50
Traffic dimensioning and traffic measurements in IP networks Konkoly Lászlóné [email protected]

Traffic dimensioning and traffic measurements in IP networks Konkoly Lászlóné [email protected]

Embed Size (px)

Citation preview

Traffic dimensioning and traffic measurements in

IP networks

Konkoly Lászlóné

[email protected]

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 2

Traffic dimensioning

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 3

The objectives of traffic dimensioning

TRAFFIC FORECAST•QUANTITY•ORGANIZATION ofNETWORK ELEMENTS

PRESCRIBED

SERVICE QUALITY

Aim: low cost high utilization of equipments

Input data: New services (business, residential)Forecasts about number of customers (for old and new services)Probable changes in usage (e.g. changes in uplink utilization)Equipments and capabilities of the existing networkPlanning directivesetc.

Main objective:

Organization:•Topology (ring, meshed etc.) •Traffic routing (OSPF, IS-IS)•Transport (SDH, WDM etc.)•Queueing mechanisms etc.

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 4

Traffic dimensioning among network planning tasksTraffic measurements on

the existing network

Traffic analysis

Traffic forecast

Traffic dimensioning

Planning changes in network management and network operation

Probability theoryStochastic processes

Traffic theory Simulation and other

planning tools

Decide on changes of:network topology,

traffic routing architecture, network redundancies,

new functionalities, quality of service etc.

N E

T W

O R

K

P L

A N

N I

N G

Planning tasks needed for building

the planned network

Link and equipment levelLink and equipment level

Network levelNetwork level

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 5

First-choice circuit groupSubscribers

Dimensioning methods in PSTN networks(PSTN=Public Switched Telephone Network)

Dimensioning trunks (first-choice circuit groups):Erlang 1. (B) formula (loss systems, infinite population of sources, Poisson arrival process, exponentially distributed holding times, full availability group of circuits)Notice: the formula is valid for general holding time distributions as well Erlang 2. (C) formula (waiting systems)Engset formula (finite population of sources)

D1

Tandem exchange

Local exchange

T

Sec

ond-

choi

ce c

ircui

t gro

up

M1,V1

D2

D3

Dn

ERT (Equivalent Random Theory) method M=∑Mi

Mi=Ai* ENi(Ai) V=∑Vi

Vi=Mi(1-Mi+Ai/(Ni+1+Mi-Ai))Local exchanges

C

Overflow traffic is already bursty!V/M > 1

Erlang B formula

Dimensioning alternate routing systems (second-choice circuit groups): Dimensioning alternate routing systems (second-choice circuit groups):

Subscribers

Subscribers

Subscribers

Subscribers

smooth trafficV/M =1

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 6

Traffic dimensioning in ISDN networks(ISDN=Integrated services digital network)

PSTN:telephone (or telefax) calls need 1 time slot

ISDN:different services need 1 or more time slots

Services: telephone, video-telephony, data-transmission, video-conference etc.

64 kbit/sec by customers(homogenous sources)

n*64 kbit/sec by customersn=1, 2, 6, 12, 16 …(different service classes)

Traffic mix on shared resources is bursty ! Traffic mix on shared resources is bursty !

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 7

Multi-dimensional Erlang formula/1 Notation: N : number of circuits

M : number of service classes (Poisson arrival by service classes)

ai : offered traffic (in number of calls) for the ith service class

di : bandwidth factor (number of time slots) for the ith service class

P n nanPM

in

ii

M i

( ,..., )!

( ,..., )11

0 0

B P n ni Md n d n N dm M i

( ... )...

10 11 1

1

...0 111!

