A number of recent empirical studies of traffic measurements from a variety of working packet networks have convincingly demonstrated that actual network traffic is self-similar or long-range dependent in nature (i.e., bursty over a wide range of time scales) -- in sharp contrast to commonly made traffic modeling assumptions. In this paper, we provide a plausible physical explanation for the occurrence of self-similarity in LAN traffic. Our explanation is based on new convergence results for processes that exhibit high variability (i.e., infinite variance) and is supported by detailed statistical analyses of real-time traffic measurements from Ethernet LAN's at the level of individual sources. This paper is an extended version of [53] and differs from it in significant ways. In particular, we develop here the mathematical results concerning the superposition of strictly alternating ON/OFF sources. Our key mathematical result states that the superposition of many ON/OFF sources (also k...

The packet pair technique estimates the capacity of a path (bottleneck bandwidth) from the dispersion (spacing) experienced by two back-to-back packets [1][2][3]. We demonstrate that the dispersion of packet pairs in loaded paths follows a multimodal distribution, and discuss the queueing effects that cause the multiple modes. We show that the path capacity is often not the global mode, and so it cannot be estimated using standard statistical procedures. The effect of the size of the probing packets is also investigated, showing that the conventional wisdom of using maximum sized packet pairs is not optimal. We then study the dispersion of long packet trains. Increasing the length of the packet train reduces the measurement variance, but the estimates converge to a value, referred to as Asymptotic Dispersion Rate (ADR), that is lower than the capacity. We derive the effect of the cross traffic in the dispersion of long packet trains, showing that the ADR is not the available bandwidth in the path, as was assumed in previous work. Putting all the pieces together, we present a capacity estimation methodology that has been implemented in a tool called pathrate.

Abstract- In this paper we demonstrate how TCP congestion control can show chaotic behavior. We demonstrate the major features of chaotic systems in TCPlIP networks with examples. These features include un-predictability, extreme sensitivity to initial conditions and odd periodicity. Previous work has shown the fractal nature of aggregate TCPAP traffic and one explanation to this phenomenon was that traffic can be approxi-mated by a large number of ON/OFF sources where the random ON and/or OFF periods are of length described by a heavy tailed distribution. In this paper we show that this argument is not necessary to explain self-similarity, neither randomness is required. Rather, TCP itself as a deter-ministic process creates chaos, which generates self-similarity. This prop-erty is inherent in todays TCPlIP networks and it is independent of higher layer applications or protocols. The two causes: heavy tailed ONlOFF and chaotic TCP together contribute to the phenomena, called fractal nature of Internet traffic. Keywords-TCP congestion control, fractal traffic, chaotic models. I.

We propose a user model that explains the shape of the distribution of file sizes in local file systems and in the World Wide Web. We examine evidence from 562 file systems, 38 web clients and 6 web servers, and find that this model is an accurate description of these systems. We compare this model to an alternative that has been proposed, the Pareto model. Our results cast doubt on the widespread view that the distribution of file sizes is long-tailed; we discuss the implications of this conclusion for proposed explanations of self-similarity in the Internet. Keywords: File sizes, lognormal distribution, long-tailed distribution, self-similarity. 1.

INTRODUCTION 1.1.1 Background Since the seminal study of Leland, Taqqu, Willinger and Wilson [41] which set the groundwork for considering self-similarity an important notion in the understanding of network traffic including the modeling and analysis of network performance, an explosion of work has ensued investigating the multifaceted nature of this phenomenon. 1 The long held paradigm in the communication and performance communities has been that voice traffic and, by extension, data traffic are adequately described by certain Markovian models (e.g., Poisson) which are amenable to accurate analysis and efficient control. The first property stems from the well-developed field of Markovian analysis which allows tight equilibrium bounds on performance variables such as the waiting time in various queueing systems to be found. This also 1 For a non-technical account of the discovery of the self-similar nature of network traffic, including parallel effort

