1. COMPSAC'14 - N. Larrieu - 22-24/07/2014 1 How to generate realistic network traffic? Antoine VARET and Nicolas LARRIEU COMPSAC – Vasteras – July the 23 rd, 2014 French Civil Aviation University (ENAC) TELECOM Laboratory

2. COMPSAC'14 - N. Larrieu - 22-24/07/2014 2 Why do we need realistic traffic? To evaluate performances of new network entities – By face them to generated traffic with characteristics as close as possible as the Internet traffic Lack of adequate tools to generate data flows with “realistic behaviors” at the network or transport level

3. COMPSAC'14 - N. Larrieu - 22-24/07/2014 3 Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

4. COMPSAC'14 - N. Larrieu - 22-24/07/2014 4 Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

5. COMPSAC'14 - N. Larrieu - 22-24/07/2014 5 Different tools for different purposes Available traffic generators – Network simulators: NS-2 [5], OpNet [6] or OmNet++ [7]  On Off sources built-in but inside the simulator – Traffic replay tools: Tcpreplay [8], Harpoon [9]  Need first to acquire the traffic trace to replay  Mostly packel-level tools, not flow-level tools  Retransmit the sniffed packets in the same order, and separated with the same delays as these measured during the capture – Network throughput estimation tools: iperf [10], BWPing [11], Ttcp [12], NetPerf [13], NetPerfMeter [14], Ostinato [15] Interesting throughput statistics  Single flow or multiple synchornized flows generation  Development of our traffic generator, the SourcesOnOff tool!

6. COMPSAC'14 - N. Larrieu - 22-24/07/2014 6 How to characterize an “Internet-like” traffic profile? Internet cannot be solely characterized with a small set of parameters (e.g. some mathematical distributions and additional factors) Not currently one unique mathematical modeling able to embrace the different characteristics and the complexity of the Internet traffic [1] “Internet” can cover very different profiles, but some common properties can be highlighted: – High variability – Self-similarity

7. COMPSAC'14 - N. Larrieu - 22-24/07/2014 7 Internet traffic characteristics High variability is characterized by an infinite mathematical variance and means that sudden discontinuous changes can always occur – Some mathematical distributions like Pareto and Weibull are heavy-tailed (i.e. the tail of the distribution is not exponentially bounded) and thus can be used to generate sets of values with high variances and also high- variability [2, 3] Self-similarity is defined by a long-range dependence characteristic, which means there are bursts of traffic any time over a wide range of time scales. – W. Willinger found in [4] a relation between self-similarity and high variability for Ethernet Local Area Network (LAN) throughputs – The author showed that using ON/OFF sources with heavy-tailed distributions causes the traffic streams to be highly variable and, consequently, the aggregation of these streams to be also self-similar and highly variable

8. COMPSAC'14 - N. Larrieu - 22-24/07/2014 8 ON-OFF sources principles (1)

9. COMPSAC'14 - N. Larrieu - 22-24/07/2014 9 ON-OFF sources principles (2) Sources parameters (based on random distribution) – Doff distribution: departure time of any source is computed with the departure time (second) of the preceding source plus a random duration. The first source starts at the beginning of the process. – Don distribution: duration times of any source. We generate random values, not for time duration in seconds but for quantity of transmission in bytes (because of TCP congestion control mechanism) Statistical sources generations – Don and Doff distributions follow statistical processes with heavy-tail characteristic (i.e. Weibull or Pareto laws) – Don and Doff distributions are statistical independent

10. COMPSAC'14 - N. Larrieu - 22-24/07/2014 10 Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

11. COMPSAC'14 - N. Larrieu - 22-24/07/2014 11 SourcesOnOff design Random distributions type – Constant, Uniform, Dirac – Normal/Gaussian, Poisson – Pareto, Weibull and Exponential Flow characteristics – Don values: kB, MB, GB, – Doff values: us, ms, s – UDP and TCP traffic flows Available under General Public License v3 (GPLv3) & the CeCiLLv2 license at http://www.recherche.enac.fr/- ~avaret/sourcesonoff http://www.recherche.enac.fr/- ~avaret/sourcesonoff

12. COMPSAC'14 - N. Larrieu - 22-24/07/2014 12 Statistic profile extraction from a real traffic trace Statistic profile extraction process in 2 steps: 1.Traffic trace decomposition algorithm 2.Distance criterion to evaluate the differences between real original data and data generated by our tool

13. COMPSAC'14 - N. Larrieu - 22-24/07/2014 13 Step 1: traffic trace decomposition process Original trace is decomposed in a sum of different standard statistical laws: Constant, Uniform, Dirac, Normal, Gaussian, Poisson, Pareto, Weibull or Exponential For each standard statistical law, its whole range of law parameters is considered – The best set of parameters is kept for each standard law we want to considered for the final aggregation – Need of a distance criterion for each standard law and aggregated final model  Bayesian Information Criterion (BIC)

14. COMPSAC'14 - N. Larrieu - 22-24/07/2014 14 Step 2: BIC (Bayesian Information Criterion) distance assessment BIC = k * ln(n) – 2 * ln(L), where: – n is the size of analyzed data; – L is the likelihood of the model (Weibull, Pareto, Exponential…) regarding the different original data; – k is the total number of estimated parameters.