)0,...,0(

Nndnd

M

i i

ni

MM

i

n

aP

Blocking probability for the ith service class:

Calculation of state probabilities:

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 8

Multi-dimensional Erlang formula/2

Multi-dimensional Erlang formula

Erlang B formula

• Blocking probability for the bigger bandwidth service class will be higher• Erlang-B formula under-estimates blocking for both service classes• Blocking curve for calls using 1 time slot will be „wavering”

Conclusion: shared links can not be used without traffic controlSolution: blocking-equalizer trunk reservation (e.g. new telephone calls are not allowed entering the system if there are only 16 free time slots)

N=100d1=1a1=1→35 erlangd2=16a2=64 erlang (in time slot units)

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35

a1 traffic [erlang]

Blo

ck

ing

Multi-dimensional Erlang formula

(d2=16)

a2=64 erlang

Erlang-B formula

Multi-dimensional Erlang formula (d1=1)

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35

a1 traffic [erlang]

Blo

ck

ing

Multi-dimensional Erlang formula

(d2=16)

a2=64 erlang

Erlang-B formula

Multi-dimensional Erlang formula (d1=1)

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 9Fern

Cantor Set

Comparing features of telephone (circuit-switched) and IP (packet-switched) traffic

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 10

Comparing traffic dimensioning methodologies applied for telephone and for IP traffic [5]

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 11

IP traffic classification – elastic and real-time traffic

TCP=Transmission Control Protocol TCP=Transmission Control Protocol UDP=User Datagram Protocol UDP=User Datagram Protocol

Applications

VoIPVideo onDemand Net Games

Applications

Interactive case

Guarantee is needed for the throughput

Not interactive case

Guarantee is not necessaryfor the throughput

Dimensioning methods

Aggregated traffic

- Mean traffic

- Variance of traffic

-self-similarity (Hurst) parameter

Traffic descriptors

-Effective bandwidth calculation methods-Processor sharing methods-Queueing systems

Elastic (TCP)

Interactive case

Guarantee is necessary for:packet loss, delay, jitter, call blocking (e.g. voice)

Not interactive case

Guarantee is necessary for packet loss (e.g. video)

Aggregated traffic

-Distribution of the number of concurrent connections (or maximum)

-Connection bandwidth (withaverage and variance if it is not constant)

Traffic descriptors

Real Time (UDP)

http FTPTelnetSSH P2P E-mail

-Connection bandwidth (with average and variance if it is not constant)

-Effective bandwidth calculation methods-Call admission Control procedures-Priority queueing models

Dimensioning methods

User traffic-Average bandwidth (derivedeither from flow arrival intensityand flow length data or measurements of aggregated traffic

-Variance of traffic or peak traffic (variance can be estimated by using the access speed)

Multicastvideo

User traffic

-Maximum number of concurrent connections

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 12

n*GE, 10 GE

IP network structure outline IP core network

10GE

Aggregation network

Access network

1- 8 Mbps

PE (Provider Edge)

n*GE, 10 GEGE= GigabitEthernetGE= GigabitEthernet

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 13

Simplified show of the triple-play service

Triple-play (3-play):1. voice (VoIP=Voice over IP)2. data (internet)3. video (TV + VoD) VoD=Video on

Demand

DSLAM: Digital Subscriber Line Access MultiplexerBRAS: Broadband Remote Access ServerDSLAM: Digital Subscriber Line Access MultiplexerBRAS: Broadband Remote Access Server

Ethernetaggregatio

nnetwork

HGW

TV+STB

PC

IPnetwork

IP telephone

Accessnetwor

k

splitter

analog telephone

Switch/router

BRASData platform

Internet

Video platform

Voip platform

Encoders, servers

SSW

gateways

DSLAM

Telephone exchange

Switch Switch

Switch

Switch

router

router

router

router

PSTN network

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 14

IP dimensioning tasksLink dimensioning tasks (simple examples):

1.task:

How many ADSL user’s traffic can be aggregated on a given link if users have c kbit/s access speed and (m, σ) traffic parameters?

2.task: How many LAN network’s traffic can be aggregated on a given link if LANs have c kbit/s access speed and (m, σ, H) traffic parameters?

3.task: Is it possible to reach bandwidth gain (and how much) if we use bigger bandwidth links instead of smaller ones?

