COMPSAC'14 - N. Larrieu /07/ How to generate realistic network traffic? Antoine VARET and Nicolas LARRIEU COMPSAC – Vasteras – July the 23 rd, 2014 French Civil Aviation University (ENAC) TELECOM Laboratory

COMPSAC'14 - N. Larrieu /07/ Why do we need realistic traffic? To evaluate performances of new network entities – By face them to generated traffic with characteristics as close as possible as the Internet traffic Lack of adequate tools to generate data flows with “realistic behaviors” at the network or transport level

COMPSAC'14 - N. Larrieu /07/ Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

COMPSAC'14 - N. Larrieu /07/ Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

COMPSAC'14 - N. Larrieu /07/ Different tools for different purposes Available traffic generators – Network simulators: NS-2 [5], OpNet [6] or OmNet++ [7]  On Off sources built-in but inside the simulator – Traffic replay tools: Tcpreplay [8], Harpoon [9]  Need first to acquire the traffic trace to replay  Mostly packel-level tools, not flow-level tools  Retransmit the sniffed packets in the same order, and separated with the same delays as these measured during the capture – Network throughput estimation tools: iperf [10], BWPing [11], Ttcp [12], NetPerf [13], NetPerfMeter [14], Ostinato [15] Interesting throughput statistics  Single flow or multiple synchornized flows generation  Development of our traffic generator, the SourcesOnOff tool!

COMPSAC'14 - N. Larrieu /07/ How to characterize an “Internet-like” traffic profile? Internet cannot be solely characterized with a small set of parameters (e.g. some mathematical distributions and additional factors) Not currently one unique mathematical modeling able to embrace the different characteristics and the complexity of the Internet traffic [1] “Internet” can cover very different profiles, but some common properties can be highlighted: – High variability – Self-similarity

COMPSAC'14 - N. Larrieu /07/ Internet traffic characteristics High variability is characterized by an infinite mathematical variance and means that sudden discontinuous changes can always occur – Some mathematical distributions like Pareto and Weibull are heavy-tailed (i.e. the tail of the distribution is not exponentially bounded) and thus can be used to generate sets of values with high variances and also high- variability [2, 3] Self-similarity is defined by a long-range dependence characteristic, which means there are bursts of traffic any time over a wide range of time scales. – W. Willinger found in [4] a relation between self-similarity and high variability for Ethernet Local Area Network (LAN) throughputs – The author showed that using ON/OFF sources with heavy-tailed distributions causes the traffic streams to be highly variable and, consequently, the aggregation of these streams to be also self-similar and highly variable

COMPSAC'14 - N. Larrieu /07/ ON-OFF sources principles (1)

COMPSAC'14 - N. Larrieu /07/ ON-OFF sources principles (2) Sources parameters (based on random distribution) – Doff distribution: departure time of any source is computed with the departure time (second) of the preceding source plus a random duration. The first source starts at the beginning of the process. – Don distribution: duration times of any source. We generate random values, not for time duration in seconds but for quantity of transmission in bytes (because of TCP congestion control mechanism) Statistical sources generations – Don and Doff distributions follow statistical processes with heavy-tail characteristic (i.e. Weibull or Pareto laws) – Don and Doff distributions are statistical independent

COMPSAC'14 - N. Larrieu /07/ Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

COMPSAC'14 - N. Larrieu /07/ SourcesOnOff design Random distributions type – Constant, Uniform, Dirac – Normal/Gaussian, Poisson – Pareto, Weibull and Exponential Flow characteristics – Don values: kB, MB, GB, – Doff values: us, ms, s – UDP and TCP traffic flows Available under General Public License v3 (GPLv3) & the CeCiLLv2 license at ~avaret/sourcesonoff ~avaret/sourcesonoff

COMPSAC'14 - N. Larrieu /07/ Statistic profile extraction from a real traffic trace Statistic profile extraction process in 2 steps: 1.Traffic trace decomposition algorithm 2.Distance criterion to evaluate the differences between real original data and data generated by our tool

COMPSAC'14 - N. Larrieu /07/ Step 1: traffic trace decomposition process Original trace is decomposed in a sum of different standard statistical laws: Constant, Uniform, Dirac, Normal, Gaussian, Poisson, Pareto, Weibull or Exponential For each standard statistical law, its whole range of law parameters is considered – The best set of parameters is kept for each standard law we want to considered for the final aggregation – Need of a distance criterion for each standard law and aggregated final model  Bayesian Information Criterion (BIC)

COMPSAC'14 - N. Larrieu /07/ Step 2: BIC (Bayesian Information Criterion) distance assessment BIC = k * ln(n) – 2 * ln(L), where: – n is the size of analyzed data; – L is the likelihood of the model (Weibull, Pareto, Exponential…) regarding the different original data; – k is the total number of estimated parameters.

