1. CMPE 252A: Computer Networks
Lecture 15
CMPE252A Fall 2003

2. Announcements Homework 3. Final exam: 12.11.2003 from 12-3pm.
Project 3 due on (by midnight).
CMPE252A Fall 2003

3. Today Internet characterization (cont’d). Overlays.
OSPF talk by Aman Shaikh.
CMPE252A Fall 2003

4. Self-Similarity in Web traffic [Crovella97a]
CMPE252A Fall 2003

5. Traffic Modeling Paxson showed microscopic traffic effects.
E.g., packet loss, delay, reordering, bw, etc.
What about macroscopic traffic behavior?
What do traffic aggregates look like?
Conventional wisdom: traffic is generated by Poisson sources, i.e., it would “smooth out” at large timescales.
CMPE252A Fall 2003

6. Traffic analysis: some history
Phone network:
Call arrivals are independent.
Interarrival times exponentially distributed.
Call durations are exponentially distributed.
Voice traffic is:
Relatively predictable.
Very amenable to mathematical analysis.
Queuing theory.
Will this change with more fax & data?
CMPE252A Fall 2003

7. Basic random processes
How to model arrival processes?
E.g., users to a computer room, or packets to a router, etc.
Define an arrival probability
a(t) := P[object arrives at time t] => pdf
A(t) := P[object arrives at t0<t] => cdf
Arrival rate := 
-1 = E[a(t)]
CMPE252A Fall 2003

8. Examples What’s a(t) of a clock that ticks every second? ( = 1)
assuming it’s just ticked?
assuming it ticked 0.5s ago?
What’s a(t) for a clock that ticks randomly between [0,2]s? ( = 1)
if it just ticked, or if it hasn’t ticked for 1s
Is there an a(t) that doesn’t change as a function of when the clock last ticked?
i.e., is memoryless
CMPE252A Fall 2003

9. Poisson Processes Poisson traffic
([Kleinrock75a],
figure 2.13)
Poisson traffic
a(t) = e-t probability next arrival is at t
 is arrival rate (steady over time)
Memoryless
a(t) that doesn’t change as a function of when the last arrival happened.
CMPE252A Fall 2003

10. Traffic at different time scales
Poisson
Measured
(Figure 1
from [Willinger98a]) 1s
bursty
bursty
10s
timescale averaged over
100s
smooth
still
bursty!
1000s
CMPE252A Fall 2003

11. Measured Data Shows burstiness at many different scales.
No natural burst length.
… unlike Poisson.
But what does this mean?
Hard to model with Poisson
Needs more parameters not just arrival rate .
Models with just simple  may not match real traffic.
CMPE252A Fall 2003

12. At different time-scales…
Poisson gets smoother at larger m, but Internet traffic stays bursty.
Question: how can we model bursty traffic?
CMPE252A Fall 2003

13. A Hint: Fractals
Definition: class of objects with surprising scaling properties.
Example: length of coastline depends on level of detail.
No “natural” length for these objects.
CMPE252A Fall 2003

14. Fractals, self-similarity and traffic
Measured
Fractal
fractal tfc
looks like
measured tfc
but…
how can we
characterize
burstiness
(and why does
it happen?)
Self-similarity
i.e., looks
like itself
(bursty)
at different
time-scales
CMPE252A Fall 2003

15. Characteristics of Self-similarity
Variance decays slowly as m increases.
Self-sim: Var(X(m)) ~ a m-, 0< <1
Poisson: Var(X(m)) ~ a m-1
I.e., self-sim remains bursty (high variance).
Autocorrelation [r(k)] decays hyperbolically rather than exponentially
self-sim: r(m)(k) ~ k -, where r(k) is autocorrelation spaced by k
Poisson: r(m)(k) ~ 0 as m  
I.e., self-sim has long-range dependence.
CMPE252A Fall 2003

16. Time-Variance Plot variance decays slowly as m increases
(Figure 5b, [Leland94a])
variance decays slowly as m increases
self-sim: Var(X(m)) ~ a m-, 0< <1
i.e., self-sim remains bursty (high variance)
time-variance plot captures decay of variance
time (in m, scale) vs. variance
time-variance plot
CMPE252A Fall 2003