Aggregating network

IP core networkInternet

LAN

LAN

LAN

ISP1

ISP2

ISP3

?

?

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 15

Dimensioning principles/1:

What about link dimensioning for the peak rate of customers ??

Pay attention!Waste of bandwidth !

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 16

What about link dimensioning for the mean rate of customers ??

Pay attention! Unsafe!Coincident traffic peaks can occur!

Consequence: High packet loss, big packet delay and jitter (slow downloads, bad service performance)

Dimensioning principles/2:

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 17

Dimensioning principles/3:

Bandwidth variation

Mean bandwidth

Effective bandwidth

Bandwidth variation

Mean bandwidth

Effective bandwidth

Bandwidth variation

Mean bandwidth

Effective bandwidth

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 18

Dimensioning principles/4:

The concept of effective (or equivalent) bandwidth:

Effective bandwidth (Eeff) is a portion of the link bandwidth C that is

„ensured” (only administratively!) for a traffic source with (m, σ, H) traffic parameters in order to fulfil the expected service quality (ε).

Eeff = f (C, m, σ, H, ε) where

C: link bandwidth, m: mean of traffic, σ: dispersion of trafficH: Hurst parameter (self-similarity measure)

ε : requirement for e.g. packet loss, delay, jitter

n= C/ Eeff

(n= number of users that can be aggregated on link C )

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 19

Bufferless multiplexing (in case of small buffer capacity)Small buffer ensures small delay principle: aggregated traffic can exceed link capacity with small probabilityaim: expected small packet loss should be realized

Advantage: simple methods dimensioning does not depend on the traffic correlations Disadvantage: moderate multiplexing gain

Classification of statistical multiplexing methods

Buffered multiplexing (in case of large buffer capacity)Maximum delay can be changed with buffer size settingsprinciple: queue length can be exceeded with small probabilityaim: expected small packet loss should be realizedAdvantage: bigger multiplexing gain than in the bufferless case

Disadvantage: more complex dimensioning procedures strongly depends on traffic correlations

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 20

Lindberger formula (Tidblom formula) [2, 6]

Bufferless multiplexing:

d=1.2m+602 /C

d: equivalent bandwidth m: mean traffic

: traffic dispersion C: link bandwidth

The formula is valid only in case of 10-9 loss probability (IP packet loss) and small (of the order of 100) buffer size.

For ON-OFF sources:

2=m*(h-m)

d=1.2m+60m(h-m)/C

h m

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 21

Application of the Tidblom formula (generalization of the Lindberger method)

Effective bandwidth as a function of the link speed

d=am[1+3y(1-m/h)] if 3y min(3,h/m) d=am[1+3y2(1-m/h)] if 3 < 3y2 h/m

d=ah otherwise,

where y=(-2log Ploss)/(C/h) and a=1-(2log Ploss / 100)

0

20

40

60

80

100

120

140

160

180

Link bandwidth

Eff

ec

tiv

e b

an

dw

idth

(K

b/s

)

2 M

b/s

8 M

b/s

6 M

b/s

4 M

b/s

10

Mb

/s

12

Mb

/s

14

Mb

/s

16

Mb

/s

59

6 M

b/s

10

00

Mb

/s

14

9 M

b/s

34

Mb

/s

m 38,4 Kbpsh 384 KbpslogP -3

Link speed (Mbps)

effektive bandwidth Kb/s

(Tidblom)

Number of users

(Tidblom)

2 167 12

4 104 38

6 83 72

8 72 111

10 66 151

12 62 194

14 59 238

16 57 283

34 48 706

149 42 3514

596 41 14491

1 000 41 24416

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 22

Effective bandwidth in case of self-similar traffic sources [3,4]

Ilkka Norros formula in case of buffered multiplexing:

c(m,a) = m +

Number of sources that can be admitted to a link of bandwidth C is expressed as: C/c(m,a)

