1 Ossama Younis and Sonia Fahmy Department of Computer Sciences Purdue University For slides, technical report, and implementation, please see: On Efficient On-line Grouping of Flows with Shared Bottlenecks at Loaded Servers

2 Is “On-line” Tomography Useful and at What Time Scale? What is “tomography”? A method of producing (inferring) an image of the internal structures of a solid object by the observation and recording of the differences in the effects on the passage of waves of energy impinging on those structures. What is “network tomography”? Internet mapping (routes, per-segment delays, per-segment losses, per-segment bandwidth, shared bottlenecks) via composing end-to-end measurements.

3 Why FlowMate? Source Receiver

4 Why FlowMate? Partitioning flows emerging from the same source (busy server) according to shared bottlenecks is useful for:  Customized, more fair and more responsive coordinated congestion management.  Overlay networks (e.g., application-layer multicast and peer-to-peer applications).  Load balancing.  Pricing.  Traffic engineering and admission control.

5 The Problem Input: A set of flows (micro or macro), F, originating at the same source, where F = { f 1, f 2, …, f n } Required: Periodically map each flow f i (1  i  n) to a group g j (1  j  m)  G = { g 1, g 2, …, g m }, m  n, where all flows f  g j  G share a common bottleneck

6 FlowMate Features Employs passive probing to reduce generation and processing overhead and network load with a large number of flows. Employs on-line partitioning based on constantly changing shared bottlenecks. Works with or without receiver timestamp support (and no router support). Reduces overhead using representatives. Uses limited history for stability (no samples).

7 Architecture Transport layer implementation enables more accurate timestamping

8 Basic Algorithm [O(NG)] Initialize: Empty group list and flow table. Repeat forever: - Collect delay Information. - Check triggering condition. - If (triggered): partition flows and generate lists. - Delete delay samples and maintain compact history information. Partitioning: - Select delay samples. - Assign a representative flow for each group. - Each flow is tested against each representative, and joins the group with highest correlation. - A flow either joins a group or forms a new one.

9 Shared Bottleneck Test For two flows f1 and f2 sharing a common bottleneck in sr [Rubenstein00]: The cross correlation measure of multiplexed (f1, f2) packets, spaced apart by time t > 0, is higher than the auto correlation measure of packets of f1 or f2, spaced apart by time T > t. s r

10 In-Band Delay Sampling One way delay (reasonable clock skew OK). Extend the time-stamped ACK (RFC 1323) to include packet reception time. Select samples according to inter-packet spacing. time Samples chosen as probes

11 Triggering Partitioning Time d_min d_max t Partitioning not invoked Partitioning may be invoked if enough samples for all flows Partitioning must be invoked if not invoked since t Last time partitioning was invoked Every flow with at least M samples is considered

12 Our Accuracy Index Sources of inaccuracies: false sharing and group splits A group split is not as harmful as false sharing Let k j denote the resulting number of splits of a correct group: Example: correct: {1,2,3},{4,5,6}, result: {1,2},{3,4,5},{6}, I=0.67

13 Simulation Configuration Configuration: Cross and reverse traffic: CBR sources Forward traffic: FTP, Telnet, or HTTP/1.1 Background traffic: 3 “StarWars” flows (self-similar traffic)

14 Foreground Load FlowMate accuracy (using a simpler topology) Different loads Staggered start times Correlation periods: 1, 2, 4, 6, 8, 10 seconds.

15 Background Load Load and on/off periods have little impact on average accuracy

16 Bursty Flows Telnet traffic HTTP/1.1 traffic Sampling: Flow life-time (P2P FTPs (elephants), HTTP/1.0 vs. 1.1), Packet interleaving patterns, Delayed ACKs

17 Router Buffering Buffer size vs avg index Drop policy

18 Naïve coordinated congestion management demonstrates better fairness and responsiveness Sample Application

19 Related Work Two-flow correlation tests based on delay or loss of all Poisson probe samples [Rubenstein et al., SIGMETRICS 2000]. Semi-active Bayesian probing (using shared packet loss correlations) [Harfoush et al., ICNP 2000]. Shannon or Renyi entropy-based flow clustering [Katabi et al., TR-2001 and IC3N01]. Other tomography work, e.g., [AT&T, UMass, BU, Rice, Berkeley]. Congestion Management schemes, e.g., Congestion Manager (CM) [Balakrishnan et al, SIGCOMM 99], Ensemble, Int, FastStart.

20 Conclusions FlowMate is an on-line flow partitioning scheme that does not require active probing. Partitioning is periodically performed at the flow origin for a large set of flows. FlowMate appears to be robust under heavy background load and has low overhead. High burstiness of flows to be partitioned is the main factor that degrades performance. FlowMate can be useful to many applications, such as overlay networks, congestion management, load balancing, and pricing.

21 Ongoing Work We are currently integrating FlowMate into Linux v to perform real experiments. We are studying various parameters, as well as UDP flow partitioning in more depth. More generally, we are studying the compression, composition and real-time use of inferred network properties for adaptation in overlay networks.