17. R/S Plot
Autocorrelation [r(k)] decays hyperbolically rather than exponentially
Self-sim: r(m)(k) ~ k -, where r(k) is autocorrelation spaced by k
I.e., self-sim has long-range dependence.
R/S Plot captures autocorrelation via H (the Hurst parameter)
H is the slope on the R/S plot
H=1- /2.
R/S plot
(Figure 5a, [Leland94a])
CMPE252A Fall 2003

18. Modeling Self-Similiarty
Can describe with Hurst parameter, H
0.5 < H < 1
H = 1 – (/2)
Can generate from (artificial) models.
Fractional Gaussian noise.
Parameters: mean , variance 2, autocorrelation: r(k) = ( | k+1 | 2H - | k | 2H + | k-1| 2H ) / 2
Fractional autoregressive integrated moving-average process.
CMPE252A Fall 2003

19. Implications for networking
Queueing delays can be much higher than if all sources were Poisson.
Need large buffers to avoid dropping packets.
Cannot rely on techniques that determine future buffer requirements based on recent past.
But, we haven’t yet looked at why:
What aspect of networks causes self-similarity?
CMPE252A Fall 2003

20. But why is the traffic Self-similar?
Observation: superposition of heavy tailed on-off processes is self-similar.
and many things have heavy tails.
Web pages, files sizes, CPU job duration,…
And network traffic is sort of on-off
Get web page, think, repeat
Suggested in [Leland94a], verified in [Crovella97a].
But still under debate…
CMPE252A Fall 2003

21. Pareto distribution: a simple heavy-tailed distribution
pdf: p(x) =  k x--1
cdf: P[X  x] = x-, for 0 <  < 2
when  < 2, the variance of the distribution is infinite, when  < 1, the mean is infinite
for network traffic, 1.2 <  < 1.8
CMPE252A Fall 2003

22. Web Traffic Self-Similar
Time-variance plot shows that the Hurst parameter is 0.76
Web traffic at a campus site, at high enough loads, is self-similar.
Confirms results of Leland et al. study.
(Leland et al. looked at aggregate of all traffic)
([Crovella97a] figure 1)
CMPE252A Fall 2003

23. Analyzing Web traffic
Change browser to log request start and end times, and file sizes transferred.
Analyze four busiest periods.
More long-range dependence in the busy periods
Show that the Hurst parameter is significantly different from 0.5
Use variance-time plots, R/S plots, periodogram
CMPE252A Fall 2003

24. Superimposing Heavy Tails
What aspect of Web traffic is heavy-tailed?
CMPE252A Fall 2003

25. Web ON Times ..because file sizes are heavy-tailed
On times are heavy-tailed…
([Crovella97a] figures 3 & 4)
CMPE252A Fall 2003

26. Web OFF Times Two different regimes
Active OFF
Display, rendering time.
Inactive OFF
User-think time.
Crovella says inactive-off is heavy tailed
Others have modeled as Poisson
CMPE252A Fall 2003

27. Summary Aggregate Ethernet traffic is self-similar
Shown statstically.
Web transfers are heavy tailed
ON times are heavy-tailed because file sizes are heavy tailed.
Provides physical interpretation.
CMPE252A Fall 2003

28. A more complex story But traffic cannot be exactly self-similar.
Connections are finite.
Can never really see infinite variance.
And, what happens at fine timescales?
Instead, traffic is multi-fractal
Some behavior at fine timescales (<few RTT).
Self-similarity at medium timescales (few RTT to hour/hours).
Longer-term behavior dominated by outside factors (e.g., daily work cycles).
CMPE252A Fall 2003

29. Are there other causes of self-similarity?
Heavy-tailed on-off processes
but could be just a cause, not necessarily the only cause
What about protocols?
TCP retransmit behavior (Figueiredo et al, U. Mass)
Explains self-sim over several orders of magnitude
Does topology matter? (Feldmann et al, SIGCOMM 1999)
CMPE252A Fall 2003