)ln2)((/1

HH

H: Hurst parameter (self-similarity measure, value in range 0.5-1)κ(H) : HH(1-H)1-H

m: mean bit-rate of the traffic streama: variance coefficient of the traffic stream (Ω2/m) Ω2 :variance of the number of bits measured for 1 sec intervals B: buffer size ε : packet loss probability

B -(1-H)/H (m*a) 1/(2H)

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 23

Loadability of a 1 Gbps link with LAN flows of 10 Mbps peak bandwidth

H = 0.8buffer : 1.336 MbyteVariance coefficient=90000

M=2.5Mbps Util=25%M=5Mbps Util=50%M=7.5Mbps Util=75%

Utilization: 73-89 %

Loadability of 1 Gbps link with 10 Mbpssources

0

50

100

150

200

250

300

350

400

Util=25% Util=50% Util=75%

Access utilization

Nu

mb

ero

f 10

Mb

ps

sou

rces

Peak rate0.010.0010.00010.000010.000001

Loadability of 1 Gbps link with 10 Mbpssources

0

50

100

150

200

250

300

350

400

Util=25% Util=50% Util=75%

Access utilization

Nu

mb

ero

f 10

Mb

ps

sou

rces

Peak rate0.010.0010.00010.000010.000001

Utilization of a 1 Gbps link

0

20

40

60

80

100

Util=25% Util=50% Util=75%

Access utilization

Lin

k u

tiliz

ati

on

%

Peak rate

0.01

0.001

0.0001

0.00001

0.000001

Utilization of a 1 Gbps link

0

20

40

60

80

100

Util=25% Util=50% Util=75%

Access utilization

Lin

k u

tiliz

ati

on

%

Peak rate

0.01

0.001

0.0001

0.00001

0.000001

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 24

Delay calculation on a 1 Gb/s link - M/M/1 model

Question is: what load limit will ensure a given delay performance for packets in case of Poisson arrivals? M/M/1 model:

Mean packet size: 1500 byte Link speed: 1 Gb/s

Average service time (s) is a function of the mean packet size and of link speed: s = 1500 byte/1 Gb/s=0.012 msec

For waiting calls:P (waiting time > t) =e –t(1-A)/s

A: link utilization (offered traffic)

Applicable only in cases when traffic is „smooth” enough !

Waiting places Link (server)Complementary distribution function of

delay in case of 1 Gb/s link

0

0,2

0,4

0,6

0,8

1

1,2

0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8

msec

P(x

>t)

Utilization=0.8

Utilization=0.9

Utilization=0.95

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 25

Introduction of the Processor Sharing (PS) model/1 (simple case)

Modeling TCP fairness: in ideal cases TCP sources share available bandwidth fairly on bottleneck links

TimeTime

Ba

nd

wid

th [

kbit/

sec]

Ba

nd

wid

th [

kbit/

sec]

TCP congestion control – the saw-tooth diagramTCP congestion control – the saw-tooth diagram

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 26

Notations:X: size of the file to be downloaded (Kbit)T(X): download time for X , E(T(X)) :expectation value of the download time T(X)Cuser : download access peak rate of a customer (Kbit/s)C: link capacity (Kbit/s), RO: link utilization (measurable parameter)R=C/ Cuser : important model parameter, the C link can accomodate R times the user’s peak rate

Advantages: does not need information about traffic mix characteristics takes into account only the average load of the link

Basic idea: the link services the users at their access rate deals with not all demand at a time! - some users are waiting in a queue

file download time = file download time at access speed + waiting time

Introduction of the processor sharing model/2 (simple case)

delay factor (>1)reciproc : Fun factor (<1)

ideal download time

Erlang 2.formula for fractional circuit numbers

useruser C

Xf

ROR

RORRE

C

XXTE

)1(

),(1)( 2

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 27

Variation of the delay factor as a function of link utilization (C=1Mbps – 10 Mbps), Cuser=512 Kbps