COMPSAC'14 - N. Larrieu /07/ Outline 1.State of the art of traffic generation tools 2.Principles of the SourcesOnOff tool 3.Validation of realism level for traffic generated by our tool

COMPSAC'14 - N. Larrieu /07/ Validation of the SourcesOnOff tool Different network traces captured: between 10 minutes and 10 hours POP: Internet entry router for the 150 users of our research department Validation results based on a 10 hours capture (8:00AM - 6:00PM), Tuesday the 29th of January, 2013 – 9 millions of IPv4 packets, mostly TCP data (97.7% of TCP, 2.2% of UDP and 0.1% of ICMP) Experimental process 1.Traffic statistical profile extraction 2.Traffic generation 3.Characteristics comparaison between original traffic trace and generated traffic

COMPSAC'14 - N. Larrieu /07/ Statistic profile detection Results for distribution modeling – Don (left side): Weibull function – Doff (right side): composition of Weibull and Dirac functions

COMPSAC'14 - N. Larrieu /07/ Verification of generated traffic correctness (1) Qualitative analysis – Quantile-quantile plots (Don and Doff values for real and generated traffic) – Autocorrelation checking (real vs. generated traffic)

COMPSAC'14 - N. Larrieu /07/ Verification of generated traffic correctness (2) Quantitative analysis – BIC distance – Hurst exponent computation

COMPSAC'14 - N. Larrieu /07/ Conclusion & Future Work Summary – Methodology to generate network traffic with realistic characteristics – SourceOnOff tool developed, based on the application of ON/OFF sources with different statistical profiles Parameters of the distributions can be defined by the user or extracted from real traffic analysis Freely available (under GPLv3 & CeCiLLv2 licenses) and may be utilized for a wide variety of network traffic profiles – Validation of both the traffic generation methodology and the SourcesOnOff tool Our tool is able to generate traffic with the same characteristics as real ones Perspectives – Tool development Supporting additional traffic (ICMP for instance) Supporting additional statistical distributions – Tool applications Consider more complex network topologies (cloud computing applications for instance)  Distribute different SourcesOnOff sender and receiver agents among the cloud

COMPSAC'14 - N. Larrieu /07/ References [1] Olivier P. and Benameur N., Flow Level IP traffic characterization, France Télécom, 2000 [2] Olivier P. and Benameur N., Flow Level IP traffic characterization, France Télécom, 2000 [3] Leland W. E., Taqqu S. M., Willinger W. and Wilson D. V., On the Self-Similar Nature of Ethernet Traffic, (Extended Version) IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 2, NO. 1, FEBRUARY 1994 [4] Willinger W., Taqqu M. S., Sherman R. and Wilson D. V., Self-Similarity Through High-Variability: Statistical Analysis of Ethernet LAN Traffic at the Source Level, IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 5, NO. 1, FEBRUARY 1997 [5] The Network Simulator - ns-2, /01/21 [6] The Opnet Website, /01/21 [7] OMNet++ Network Simulation Framework website, /01/21 [8] Tcpreplay website: [9] Harpoon website: [10] iperf, a modern alternative for measuring maximum TCP and UDP bandwidth performance, [11] BWPing, Open Source bandwidth measurement tool, /01/21 [12] 2010 ttcp(1) test TCP/UDP performance, /01/21 [13] The NetPerf HomePage, /01/21 [14] Dreibholz T NetPerfMeter, A TCP/UDP/SCTP/DCCP Network Performance Meter Tool, /12/21 [15] Ostinato website :

COMPSAC'14 - N. Larrieu /07/ Questions? How to generate realistic network traffic? SourcesOnOff tool available at Contact: Nicolas LARRIEU ENAC / Telecom Laboratory