PhD Student: Ana Novak Supervisors: Prof Peter Taylor & Dr Darryl Veitch Active Probing Using Packet-Pair Probing to Estimate Packet Size and Packet Arrival Rate Department of Mathematics & Statistics Melbourne University

Introduction Concept of a Packet NAME: Billy Bob MESSAGE: How are you today Sarah Jo? Billy BobSarah Jo

NAME: Billy Bob Introduction Concept of a Packet NAME: Billy Bob MESSAGE: How are you today Sarah Jo? Billy BobSarah Jo NAME: Billy Bob DEPO NAME: Billy Bob

Introduction Concept of a Packet Billy BobSarah Jo DEPO otmail.com NAME: Billy Bob MESSAGE: How are you today Sarah Jo?

Introduction Concept of a Packet Billy BobSarah Jo DEPO MESSAGE How are... NAME: Billy Bob MESSAGE: How are you today Sarah Jo? MESSAGE: How are yo today Sara MESSAGE: How are you today Sarah Jo?

Fundamental Approaches to Measurement Passive measurement  Monitoring  Typically at a point  Non-invasive  Network authority Active measurement  Injecting artificial traffic stream  End-to-End  Fundamentally invasive  Non-privileged users

Active Probing Infrastructure Time stamp; Packet header; Packet content Raw information captured:

Timestamps  Sender Monitor timestamps probe arrivals to the network.  Receiver Monitor timestamps probe departures from the network. SenderReceiver Sender Monitor:Receiver Monitor:

Timestamps  As the clocks on the sender and receiver monitors may not be synchronized we use inter-arrival and inter-departure times, rather then the end-to-end delays.

Description of the 1-hop system  Service is offered in a FIFO order.  The server processes at rate. Single Hop Model

Probe Traffic & Cross Traffic Definitions: Probe Traffic (PT) is an artificial stream of traffic, all of whose properties are known and can be modified and controlled. Cross Traffic (CT) is any traffic in the Internet that is not Probe Traffic.

Types of CT Arrivals  Single Channel (M/D/1 output)  Multi Channel (Poisson)

Packet-Pair Pairs of probes are sent periodically with period T, intra-pair spacing r and packet service time x p. Types of Probe Traffic

 Lets construct the following experiment:  Inject a packet-pair probe stream into the network s.t. probes are “back-to-back” and, where x c is the CT service time.  Output of the experiment  Probes capture 1 or 0 CT packets. Estimating Cross Traffic Size Single Channel (M/D/1 output)

 Cross Traffic packet size estimate: where is the i-th inter-departure time, is the probe service time and is the link rate. Estimating Cross Traffic Size Single Channel (M/D/1 output) To Summarize:

Estimating CT Size Example  Cross Traffic sizes: 100B, 500B, 1000B, 1500B  Respective arrival rates: 600pkt/s, 100pkt/s, 300pkt/s, 800pkt/s  Other parameters: Link rate: 2MBps; Cross Traffic packet size: 1000B; Probes packet size: 40B; Probe rate: 10pkt/s; Probe separation: 10ms Single Channel (M/D/1 output)

Estimating CT Size Example  Cross Traffic sizes: 100B, 500B, 1000B, 1500B  Respective arrival rates: 600pkt/s, 100pkt/s, 300pkt/s, 800pkt/s  Other parameters: Link rate: 2MBps; Cross Traffic packet size: 1000B; Probes packet size: 40B; Probe rate: 10pkt/s; Probe separation: s Single Channel (M/D/1 output)

Method 1: Back-to-back probes { M/D/1 } Method 2: Back-to-back probes { Poisson } Method 3: Not back-to-back probes { Poisson } Estimating CT Arrival Rate (Assumption: Single CT size)

Incentive: Exploit the same probe stream used for estimating Cross Traffic size. Recap. Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times) Recap. Outcome: Array of inter-departure times corresponding to catching 1 CT packet (success) or 0 CT packets (failure). Model: Numerical outcome of the experiment is a r.v. Y with a Binomial distribution, B(n,p) Method 1: Back-to-back probes Single Channel (M/D/1 output)

 Cross Traffic arrival rate estimate in [pkt/s]:  For large values of n, if experimental value of Y is y, the 95.4% confidence interval for arrival rate estimate is: Method 1: Back-to-back probes Single Channel (M/D/1 output)

