On the Self-Similar Nature of Ethernet Traffic - Leland, et. Al Presented by Sumitra Ganesh

Overview Demonstrate the self-similar nature of Ethernet LAN traffic Study the degree of self-similarity in various data sets using the Hurst parameter as a measure of “burstiness” High resolution data collected over several years and across several networks Discusses models for traffic sources, methods for measuring self-similarity and simulating self-similar traffic.

Structure of presentation Traffic Measurements Self-Similar Stochastic Processes Analysis of Ethernet Traffic Measurements Source Models Implications and Conclusions Comments

Traffic Measurements Traffic monitor records for each packet a timestamp (accurate to within microsec, packet length, header information Study conducted from Network underwent changes during this period Data sets with External traffic analyzed separately

Relevant Network Changes Aug 89/Oct 89 – host to host workgroup traffic Jan 1990 – host-host and router-to- router Feb 1992 – predominantly router-to- router traffic

Self-similarity Slowly Decaying Variances : Variance of the sample mean decreases slower than the reciprocal of the sample size. Long Range Dependence : The autocorrlations decay hyperbolically rather than exponentially. Power Law: Spectral density obeys a power law near the origin

Hurst parameter For a given set of observations

Mathematical Models Fractional Gaussian noise – rigid correlation structure ARIMA processes – more flexible for simultaneous modeling of short-term and long-term behavior Construction by Mandelbrot : aggregation of renewal reward processes with inter-arrival times exhibiting infinite variances

Estimating the Hurst parameter H Time domain analysis based on the R/S statistic – robust against changes in the marginal distributions Analysis of the variances for the aggregated processes Periodogram based Maximum Likelihood Estimate analysis in the frequency domain – yields confidence intervals

Ethernet traffic (27 hour) Compare variance-time plot, R/S plot and periodogram for number of bytes during normal hour in Aug 89. H is approx. 0.8 Estimate is constant over different levels of aggregation Conclusion : The Ethernet traffic over a 24- hour period is self-similar with the degree of self-similarity increasing as the utilization of the Ethernet increases.

(a)R/S plot (b) Variance-time (c)Periodogram (d)Different levels Analysis for data set AUG89.MB

Four Year period Estimate for H is quite stable ( ) Ethernet traffic during normal traffic hours is exactly self-similar Estimates from R/S and variance-time plots are accurate

(a)-(d) Aug 89, Oct 89, Jan 90, Feb 92. Analysis for packet count Normal hour traffic

(a)– packet count (b)- number of bytes Low-Normal-High for each

Observations (4-year) H increases from low to normal to high traffic hours As number of sources increased the aggregate traffic does not get smoother – rather the burstiness increases Low traffic hours : gets smoother in 90s because of router-to-router traffic Confidence intervals wider for low traffic hours – process is asymptotically self-similar

External Traffic Normal/High – H is slightly smaller Low traffic hours – H is 0.55 and confidence interval contains 0.5. Therefore coventional short-range Poisson based models describe this traffic accurately 87 % of the packets were TCP

Source Model Renewal reward process in which the inter- arrival times are heavy-tailed With relatively high probability the active- inactive periods are very long The heavier the tail -> the greater the variability -> Burstier the traffic Not analyzed the traffic generated by individual Ethernet users.

Conclusions Ethernet LAN traffic is statistically self-similar Degree of self-similarity (the Husrt parameter H) is typically a function of the overall utilization of the Ethernet Normal and Busy hour traffic are exactly self- similar. Low hour traffic is asymptotically self- similar External traffic / TCP traffic share the same characteristics Conventional packet traffic models are not able to capture the self-similarity

Implications Congestion ? Queueing ? …

Comments Convincing analysis and interpretation of results Poor graphs for a paper that relies on them so heavily