Results of the processor sharing model

1,000

1,100

1,200

1,300

1,400

1,500

1,600

1,700

1,800

1,900

2,000

0,56 0,59 0,62 0,65 0,68 0,71 0,74 0,77 0,8 0,83 0,86 0,89 0,92 0,95 0,98

Link kihasználtság

Kés

lelt

etés

i té

nye

ző 1 000 0002 000 0003 000 0004 000 0005 000 0006 000 0007 000 0008 000 0009 000 00010 000 000

Link utilization

De

lay

fact

or

1,000

1,100

1,200

1,300

1,400

1,500

1,600

1,700

1,800

1,900

2,000

0,56 0,59 0,62 0,65 0,68 0,71 0,74 0,77 0,8 0,83 0,86 0,89 0,92 0,95 0,98

Link kihasználtság

Kés

lelt

etés

i té

nye

ző 1 000 0002 000 0003 000 0004 000 0005 000 0006 000 0007 000 0008 000 0009 000 00010 000 000

Link utilization

De

lay

fact

or

= C

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 28

IP network traffic analysis by using flow

and packet based measurements

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 29

IP traffic measurement types

Passive Active(workload measurements) (test traffic generation)

Passive measurement tools usable in network planning:MRTG (Multi-Router Traffic Grapher) - measures aggregated traffic on links

Netflow - measures traffic flows

Tools above do not give information about:packet level features (e.g. packet size distribution, input process of packets), variance and burstiness, self-similarity, auto-correlations etc.

Protocol analyzer measurements are needed to be able to analyze the traffic on the packet level !

link load, processor load,number of connections on a link,packet and flow level data about connections,traffic per user, etc.

packet delaypacket delay variance (jitter)RTT (Round Trip Time)packet loss

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 30

MRTG (Multi-Router Traffic Grapher) - Tobias OetikerBy using this tool, statistics can be obtained from the inner counters of routers (MIB - Management Information Base)

Appropriate protocol (e.g. SNMP=Simple Network Management Protocol) can be used for querying routers

■MRTG is a tool to •collect•monitor •save and store traffic load of links

MRTG uses cyclic database

(efficient buffer utilization)

■Aggregates data daily data → → weekly data →

→ monthly data → → yearly data

weekly

monthly

yearly

daily

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 31

MRTG measurement exampleBudapest Internet Exchange (www.bix.hu)/1

Daily traffic profile5 minute’s averages

Weekly traffic profile30 minute’s averages

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 32

MRTG measurement exampleBudapest Internet Exchange (www.bix.hu)/2

Monthly traffic profile2 hour’s averages

Yearly traffic profileDaily averages

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 33

NetFlow – collecting IP traffic information on the flow-level

Flow: unidirectional sequence of packets aggregated by some features

Basic information involved in the flows: Source IP address, Destination IP address Source port for UDP or TCP Destination port for UDP or TCP IP protocol, ingress interface IP Type of Service

Different aggregation schemes (e.g. Call record, AS record)

Further information involved in NetFlow records:

start and end-time of the flow (flow holding time)carried bytes and carried packets in the flow (mean packet size) etc.

: :

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 34

An example for analyzing NetFlow measurements/1(data from 2005)

Night1-2 o’clock

Night1-2 o’clock

Night4-5 o’clock

Night4-5 o’clock

Morning8-9 o’clockMorning

8-9 o’clock

Changes in the ratio of peer-to-peer file downloads and web browsingChanges in the ratio of peer-to-peer file downloads and web browsing

TCP other: peer-to-peer (P2P) file downloadTCP www: web browsingTCP other: peer-to-peer (P2P) file downloadTCP www: web browsing

TCP-Other

TCP-WWW

TCP-FTP

UDP-Other

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 35

HTTP WEB

HTTP P2P

FTP

Edonkey

Kazaa, Morpheus

Gnutella

BitTorrent

DC++

EgyébOther

An example for analyzing NetFlow measurements/2(data from 2006)

Traffic partition according to applicationsTraffic partition according to applications