30. Traffic at high levels of aggregation
What about traffic levels at very high levels of aggregation (i.e., Gb/s)?
Some recent work suggests that traffic does smooth out with enough users and enough traffic
Intuition: each individual can only give so much burstiness, in a big enough pipe they get lost
CMPE252A Fall 2003

31. Implications For modeling network traffic:
Should use appropriate models (not just Poisson).
Should study at many time-scales.
CMPE252A Fall 2003

32. Overlays
CMPE252A Fall 2003

33. What are overlays?
Logical topology superimposed on network physical topology.
CMPE252A Fall 2003

34. Overlays at different layers
Overlays at network layer: routing overlays.
Overlays at application layer: application-layer overlays.
Example: Distributed, replicated databases.
CMPE252A Fall 2003

35. Why overlays? performance
Different graphs for different requirements.
QoS guarantees:
Compute overlay that provides required delay bounds.
Network resource usage:
Compute graph that uses least number of hops.
This is what current Internet routing algorithms do, i.e., shortest-path using number of hops as cost.
CMPE252A Fall 2003

36. Why overlays? security and robustness
Set up overlay carrying data encrypted e2e.
Robustness:
Compute several overlays.
Randomly switch among them.
CMPE252A Fall 2003

37. Resilient Overlay Networks [Andersen01]
CMPE252A Fall 2003

38. Goal Robustness! Application-specific QoS.
Circumvents routing convergence delays.
E.g., BGP may take several minutes to recover.
Application-specific QoS.
Path selection based on application-specific requirements.
CMPE252A Fall 2003

39. RON: approach
RON nodes cooperate to forward data on behalf of any pair of RON nodes.
Rely on network redundancy to find alternate paths.
Probes and monitors paths.
RON nodes exchange information abut paths.
Build “routing tables” based on latency, loss, throughput, etc.
CMPE252A Fall 2003

40. Architecture RON client: application program communicating with RON.
Overlay: group of clients collaborating in providing distributed service.
RON client  RON node through conduit.
RON entry node: classifies packet, chooses path, encapsulates with RON header, and forwards.
Intermediate RON nodes, forward packets.
Exit node delivers packet to application.
CMPE252A Fall 2003

41. Conduit API send(pkt, dst, via-ron). recv(pkt, via-ron).
Sends packet to a destination RON using the RON or not.
recv(pkt, via-ron).
Callback function called when packet arrives for client.
CMPE252A Fall 2003

42. RON router Implements routing protocol.
Entry node tags packet with flow id.
Subsequent nodes try to keep packets of the same flow on same path.
Speed-up forwarding.
More predictable application-specific performance.
CMPE252A Fall 2003

43. Routing metrics
RON nodes keep different routing metrics per virtual link.
Latency,
Packet loss,
Throughput.
Link-state routing.
Each node disseminates its view about other N-1 virtual links to other nodes.
Nodes compute routing table based on this information.
Link-state update propagates via RON.
CMPE252A Fall 2003

44. Path evaluation Outage detection uses active probing.
Low frequency probing till loss detected.
High frequency probing is then used.
If OUTAGE_THRESH probes have no response, link failure.
Paths are ranked according to their loss rate.
CMPE252A Fall 2003

45. Minimizing latency Link latency computed as:
latl = alpha*latl + (1-alpha)* new-sample,
where alpha = 90%.
Path latency = summation of each link latency.
CMPE252A Fall 2003

46. Loss rate estimation Average of last 100 probes. Why not EWMA?
Path loss rate is given by product of link loss rates.
Assume links loss rates are independent.
CMPE252A Fall 2003

47. Throughput estimation
TCP-type traffic.
Uses TCP-friendly formula.
Throughput as a function of drop rate and RTT.
RON does not try to optimize throughput but picks lower throughput paths when available.
CMPE252A Fall 2003

48. Data forwarding
If packet is for local node, look at packet type to identify RON client.
Else, check flow id; if there’s already cached entry, then use it.
Else, routing table lookup.
Examines policy tag.
Examines routing preference flags.
CMPE252A Fall 2003