Method 1: Back-to-back probes Single Channel (M/D/1 output) x c =0.9 Predicted confidence interval Example x c = 0.9ms CT a.r. = 1000 pkt/s n = 1000 p-p best c.i = + /- 10%

Mathematical Incentive: Rectify the problem of obtaining very low probabilities of packet capture, which result in a large confidence interval for arrival rate estimate (eliminate the upper bound ). Physical Incentive: CT Traffic can be better approximated with a multi-channel (Poisson) arrivals. Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times). Method 2: Back-to-back probes Multi Channel (Poisson)

Model: Numerical outcome of the experiment is a r.v. Y with a Poisson distribution,. Method 2: Back-to-back probes Multi Channel (Poisson) Outcome: Array of inter-departure times corresponding to capturing m packets in an interval of length r.

Method 2: Back-to-back probes  The probability of capturing m packets in an interval of length r:  The sample average is the MLE of where Multi Channel (Poisson)

Method 2: Back-to-back probes  Respective exact 95% confidence interval is: where is the inverse of the chi-square cumulative distribution function. Multi Channel (Poisson)

Method 2: Back-to-back probes Multi Channel (Poisson) Predicted confidence interval Example x c = 0.01s CT a.r. = 1000 pkt/s n = 1000 p-p best c.i = + /- 1%

Incentive: Reduce invasiveness. In a multi-hop this is the inevitable effect. Experiment: Inject a stream of n probe-pairs into the network with intra-pair separation r, such that we can capture at least k =ceil( r / x c) CT packets (i.e. array of inter-arrival times). Outcome: Array of inter-departure times, of which some correspond to capturing m packets in an interval of length r. Model: It will become apparent later… Method 3: Not back-to-back probes Multi Channel (Poisson)

Busy and Idle Periods System passes through alternating cycles of busy and idle periods.  Busy period is when queue is never empty.  Idle period is when queue is always empty.

Why do we care about busy and idle periods?  If the probes share the same busy period the inter-departure times let us know how many packets arrived in time interval r.  If probes are in different busy periods then the inter-departure times don’t give us any conclusive information.

If two probes within a packet-pair: Peaks vs. Noise  Share the same busy period then the corresponding inter- departure time will contribute to a formation of a peak.  Don’t share the same busy period then the corresponding inter- departure time will contribute to a formation of noise.

 As it stands, it looks like we could model the numerical outcomes from the set B as a Poisson distribution. But, that is not quite true. Why? Set of all measured inter-departure times A Inter-departure times which are a result of probes sharing the same busy period (i.e. peaks) B Filtering-out noise

Problem: If then one of the following happened: Method 3: Not back-to-back probes Multi Channel (Poisson)  First probe saw the busy period and was delayed, as a result we caught an integer number of packets.  We cannot tell from the inter- departure time that 4 consecutive packets have arrived.

Therefore if probes are not back-to-back then the outcome that two probe-packets occur in the same busy period is dependent on how many packets were caught. Method 3: Not back-to-back probes Multi Channel (Poisson)  If a number of CT packets we caught is greater then k, then the two probe packets must necessarily be in the same busy period.  The converse does not hold.

Conclusion: If an inter-departure time, then we filter it out. Method 3: Not back-to-back probes Multi Channel (Poisson) Set of all measured inter-departure times A Inter-departure times which are a result of probes sharing the same busy period (i.e. peaks) B C Inter-departure times which are a result of probes sharing the same busy period and are greater then r.

Method 3: Not back-to-back probes  Probability of capturing k CT packets in the interval of length r if we exclude the events of capturing {0,1,…,m} CT packets is: Multi Channel (Poisson) Model: Numerical outcome of the filtered experiment is a r.v. Y with a Truncated-Poisson distribution.

Method 3: Not back-to-back probes  The mean is :  The second moment is:  The variance is: Multi Channel (Poisson)

Mixed Truncated Poisson Distribution  After each filtration, number of valid experiments (i.e. successful probe-pairs) reduces.  Can we preserve the valid data i.e. ?  Yes. The answer is the Mixed Truncated Poisson Distribution.  where and is the weight of the i-th factor. Multi Channel (Poisson)

 Complete the algorithm for finding an optimal intra-pair separation.  Extend Methods for the traffic that comprises of multiple CT sizes.  Find the exact distribution for the Method 3.  Use Takacs integrodifferential equation to determine if probes are in the same busy period for an M/G/1 queue (continuous case).  Solve the problem for a multiple hop case. Future Work