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 36

PC + software (Sniffer portable)

Measurement methods on packet level

SnifferBook Ultra256 MB memoryfrequent archiving,packet loss

PC+ appropriate measurement card•Data saved directly to hard disc (640 GB) •Measurements done through several days •0 % packet loss

GE interface traffic mirrored on a free interface(port monitoring)

Object: save packet headers and elaborate information gained from the headers

Results may be used for different tasks:• Explore bottlenecks in the network• Detect and analyze special traffic types (e.g. Skype or other peer-to-peer)• Outline network performance measures

(packet loss, delay, jitter, burstiness etc.)• Collect packet length statistics

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 37

Searching bottleneck links in IP networks/1

Object: conclude for blocking realized farther from the measurement point on the basis of packet header statistics calculated from measurement data collected on a given link

X-measure – peakedness (V/M) of the throughput of TCP flows„relatively small values on bottleneck links”

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 38

Delay factor investigations„Assumption: on bottleneck links the value of the delay factor is >3”

Investigation of the Packet Interarrival Times (4.moment=PIT-kurtosis)„if the bottleneck is before the measurement point” – peaks can be seen in the 4.moments

Packet loss„In case of TCP traffic its higher size does not imply bottleneck” : its value can be a similar order of magnitude on bottleneck links as in cases without blocking

■ Connection bandwidth – depends on several factors, so its small value does not imply bottleneck definitely

Searching bottleneck links in IP networks/2

Delay factor (>1)Reciproc : Fun faktor (<1)

idealdownload time

felh

rfelh C

Xf

ROR

RORRE

C

XXTE

)1(

),(1)( 2

Erlang 2.formula forfractional circuit numbers

Delay factor (>1)Reciproc : Fun faktor (<1)

idealdownload time

felh

rfelh C

Xf

ROR

RORRE

C

XXTE

)1(

),(1)( 2

Erlang 2.formula forfractional circuit numbers

felh

rfelh C

Xf

ROR

RORRE

C

XXTE

)1(

),(1)( 2

Erlang 2.formula forfractional circuit numbers

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 39

Examining the micro-structure of traffic

•Burstiness investigations (msec) – for capacity planning Determining self similarity - Hurst parameter (H=0.5 - 0,7)

•Packet interarrival time investigations (if it can be supposed to be Poissonian)

Method:R/S (Rescaled Range)analysis

Method:R/S (Rescaled Range)analysis

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 40

Packet size statistics/1

1 (uplink) 2(downlink) 3 (uplink) 4 (downlink)

Number of elements 2 365 801 3 148 857 2 243 282 2 909 793

Minimal (byte) 40 40 40 40

Maximal (byte) 1 492 1 500 1 492 1 500

Mean (byte) 222.93 1017.92 246.37 952.16

Dispersion 434.44 620.73 461.33 641.48

10% percentile 40 40 40 40

20% percentile 40 79 40 56

30% percentile 40 576 40 239

40% percentile 40 1 400 40 1 064

50% percentile (median) 40 1 454 40 1 442

60% percentile 48 1 480 48 1 460

70% percentile 52 1 480 52 1 480

80% percentile 72 1 480 116 1 480

90% percentile 1 132 1 492 1 412 1 492

ParameterMorning (9 o'clock) Daily (13 o'clock)

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 41

Packet size distribution and density functions

Packet size statistics/2

Packet size (byte)

Nu

mb

er

of

pa

cket

s(l

og

)

Density function

Distribution function

Packet size (byte)

Nu

mb

er

of

pa

cket

s(l

og

)

Density function

Distribution function

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 42

Identification of P2P traffic

Main features of P2P applications: Continuously changing and often

encrypted protocols Random, fix, default ports or

usage of port 80 (HTTP port!) Big-sized (~1490 byte) packets

in file download

Some heuristics:1. Known non P2P applications (except http) can be filtered according to source_port

