## Wide-Area Traffic: The Failure of Poisson Modeling (1995)

### Cached

### Download Links

Venue: | IEEE/ACM TRANSACTIONS ON NETWORKING |

Citations: | 1412 - 21 self |

### BibTeX

@ARTICLE{Paxson95wide-areatraffic:,

author = {Vern Paxson and Sally Floyd},

title = {Wide-Area Traffic: The Failure of Poisson Modeling},

journal = {IEEE/ACM TRANSACTIONS ON NETWORKING},

year = {1995},

pages = {226--244}

}

### Years of Citing Articles

### OpenURL

### Abstract

Network arrivals are often modeled as Poisson processes for analytic simplicity, even though a number of traffic studies have shown that packet interarrivals are not exponentially distributed. We evaluate 24 wide-area traces, investigating a number of wide-area TCP arrival processes (session and connection arrivals, FTP data connection arrivals within FTP sessions, and TELNET packet arrivals) to determine the error introduced by modeling them using Poisson processes. We find that user-initiated TCP session arrivals, such as remotelogin and file-transfer, are well-modeled as Poisson processes with fixed hourly rates, but that other connection arrivals deviate considerably from Poisson; that modeling TELNET packet interarrivals as exponential grievously underestimates the burstiness of TELNET traffic, but using the empirical Tcplib [Danzig et al, 1992] interarrivals preserves burstiness over many time scales; and that FTP data connection arrivals within FTP sessions come bunched into “connection bursts,” the largest of which are so large that they completely dominate FTP data traffic. Finally, we offer some results regarding how our findings relate to the possible self-similarity of widearea traffic.

### Citations

2051 | An introduction to probability theory and its applications. Vol. I. Third edition - Feller - 1968 |

1765 | On the self-similar nature of Ethernet traffic
- Leland, Taqqu, et al.
- 1993
(Show Context)
Citation Context ...of packet interarrivals clearly differs from exponential [JR86, G90, FL91, DJCME92]. Recent work argues convincingly that LAN traffic is much better modeled using statisticallysself-similar processes =-=[LTWW94], which ha-=-ve much different theoretical properties than Poisson processes. For self-similar traffic, there is no natural length for a "burst"; traffic bursts appear on a wide range of time scales. In ... |

1692 | The Fractal Geometry of Nature - Mandelbrot - 1982 |

1461 | An Introduction to Probability Theory - Feller - 1971 |

1013 | Origins of order: Self-Organization and selection in evolution - Kauffman - 1993 |

542 | TCP/IP Illustrated, Volume 1: The Protocols - Stevens - 1998 |

525 | Supporting RealTime Applications in an Integrated Services Packet Network: Architecture and Mechanisms
- Clark, Shenker, et al.
- 1992
(Show Context)
Citation Context ... dependence of packet traffic concerns classes with admissions control procedures that are based on measurements of recent traffic, rather than on policed traffic parameters of individual connections =-=[CSZ92]-=-. As has been shown by numerous researchers, such admissions control procedures could lead to a much more effective use of the available bandwidth [YKTH93]. Nevertheless, if the measured class has hig... |

464 | Analysis, modeling and generation of self-similar VBR video traffic
- Garrett, Willinger
- 1994
(Show Context)
Citation Context ...traffic motivated our revisitation of models for individual connections; indeed, we originally set out to challenge the notion that wide-area traffic might be self-similar, and have come full circle. =-=[GW94]-=- examines the long-range dependence of variable-bitrate (VBR) video traffic. Their empirical measurements of VBR traffic show strong low-frequency components, and they propose source models for video ... |

264 | The Synchronisation of Periodic Routing Messages
- Floyd, Jacobson
- 1993
(Show Context)
Citation Context ...chine-initiated and can be timer-driven. Previous research has discussed how the periodicity of machine-generated IP traffic such as routing updates can result in network-wide traffic synchronization =-=[FJ94]-=-, a phenomenon impossible with Poisson models. For large bulk transfer, exemplified by FTP, the traffic structure is quite different than suggested by Poisson models. As with TELNET connections, user-... |