15. COMPSAC'14 - N. Larrieu - 22-24/07/2014 15 Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

16. COMPSAC'14 - N. Larrieu - 22-24/07/2014 16 Validation of the SourcesOnOff tool Different network traces captured: between 10 minutes and 10 hours POP: Internet entry router for the 150 users of our research department Validation results based on a 10 hours capture (8:00AM - 6:00PM), Tuesday the 29th of January, 2013 – 9 millions of IPv4 packets, mostly TCP data (97.7% of TCP, 2.2% of UDP and 0.1% of ICMP) Experimental process 1.Traffic statistical profile extraction 2.Traffic generation 3.Characteristics comparaison between original traffic trace and generated traffic

17. COMPSAC'14 - N. Larrieu - 22-24/07/2014 17 Statistic profile detection Results for distribution modeling – Don (left side): Weibull function – Doff (right side): composition of Weibull and Dirac functions

18. COMPSAC'14 - N. Larrieu - 22-24/07/2014 18 Verification of generated traffic correctness (1) Qualitative analysis – Quantile-quantile plots (Don and Doff values for real and generated traffic) – Autocorrelation checking (real vs. generated traffic)

19. COMPSAC'14 - N. Larrieu - 22-24/07/2014 19 Verification of generated traffic correctness (2) Quantitative analysis – BIC distance – Hurst exponent computation

20. COMPSAC'14 - N. Larrieu - 22-24/07/2014 20 Conclusion & Future Work Summary – Methodology to generate network traffic with realistic characteristics – SourceOnOff tool developed, based on the application of ON/OFF sources with different statistical profiles Parameters of the distributions can be defined by the user or extracted from real traffic analysis Freely available (under GPLv3 & CeCiLLv2 licenses) and may be utilized for a wide variety of network traffic profiles – Validation of both the traffic generation methodology and the SourcesOnOff tool Our tool is able to generate traffic with the same characteristics as real ones Perspectives – Tool development Supporting additional traffic (ICMP for instance) Supporting additional statistical distributions – Tool applications Consider more complex network topologies (cloud computing applications for instance)  Distribute different SourcesOnOff sender and receiver agents among the cloud

21. COMPSAC'14 - N. Larrieu - 22-24/07/2014 21 References [1] Olivier P. and Benameur N., Flow Level IP traffic characterization, France Télécom, 2000 [2] Olivier P. and Benameur N., Flow Level IP traffic characterization, France Télécom, 2000 [3] Leland W. E., Taqqu S. M., Willinger W. and Wilson D. V., On the Self-Similar Nature of Ethernet Traffic, (Extended Version) IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 2, NO. 1, FEBRUARY 1994 [4] Willinger W., Taqqu M. S., Sherman R. and Wilson D. V., Self-Similarity Through High-Variability: Statistical Analysis of Ethernet LAN Traffic at the Source Level, IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 5, NO. 1, FEBRUARY 1997 [5] The Network Simulator - ns-2, http://www.isi.edu/nsnam/ns/, 2013/01/21 [6] The Opnet Website, http://www.opnet.com/, 2013/01/21 [7] OMNet++ Network Simulation Framework website, http://www.omnetpp.org/, 2013/01/21 [8] Tcpreplay website: http://tcpreplay.synfin.net/ [9] Harpoon website: https://github.com/jsommers/harpoon [10] iperf, a modern alternative for measuring maximum TCP and UDP bandwidth performance, http://iperf.sourceforge.net/,2013/01/21 [11] BWPing, Open Source bandwidth measurement tool, http://bwping.sourceforge.net/, 2013/01/21 [12] 2010 ttcp(1) test TCP/UDP performance, http://linux.die.net/man/1/ttcp, 2013/01/21 [13] The NetPerf HomePage, http://www.netperf.org/netperf/, 2013/01/21 [14] Dreibholz T. 2011 NetPerfMeter, A TCP/UDP/SCTP/DCCP Network Performance Meter Tool, http://www.iem.uni-due.de/~dreibh/netperfmeter/, 2012/12/21 [15] Ostinato website : http://wiki.ostinato.googlecode

22. COMPSAC'14 - N. Larrieu - 22-24/07/2014 22 Questions? How to generate realistic network traffic? SourcesOnOff tool available at http://www.recherche.enac.fr/~avaret/sourcesonoff http://www.recherche.enac.fr/~avaret/sourcesonoff Contact: Nicolas LARRIEU (nicolas.larrieu@enac.fr)nicolas.larrieu@enac.fr ENAC / Telecom Laboratory