The problem of estimating the capacity of an Internet path is one of fundamental importance. Due to the multitude of potential applications, a large number of solutions have been proposed and evaluated. The proposed solutions so far have been successful in partially addressing the problem, but have suffered from being slow, obtrusive or inaccurate. In this work, we evaluate CapProbe, a low-cost and accurate end-to-end capacity estimation scheme that relies on packet dispersion techniques as well as end-to-end delays. The key observation that enabled the development of CapProbe is that both compression and expansion of packet pair dispersion are the result of queuing due to cross-traffic. By filtering out queuing effects from packet pair samples, CapProbe is able to estimate capacity accurately in most environments, with minimal processing and probing traffic overhead. In fact, the storage and processing requirements of CapProbe are orders of magnitude smaller than most of the previously proposed schemes. We tested CapProbe through simulation, Internet, Internet2 and wireless experiments. We found that CapProbe error percentage in capacity estimation was within 10 % in almost all cases, and within 5 % in most cases.

This paper investigates differentiated services in wireless packet networks using a fully distributed approach that supports service differentiation, radio monitoring, and admission control. While our proposal is generally applicable to distributed wireless access schemes, we design, implement, and evaluate our framework within the context of existing wireless technology. Service differentiation is based on the IEEE 802.11 Distributed Coordination Function (DCF) originally designed to support best-effort data services. We analyze the delay experienced by a mobile host implementing the IEEE 802.11 DCF and derive a closed-form formula.We then extend the DCF to provide service differentiation for delay-sensitive and best-effort traffic based on the results from the analysis. Two distributed estimation algorithms are proposed. These algorithms are evaluated using simulation, analysis, and experimentation. A Virtual MAC (VMAC) algorithm passively monitors the radio channel and estimates locally achievable service levels. The VMAC estimates key MAC level statistics related to service quality such as delay, delay variation, packet collision, and packet loss. We show the efficiency of the VMAC algorithm through simulation and consider significantly overlapping cells and highly bursty traffic mixes. In addition, we implement and evaluate the VMAC in an experimental differentiated services wireless testbed. A Virtual Source (VS) algorithm utilizes the VMAC to estimate application -level service quality. The VS allows application parameters to be tuned in response to dynamic channel conditions based on "virtual delay curves." We demonstrate through simulation that when these distributed virtual algorithms are applied to the admission control of the radio channel then a globally st...

Abstract — Network based intruders seldom attack their victims directly from their own computer. Often, they stage their attacks through intermediate “stepping stones ” in order to conceal their identity and origin. To identify the source of the attack behind the stepping stone(s), it is necessary to correlate the incoming and outgoing flows or connections of a stepping stone. To resist attempts at correlation, the attacker may encrypt or otherwise manipulate the connection traffic. Timing based correlation approaches have been shown to be quite effective in correlating encrypted connections. However, timing based correlation approaches are subject to timing perturbations that may be deliberately introduced by the attacker at stepping stones. In this paper we propose a novel watermark-based correlation scheme that is designed specifically to be robust against timing

Cumulative broadband network traffic is often thought to be well modelled by fractional Brownian motion. However, some traffic measurements do not show an agreement with the Gaussian marginal distribution assumption. We show that if connection rates are modest relative to heavy tailed connection length distribution tails, then stable L'evy motion is a sensible approximation to cumulative traffic over a time period. If connection rates are large relative to heavy tailed connection length distribution tails, then FBM is the appropriate approximation. The results are framed as limit theorems for a sequence of cumulative input processes whose connection rates are varying in such a way as to remove or induce long range dependence.

In this letter we consider burst switching for very high speed routing in the next generation Internet backbone. In this scenario, Internet Protocol (IP) packets to a given destination are collected in bursts at the network edges. We propose a burst assembly mechanism that can reduce the traffic autocorrelation or degree of self-similarity, and at the same time keep the delay due to burst formation limited at the network edges.