233 | On traffic phase effects in packet-switched gateways
- FLOYD, V
- 1992
(Show Context)
Citation Context ...n. In addition, TCP's window flow control contributes a shorter-term periodicity to the traffic pattern, as each packet is transmitted in response to an acknowledgement returned for an earlier packet =-=[FJ92]-=-. It is particularly important to take into account these effects in simulations investigating changes to either TCP, the gateway scheduling algorithms, or the network's packet-dropping algorithms. 8 ... |

188 | Empirically-derived analytic models of wide-area tcp connections
- Paxson
- 1994
(Show Context)
Citation Context ...dhence connection arrival processes), durations, TCP protocol, participating hosts, and data bytes transferred in each direction. The BC and UCB traces are analyzed in depth in [DJCME92], and also in =-=[P94a], and-=- the UCB trace forms the basis of the connection characteristics used for Tcplib [DJ91]. The NC, UK, and DEC traces are analyzed in [P94a], and the LBL traces are analyzed in [P94a, P94b]. The "D... |

173 | Packet Trains: Measurements and a New Model for Computer Network Traffic - Jain, Routhier - 1985 |

154 |
Traffic Modeling for Telecommunications Networks
- Frost, Melamed
- 1994
(Show Context)
Citation Context ...wide-area traffic. 1 Introduction When modeling network traffic, packet and connection arrivals are often assumed to be Poisson processes because such processes have attractive theoretical properties =-=[FM94]-=-. A number of studies have shown, however, that for both local-area and wide-area network traffic, the distribution of packet interarrivals clearly differs from exponential [JR86, G90, FL91, DJCME92].... |

142 | Telnet Protocol Specification - Postel - 1980 |

120 |
Load-balancing heuristics and process behavior
- Leland, Ott
- 1986
(Show Context)
Citation Context ...slands, cities and extinction events [K93, M63]. Leland and Ott also found that a Pareto distribution with 1:05 ! fi ! 1:25 is a good model for the amount of CPU time consumed by an arbitrary process =-=[LO86]-=-. In communications, heavy-tailed distributions have been used to model telephone call holding times [DMRW94] and frame sizes for variable-bit-rate video [GW94]. The discrete Pareto (Zipf) distributio... |

114 |
Supporting Real-time Applications
- Clark, Shenker, et al.
- 1992
(Show Context)
Citation Context ...pendence of packet traffic concerns classes with admissions control procedures 14that are based on measurements of recent traffic, rather than on policed traffic parameters of individual connections =-=[CSZ92]-=-. As has been shown by numerous researchers, such admissions control procedures could lead to a much more effective use of the available bandwidth [YKTH93]. Nevertheless, if the measured class has hig... |

111 |
Congestion control in ip/tcp internetworks (rfc-896
- Nagle
- 1984
(Show Context)
Citation Context ...sumes that each TELNET originator packet conveys one byte of user data, corresponding to a keystroke. Often, however, a packet carries more than one byte, either due to effects of the Nagle algorithm =-=[N84] or because the TELN-=-ET connection is operating in "line mode" [B90] or "line-at-a-time mode" [PR83, S94]. For example, the LBL PKT-2 TELNET originator traffic comprised about 85,000 packets carrying 1... |

95 |
Congestion control
- Nagle
- 1984
(Show Context)
Citation Context ...sumes that each TELNET originator packet conveys one byte of user data, corresponding to a keystroke. Often, however, a packet carries more than one byte, either due to effects of the Nagle algorithm =-=[N84]-=- or because the TELNET connection is operating in “line mode” [B90] or “line-at-a-time mode” [PR83, S94]. For example, the LBL PKT-2 TELNET originator traffic comprised about 85,000 packets carrying 1... |

93 |
Statistical methods for data with long-range dependence
- Beran
- 1992
(Show Context)
Citation Context ...lso used Whittle's procedure [GW94, LTWW94] and Beran's goodness-of-fit test [B92a] to gauge the agreement between the traffic and the simplest type of self-similar process, fractional Gaussian noise =-=[B92b]-=-. All of the results are consistent with selfsimilarity on scales of tens of seconds or more. We postulate that two different mechanisms contribute to the apparent self-similarity of TELNET traffic. O... |

