1. Advanced Technology Laboratories 8 December 2000 page 1 Characterization of Traffic at a Backbone POP Nina Taft Supratik Bhattacharyya Jorjeta Jetcheva Christophe Diot

2. Advanced Technology Laboratories 8 December 2000 page 2 Questions : Where does the traffic come from? Between any two POPs : What is the volume of traffic? What are the traffic patterns?

3. Advanced Technology Laboratories 8 December 2000 page 3 Applications Traffic Engineering Verify BGP peering Intra-domain routing Writing SLAs

4. Advanced Technology Laboratories 8 December 2000 page 4 Sprint IP Monitoring Project Insert optical splitters in multiple POPs and on numerous links within each POP. Currently monitoring OC3 access links Collect and timestamp all IP headers Collect routing information (IS-IS, BGP) Transfer data to lab for off-line analysis

5. Advanced Technology Laboratories 8 December 2000 page 5 Traffic Matrix For each ingress POP : identify traffic to each egress POP further analyze this traffic City A City B City C City A City B City C Measure traffic over different timescales Divide traffic per destination prefix, protocol, etc.

6. Advanced Technology Laboratories 8 December 2000 page 6 POP architecture Core private peer public peer Access web hosting

7. Advanced Technology Laboratories 8 December 2000 page 7 Data 4 traces collected on Wednesday August 9, 2000

8. Advanced Technology Laboratories 8 December 2000 page 8 The Mapping Problem What is the egress POP for a packet entering a given ingress POP? Method : Map each BGP next hop to a POP Extract destination address from each packet Use longest prefix match with (BGP destination, POP) table

9. Advanced Technology Laboratories 8 December 2000 page 9 Mapping BGP destinations to POPs BGP table Find best Next-Hop Get Unique Next-Hops Traceroute to each Next-Hop Trace back to last Sprint hop Map to POP (Dst,Next-Hop) Unique Next-Hops (Next-Hop, Last Sprint Hop) (Next-Hop, POP map) (BGP Dst,POP) Map Dst to POP

10. Advanced Technology Laboratories 8 December 2000 page 10 POP-to-POP Traffic Matrix

11. Advanced Technology Laboratories 8 December 2000 page 11 POP-to-POP Traffic Matrix: fan-out plots per access link

12. Advanced Technology Laboratories 8 December 2000 page 12 Traffic Matrix: fan-out plots per access link

13. Advanced Technology Laboratories 8 December 2000 page 13 Observations and Comparison of Access Links top 3 different for each access link bottom 3 same for each access link 3 of 4 have one egress POP that is much bigger than rest: twice as big as next largest 1/3 of egress POPs carry very little traffic consistent heaviest hitter: to east coast POP that connects to cross-oceanic links

14. Advanced Technology Laboratories 8 December 2000 page 14 Fluctuation of Traffic Matrix

15. Advanced Technology Laboratories 8 December 2000 page 15 Time of Day Behavior: 5 POPs, 1 access link

16. Advanced Technology Laboratories 8 December 2000 page 16 Time of Day Behavior: 4 access links, 1 POP

17. Advanced Technology Laboratories 8 December 2000 page 17 Elephants and Mice Behavior 1st granularity level: prefix mask of 8 bits –split heaviest POP-to-POP stream into substreams –equivalent to aggregating all packets with same 8- bit prefix into one stream –top 10% make up 82% of traffic 2nd granularity level: prefix mask of 16 bits within mask-8 substreams –subdivide an elephant of mask-8 streams –top 10% make up 97% of traffic

18. Advanced Technology Laboratories 8 December 2000 page 18 Elephants and Mice Behavior

19. Advanced Technology Laboratories 8 December 2000 page 19 Frequency of rank changes 70% of streams in the top 10%, stay in the top 10%. 70% of those in the bottom half, stay in the bottom half. Definition: –R i (n) = the rank of flow i at time slot n –  i = | R i (n) - R i (n+k) | –each time slot corresponds to 30 minutes –computed for 26 values of n (13 hours)

20. Advanced Technology Laboratories 8 December 2000 page 20 Frequency of Rank Changes

21. Advanced Technology Laboratories 8 December 2000 page 21 Conclusions POP-to-POP traffic matrices are non-uniform Different access links are ?? Overall, traffic is reduced by a factor of 2 at night The elephants & mice phenomenon exists within streams categorized by destination prefix The elephants & mice phenomenon appears to be recursive The distribution of changes in rank is the same for multiple time intervals.