

3. R. RiediSpin.rice.edu Non-Gaussianity and Dominance Connection level separation: –remove packets of the ONE strongest connection –Leaves Gaussian residual traffic Traffic components: –Alpha connections: high rate (> ½ bandwidth) –Beta connections: all the rest Overall traffic Residual traffic1 Strongest connection = + Mean 99%

4. R. RiediSpin.rice.edu CWND or RTT? Correlation coefficient=0.68 Short RTT correlates with high rate peak-rate (Bps) 1/RTT (1/s) Correlation coefficient=0.01 10 3 4 5 6 2 3 4 5 peak-rate (Bps) cwnd (B) Colorado State University trace, 300,000 packets BetaAlphaBetaAlpha Challenge: estimation of RTT and CWND/rate from trace / at router

5. R. RiediSpin.rice.edu Impact: Performance Beta Traffic rules the small Queues Alpha Traffic causes the large Queue-sizes (despite small Window Size) Alpha connections Queue-size overlapped with Alpha Peaks Total traffic

6. R. RiediSpin.rice.edu Two models for alpha traffic Impact of alpha burst in two scenarios: Flow control at end hosts – TCP advertised window Congestion control at router – TCP congestion window

7. Modeling Alpha Traffic ON/OFF model revisited: High variability in connection rates (RTTs) Low rate = betaHigh rate = alpha fractional Gaussian noise stable Levy noise + = + + =

8. R. RiediSpin.rice.edu Alpha-Beta Model of Traffic Model assumptions: –Total traffic = Alpha component + Beta component –Alpha and Beta are independent –Beta=fractional Brownian motion Alpha traffic: two scenarios –Flow control through thin or busy end-hosts ON-OFF Burst model –Congestion control allowing large CWND Self-Similar Burst model Methods of analysis –Self-similar traffic –Queue De-multiplexing –Variable service rate

9. Self-similar Burst Model Alpha component = self-similar stable –(limit of a few ON-OFF sources in the limit of fast time) This models heavy-tailed bursts –(heavy tailed files) TCP control: alpha CWND arbitrarily large –(short RTT, future TCP mutants) Analysis via De-Multiplexing: –Optimal setup of two individual Queues to come closest to aggregate Queue De-Multiplexing: Equal critical time-scales Q-tail Pareto Due to Levy noise Beta (top) + Alpha

10. R. RiediSpin.rice.edu ON-OFF Burst Model Alpha traffic = High rate ON-OFF source (truncated) This models bi-modal bandwidth distribution TCP: bottleneck is at the receiver (flow control through advertised window) Current state of measured traffic Analysis: de-multiplexing and variable rate queue Beta (top) + Alpha Variable Service Rate Queue-tail Weibull (unaffected) unless rate of alpha traffic larger than capacity – average beta arrival and duration of alpha ON period heavy tailed

11. R. RiediSpin.rice.edu Conclusions Network modeling and simulation need to include –Connection level detail –Heterogeneity of topology Physically motivated models at large Challenges of inference –From traces –At the router Need for adapted Queuing theory