93 | Local area network traffic characteristics, with implications for broadband networks congestion managementn
- Fowler, Leland
- 1991
(Show Context)
Citation Context ...erval might be well modeled by a homogeneous (fixed-rate) Poisson process. Telephone traffic, for example, is fairly well modeled during one-hour intervals using homogeneous Poisson arrival processes =-=[FL91]-=-. To evaluate these Poisson models, we developed a simple statistical methodology (Appendix A) for testing whether arrivals during a given one-hour or ten-minute interval are Poisson with a fixed rate... |

91 | An empirical workload model for driving wide-area tcp/ip network simulations
- Danzig, Jamin, et al.
- 1992
(Show Context)
Citation Context ...ects the burstiness found in actual TELNET traffic. (We do not model the TELNET response, only the user side.) The success with this model of using Tcplib packet interarrivals confirms the finding in =-=[DJCME92]-=- that the arrival pattern of user-generated TELNET packets has an invariant distribution, independent of network details. For small machine-generated bulk transfers such as SMTP (email) and NNTP (netw... |

90 |
Mail Routing and the Domain System
- Partridge
- 1986
(Show Context)
Citation Context ... SMTP connections are perturbed by mailing list explosions in which one connection immediately follows another, and possibly by timer effects due to using the Domain Name Service to locate MX records =-=[P86]. That FTP-=-DATA connection arrivals are clearly not Poisson can be readily attributed to the fact that "multiple-get" file transfers often result in a rapid succession of FTPDATA connections, one immed... |

77 | tcplib: A Library of TCP Internetwork Traffic Characteristics
- Danzig, Jamin
- 1991
(Show Context)
Citation Context ... bytes transferred in each direction. The BC and UCB traces are analyzed in depth in [DJCME92], and also in [P94a], and the UCB trace forms the basis of the connection characteristics used for Tcplib =-=[DJ91]. The NC, UK, a-=-nd DEC traces are analyzed in [P94a], and the LBL traces are analyzed in [P94a, P94b]. The "DEC 1-3" rows represents three wide-area TCP SYN/FIN traces, each spanning 1 day, and the "LB... |

72 | Growth Trends in Wide-Area TCP Connections - Paxson - 1994 |

71 | Statistical Analysis of CCSN/SS7 Traffic Data from Working CCS Subnetworks / Diane
- Duffy, McIntosh, et al.
(Show Context)
Citation Context ...1:05 ! fi ! 1:25 is a good model for the amount of CPU time consumed by an arbitrary process [LO86]. In communications, heavy-tailed distributions have been used to model telephone call holding times =-=[DMRW94]-=- and frame sizes for variable-bit-rate video [GW94]. The discrete Pareto (Zipf) distribution [A83, p.95]: P [x = n] = 1=((n + 1)(n + 2)) for ns0: arises in connection with platoon lengths for cars at ... |

71 |
Long-range dependence: A review", in statistics: An appraisal
- Cox
- 1984
(Show Context)
Citation Context ... more precise notion of sustained correlation is that of “long-range dependence.” A stationary process is long-range dependent if its autocorrelation function r(k) is nonsummable (i.e., ∑ k r(k) = ∞) =-=[C84]-=-. Thus, the definition of long-range dependence applies only to infinite time series. The simplest models with long-range dependence are selfsimilar processes, which are characterized by hyperbolicall... |

68 | A measurement study of diskless workstation tra c on an ethernet - Gusella - 1990 |

64 | Contributions toward real-time services on packet switched networks - Garrett - 1993 |

59 |
On per-session end-to-end delay distributions and the call admission problem for real-time applications with QoS requirements
- Yates, Kurose, et al.
- 1993
(Show Context)
Citation Context ... traffic parameters of individual connections [CSZ92]. As has been shown by numerous researchers, such admissions control procedures could lead to a much more effective use of the available bandwidth =-=[YKTH93]-=-. Nevertheless, if the measured class has high burstiness consisting of both a high variance and significant long-range dependence, then an admissions control procedure that considers only recent traf... |

