On the Self-Similar Nature of Ethernet Traffic

- Leland, et. Al

Presented by Sumitra Ganesh

Overview Demonstrate the self-similar nature of

Ethernet LAN traffic Study the degree of self-similarity in

various data sets using the Hurst parameter as a measure of “burstiness”

High resolution data collected over several years and across several networks

Discusses models for traffic sources, methods for measuring self-similarity and simulating self-similar traffic.

Structure of presentation Traffic Measurements Self-Similar Stochastic Processes Analysis of Ethernet Traffic

Measurements Source Models Implications and Conclusions Comments

Traffic Measurements Traffic monitor records for each packet

a timestamp (accurate to within 100-20 microsec, packet length, header information

Study conducted from 1989-1992 Network underwent changes during this

period Data sets with External traffic analyzed

separately

Relevant Network Changes Aug 89/Oct 89 – host to host

workgroup traffic Jan 1990 – host-host and router-to-

router Feb 1992 – predominantly router-

to-router traffic

Self-similarity Slowly Decaying Variances : Variance of

the sample mean decreases slower than the reciprocal of the sample size.

Long Range Dependence : The autocorrlations decay hyperbolically rather than exponentially.

Power Law: Spectral density obeys a power law near the origin

mX m )var( )( m 10

)(kr

Hurst parameter

For a given set of observations kX

)(/)],..,0min(),..,0[max()(/)( 11 nSWWWWnSnR nn

)()..( 1 nXkXXW kk

nk ,..1

HnnSnRE )](/)([

HnnSnRE )](/)([ n

Mathematical Models Fractional Gaussian noise – rigid

correlation structure ARIMA processes – more flexible for

simultaneous modeling of short-term and long-term behavior

Construction by Mandelbrot : aggregation of renewal reward processes with inter-arrival times exhibiting infinite variances

Estimating the Hurst parameter H Time domain analysis based on the

R/S statistic – robust against changes in the marginal distributions

Analysis of the variances for the aggregated processes

Periodogram based Maximum Likelihood Estimate analysis in the frequency domain – yields confidence intervals

Ethernet traffic (27 hour) Compare variance-time plot, R/S plot and

periodogram for number of bytes during normal hour in Aug 89. H is approx. 0.8

Estimate is constant over different levels of aggregation

Conclusion : The Ethernet traffic over a 24-hour period is self-similar with the degree of self-similarity increasing as the utilization of the Ethernet increases.

(a)R/S plot(b) Variance-time (c) Periodogram(d)Different levels

Analysis for data setAUG89.MB

Four Year period

Estimate for H is quite stable (0.85-0.95)

Ethernet traffic during normal traffic hours is exactly self-similar

Estimates from R/S and variance-time plots are accurate

(a)-(d) Aug 89, Oct 89,Jan 90, Feb 92.

Analysis for packet countNormal hour traffic

(a)– packet count(b)- number of bytes

Low-Normal-High for each

Observations (4-year) H increases from low to normal to high

traffic hours As number of sources increased the

aggregate traffic does not get smoother – rather the burstiness increases

Low traffic hours : gets smoother in 90s because of router-to-router traffic

Confidence intervals wider for low traffic hours – process is asymptotically self-similar

External Traffic Normal/High – H is slightly smaller Low traffic hours – H is 0.55 and

confidence interval contains 0.5. Therefore coventional short-range Poisson based models describe this traffic accurately

87 % of the packets were TCP

Source Model Renewal reward process in which the

inter-arrival times are heavy-tailed With relatively high probability the

active-inactive periods are very long The heavier the tail -> the greater the

variability -> Burstier the traffic

Not analyzed the traffic generated by individual Ethernet users.

2/)3( H 21

Conclusions Ethernet LAN traffic is statistically self-similar Degree of self-similarity (the Husrt parameter

H) is typically a function of the overall utilization of the Ethernet

Normal and Busy hour traffic are exactly self-similar. Low hour traffic is asymptotically self-similar

External traffic / TCP traffic share the same characteristics

Conventional packet traffic models are not able to capture the self-similarity

Implications Congestion ? Queueing ? … …

Comments Convincing analysis and

interpretation of results Poor graphs for a paper that relies

on them so heavily