Network arrivals are often modeled as Poisson processes for analytic simplicity, even though a number of traffic studies have shown that packet interarrivals are not exponentially distributed. We evaluate 24 wide-area traces, investigating a number of wide-area TCP arrival processes (session and connection arrivals, FTP data connection arrivals within FTP sessions, and TELNET packet arrivals) to determine the error introduced by modeling them using Poisson processes. We find that user-initiated TCP session arrivals, such as remotelogin and file-transfer, are well-modeled as Poisson processes with fixed hourly rates, but that other connection arrivals deviate considerably from Poisson; that modeling TELNET packet interarrivals as exponential grievously underestimates the burstiness of TELNET traffic, but using the empirical Tcplib [Danzig et al, 1992] interarrivals preserves burstiness over many time scales; and that FTP data connection arrivals within FTP sessions come bunched into “connection bursts,” the largest of which are so large that they completely dominate FTP data traffic. Finally, we offer some results regarding how our findings relate to the possible self-similarity of widearea traffic.

A number of recent empirical studies of traffic measurements from a variety of working packet networks have convincingly demonstrated that actual network traffic is self-similar or long-range dependent in nature (i.e., bursty over a wide range of time scales) -- in sharp contrast to commonly made traffic modeling assumptions. In this paper, we provide a plausible physical explanation for the occurrence of self-similarity in LAN traffic. Our explanation is based on new convergence results for processes that exhibit high variability (i.e., infinite variance) and is supported by detailed statistical analyses of real-time traffic measurements from Ethernet LAN's at the level of individual sources. This paper is an extended version of [53] and differs from it in significant ways. In particular, we develop here the mathematical results concerning the superposition of strictly alternating ON/OFF sources. Our key mathematical result states that the superposition of many ON/OFF sources (also k...

Abstract not found

We present a parameterizable methodology for profiling Internet traffic flows at a variety of granularities. Our methodology differs from many previous studies that have concentrated on end-point definitions of flows in terms of state derived from observing the explicit opening and closing of TCP connections. Instead, our model defines flows based on traffic satisfying various temporal and spatial locality conditions, as observed at internal points of the network. This approach to flow characterization helps address some central problems in networking based on the Internet model. Among them are route caching, resource reservation at multiple service levels, usage based accounting, and the integration of IP traffic over an ATM fabric. We first define the parameter space and then concentrate on metrics characterizing both individual flows as well as the aggregate flow profile. We consider various granularities of the definition of a flow, such as by destination network, host-pair, or hos...

High-resolution traffic measurements from modern communications networks provide unique opportunities for developing and validating mathematical models for aggregate traffic. To exploit these opportunities, we emphasize the need for structural models that take into account specific physical features of the underlying communication network structure. This approach is in sharp contrast to the traditional black box modeling methodology from time series analysis that ignores, in general, specific physical structures. We demonstrate, in particular, how the proposed structural modeling approach provides a direct link between the observed self-similarity characteristic of measured aggregate network traffic, and the strong empirical evidence in favor of heavy-tailed, infinite variance phenomena at the level of individual network connections.

We present detailed measurements of various processing overheads of the TCP/IP and UDP/IP protocol stacks on a DECstation 5000/200 running the Ultrix 4.2a operating system. These overheads include data-touching operations, such as the checksum computation and data movemen ~ which are well known to be major time consumers. In this stud y, we also considered overheads due to non-data touching operations, such as network buffer manipulation, protocol-specific processing, operating system functions, data structure manipulations (other than network buffers), and error checking. We show that when one considers realistic message size dktributions, where the majority of messages are small, the cumulative time consumed by the nondata touching overheads represents the majority of processing time. We assert that it will be difficult to significantly reduce the cumulative processing time due to non-data touching overheads. The goal of this study is to determine the relative importance of various processing overheads in network software, in particular, the TCP/IP and UDPAP protocol stacks. In the prrsg significant focus has been placed on maximizing throughput noting that “data

In this paper, we characterize wide-area network applications that use the TCP transport protocol. We also describe a new way to model the wide-area traffic generated by a stub network. We believe the traffic model presented here will be useful in studying congestion control, routing algorithms, and other resource management schemes for existing and future networks. Our model is based on trace analysis of TCP/IP widearea internetwork traffic. We collected the TCP/IP packet headers of USC, UCB, and Bellcore networks at the point they connect with their respective regional access networks. We then wrote a handful of programs to analyze the traces. Our model characterizes individual TCP conversations by the distributions of: number of bytes transferred, duration, number of packets transferred, packet size, and packet interarrival time. Our trace analysis shows that both interactive and bulk transfer traffic from all sites reflect a large number of short conversations. Similarly, it shows that a very large percentage of traffic is bidirectional, even for bulk transfer. We observed that interactive applications send significantly different amounts of data in each direction of a conversation, and that interarrival times for interactive applications closely follow a constant plus exponential model. Half of the conversations are directed to a handful of networks, but the other half are directed to hundreds of networks. Many of these observations contradict commonly held beliefs regarding wide-area traffic.

The interconnection of local area networks is increasingly important, but little data are available on the characteristics of the aggregate traffic that LANs will be submitting to the interconnection media. In order to understand the interactions between LANs and the proposed interconnection networks (MANs, WANs, and BISDN networks), it is necessary to study the behavior of this external LAN traffic over many time scales – from milliseconds to hundreds of seconds. We present a high time-resolution hardware monitor for Ethernet LANs that avoids the shortcomings of previous monitoring tools, such as traffic burst clipping and timestamp jitter. Using data recorded by our monitor for several hundred million Ethernet packets, we present an overview of the short-range time correlations in external LAN traffic. Our analysis shows that LAN traffic is extremely bursty across time domains spanning six orders of magnitude. We compare this behavior with simple formal traffic models and employ the data in a trace-driven simulation of the LAN-BISDN interface proposed for the SMDS SM service. Our results suggest that the pronounced short-term traffic correlations, together with the extensive time regime of traffic burstiness, strongly influence the patterns of loss and delay induced by LAN interconnection. 1.

Rapid developments in networking technology and a rise in clustered computing have driven research studies in high performance communication architectures. In an effort to standardize the work in this area, industry leaders have developed the Virtual Interface Architecture (VIA) specification. This architecture seeks to provide an operating system-independent infrastructure for high-performance user-level networking in a generic environment. This paper evaluates the inherent costs and performance potential of the Virtual Interface Architecture through a prototype implementation over Myrinet. The VIA prototype is compared against established research user-level networks using simple communication benchmarks on the same hardware. We consider extensions to the VI Architecture that improve its performance for certain types of communication traffic and outline further research areas in the VIA design space that merit investigation.

We present an artificial workload model of wide-area internetwork traffic. The model can be used to drive simulation experiments of communication protocols and flow and congestion control experiments. The model is based on analysis of wide-area TCP/IP traffic collected from one industrial and two academic networks. The artificial workload model uses both detailed knowledge and measured characteristics of the user application programs responsible for the traffic. Observations drawn from our measurements contradict some commonly held beliefs regarding wide-area TCP/IP network traffic.