49 |
New Methods in Statistical Economics
- Mandelbrot
- 1963
(Show Context)
Citation Context ...d mixture of distributions), and because this is true of no other distribution, this invariance could in some respects explain the widespread observance of Pareto distributions in the social sciences =-=[M63]-=- [M83, p.344]. C Pareto interpacket times In this section we give some intuition for the observed long-range dependence of traces of TELNET traffic. Recall that the main body of the distribution of TE... |

42 |
Long-Range Dependence: A Review," in Statistics: An Appraisal
- Cox
- 1984
(Show Context)
Citation Context ... more precise notion of sustained correlation is that of "long-range dependence." A stationary process is long-range dependentsif its autocorrelation function r(k) is nonsummable (i.e., P k =-=r(k) = 1) [C84]-=-. Thus, the definition of long-range dependence applies only to infinite time series. The simplest models with long-range dependence are self-similar processes, which are characterized by hyperbolical... |

37 |
Variable-bit-rate Video Traffic and Long Range Dependence
- Beran, Sherman, et al.
- 1995
(Show Context)
Citation Context ...with location parameter a and shape parameter fi, for 1 ! fi ! 2. From Equation 4, the autocorrelation function r(k) is as follows: r(k) = ae Z 1 k i a x j fi dx: = aea fi fi 0 1 k (10fi) : Following =-=[BSTW94]-=-, the process fX t g t=0;1;2;::: is asymptotically self-similar if r(k)sk 0D L(k) as k !1; (5) for 0 ! D ! 1 and L a slowly-varying function. 2 Thus, for as0 and 1 ! fi ! 2, the count process of the M... |

33 | On Traffic Phase Effects - Floyd, Jacobson - 1991 |

21 |
Asymptotic expansion for waiting time probabilities in an M/G/1 queue with long-tailed service time, Queueing Systems 10
- Willekens, Teugels
- 1992
(Show Context)
Citation Context ... we note that our source model of TELNET connections presented in x 5 in some respects matches the M/G/1 model described in the previous section. TELNET connection sizes in packets have a long-tailed =-=[WT92]-=- distribution, in that the tail function of a log-normal distribution decreases more slowly than any exponential function. While we show in Appendix E that the M/G/1 queue with log-normal service time... |

20 |
A goodness-of-fit test for time series with long range dependence
- Beran
- 1992
(Show Context)
Citation Context ...so occur due to the presence of non-stationarity. In addition to looking at variance-time plots of the TELNET traffic, we also used Whittle's procedure [GW94, LTWW94] and Beran's goodness-of-fit test =-=[B92a]-=- to gauge the agreement between the traffic and the simplest type of self-similar process, fractional Gaussian noise [B92b]. All of the results are consistent with selfsimilarity on scales of tens of ... |

19 |
Estimates of distributions of random variables for certain computer communications traffic models
- Fuchs, Jackson
- 1970
(Show Context)
Citation Context ... do not fit a Poisson model, since earlier work looking at many different components of interactive traffic failed to find any statistically significant exponential fits to the observed distributions =-=[FJ70]-=-. This leaves the question: What are the consequences of using Poisson packet arrivals rather than the Tcplib distribution for TELNET traffic? (Row 1: Tcplib Interarrivals. Row 2: Exponential Interarr... |

13 |
Telnet Linemode Option
- Borman, Editor
- 1989
(Show Context)
Citation Context ...ata, corresponding to a keystroke. Often, however, a packet carries more than one byte, either due to effects of the Nagle algorithm [N84] or because the TELNET connection is operating in "line m=-=ode" [B90] or "-=-line-at-a-time mode" [PR83, S94]. For example, the LBL PKT-2 TELNET originator traffic comprised about 85,000 packets carrying 139,000 user data bytes. Given these difficulties, we attempted to f... |

12 |
Load-balancing Heuristics and
- Leland, Ott
- 1986
(Show Context)
Citation Context ...islands, cities and extinction events [K93, M63]. Leland and Ott also found that a Pareto distribution with 1.05 < β < 1.25 is a good model for the amount of CPU time consumed by an arbitrary process =-=[LO86]-=-. In communications, heavy-tailed distributions have been used to model telephone call holding times [DMRW94] and frame sizes for variable-bit-rate video [GW94]. The discrete Pareto (Zipf) distributio... |

9 | Long-term traffic aspects of the NSFNET
- Claffy, Braun, et al.
(Show Context)
Citation Context ...ivals This section investigates arrival processes for FTP traffic. Modeling FTP is particularly important because FTPDATA connections currently carry the bulk of the data bytes in wide area networks (=-=[CBP93]-=-). Section 3 showed that while FTP session arrivals can be modeled as Poisson processes, this is not the case for FTPDATA connection arrivals. This section shows that FTPDATA connections within a sess... |

8 |
Statistics of Mixed Data Traffic on a Local Area Network
- Marshall, Morgan
- 1985
(Show Context)
Citation Context ...isson fit somewhat, but still falls short of statistical consistency. The finding that TELNET connection arrivals are well-modeled as a Poisson process with fixed hourly rates is at odds with that of =-=[MM85], who foun-=-d that user interarrival times looked "roughly log-normal". We believe the discrepancy is due to characterizing the distribution of all of the interarrivals lumped together, rather than post... |

7 | Growth Trends in Wide-Area TCP - Paxson - 1994 |

6 | private communication - Willinger - 2001 |

4 |
Tailweight, statistical inference, and families of distributions�a brief survey
- Hettmansperger, Keenan
- 1980
(Show Context)
Citation Context ...discusses the Pareto distribution and its occurrence in the physical world. The classical Pareto distribution with shape parameter fi and location parameter a has the cumulative distribution function =-=[HK80]-=-: F (x) = P [Xsx] = 1 0 (a=x) fi ; a; fis0; xsa; with the corresponding probability density function: f(x) = fia fi x 0fi01 : 13 If fis2, then the distribution has infinite variance, and if fis1, then... |

4 | Self-Organized Criticality," Scientific American - Bak, Chen - 1991 |

4 | Goodness-of-Fit Techniques - B, Stephens - 1986 |

4 |
Statistics of Mixed Data Traffic on a
- Marshall, Morgan
- 1985
(Show Context)
Citation Context ...oisson fit somewhat, but still falls short of statistical consistency. The finding that TELNET connection arrivals are wellmodeled as a Poisson process with fixed hourly rates is at odds with that of =-=[MM85]-=-, who found that user interarrival times looked “roughly log-normal”. We believe the discrepancy is due to characterizing the distribution of all of the interarrivals lumped together, rather than post... |

1 |
gordoni@netcom.com), "ufs'93 [Updated file size survey results]," USENET newsgroup comp.os.research, message 2ddp3b$jn5@darkstar.UCSC.EDU
- Irlam
(Show Context)
Citation Context ... bursts will vary considerably from one time to another; but they will be present. We also note that our finding that the size of an FTPDATA burst has a heavy tail matches a survey conducted by Irlam =-=[I93]-=- of the sizes of files in 1,000 file systems comprising 12 million files and 250 GB of data: 1.9% of the files accounted for 71% of the bytes, and 0.5% accounted for 54% of the bytes. We performed fit... |

1 |
gordoni@netcom.com), “ufs’93 [Updated file size survey results],” USENET newsgroup comp.os.re-search, message 2ddp3b$jn5@darkstar.UCSC.EDU
- Irlam
(Show Context)
Citation Context ... bursts will vary considerably from one time to another; but they will be present. We also note that our finding that the size of an FTPDATA burst has a heavy tail matches a survey conducted by Irlam =-=[I93]-=- of the sizes of files in 1,000 file systems comprising 12 million files and 250 GB of data: 1.9% of the files accounted for 71% of the bytes, and 0.5% accounted for 54% of the bytes. We performed fit... |

1 | Empirical Workload Model for Driving Widearea TCP/IP - Estrin - 1992 |

1 | Telnet Protocol Specification,” RFC 854, Network - Postel, Reynolds - 1983 |