/destination_porte.g. FTP:21, telnet:23, ssh:22, http, web:80

2. Identification and separation of default P2P ports: e.g. gnutella:6346, Kazaa:12143. Separation of P2P applications using HTTP ports (www and P2P separation)

www: several parallel connections between source and destination we can identify web servers

P2P: several connections with many different hosts4. IP pairs having TCP and UDP connections at the same time → P2P traffic 5. If a host uses a given fix port several times → P2P traffic 6. Carried data > 1 MByte and/or holding time > 10 minutes

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 43

Usable for:•Internet telephony•video-telephony•Video and audio conference•Instant messaging (chat)•file transfer

Inside the Skype network it is freeof charge

There is a possibility for:•Skype In•Skype Out

Advantages: •Skype bypasses NAT and firewalls•Reasonable call quality if available bandwidth is only 32 Kbit/s (due to its VBR codec)•Tolerates higher packet losses

Disadvantage: •no guaranteed quality of service

Skype traffic identification [8,9]

Skype login server(user names, passwords)

ordinary node(client)

Super Node (Boot-strap SN)

Directs communication,gives address services, connects clients beingbehind NAT or firewall

Skype update server

updatemessages Buddy-list server

Partner-listupdates

loginmessages

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 44

Characteristics of Skype P2P application-layer protocol, encrypted therefore practically unsolvable Only transport layer protocols can be analyzed (IP addresses, TCP/UDP ports) Its identification can not be done unambiguously on the basis of bandwidth and

packet size, because other applications can have the same statistics.

• Packet size

• Bandwidth20-80 Kbit/secAverage 38 -45 Kbit/sec

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 45

Skype identification/1

1. Connection with servers (port- and IP address-based identification)

Can be used when the user enters (logins) into the Skype network after starting the measurement.

– Login Server (LS) – user identification

Direct connection: client→LS indirect: client→SN→LS

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 46

– Bootstrap Super Node – sure connection only at first login– Update Server – for searching new software version– Buddy-list Server – provide partner-list updates

The client will be connected rarely to the above servers, therefore the absence of these connections does not prove a denial of being a Skype user.

Typical traffic sample in the signalling traffic ! In outgoing direction (SC→SN) packets of a special packet size show1 minute periodicity (periodic „heart-beat” – keep alive - messages)

„heart-beat” packets

Skype identification/2

0 10 20 30 40 50 600

20

40

60

80

100

120

140

160

180

arrival-time modulo 60

Fre

qu

ency

Frequency of occurrences of different packet sizes according to arrival-timemodulo 60

2. SC ↔ SN signalling connection Can be used also in cases when the user made its login before starting the measurement.

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 47

OPNET Technologies, Inc.

NetDoctor

FlowAnalysisReachability Analysis Failure AnalysisDiscrete Event Simulation (DES)

Hybrid SimulationMPLS Traffic Engineering design

For validating network configurations

Routing simulator – for modeling and analysingthe routing procedure, determining link loadsquick – good for examining big networks

Performance analysis for applications and for network resources Long run times – accurate results

Network load and performance optimization (using optimal traffic routing instead of OSPF)

Service Provider GURU planning toolN

e t

w o

r k

a n

a l

y s

i sN

e t

w o

r k

a n

a l

y s

i s

Shorter run times – but less accurate results

OSPF:Open Shortest Path firstMPLS: Multi-Protocol Label SwitchingOSPF:Open Shortest Path firstMPLS: Multi-Protocol Label Switching

Pla

nn

ing

Pla

nn

ing

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 48

Interfaces with network databases, inventories

FLEXPLANET(building layered network model)

Network layers:IP, Ethernet, SDH/PDH, WDM, optical network

Auxiliary planning data:coordinates, hierarchy etc.

graficalrepresentation

lists

Network planner

Traffic and availability analysis

FLEXPLANET network planning tool

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 49

References[1] J. Charzinski: Fun factor for dimensioning elastic traffic

http://www.jcho.de/jc/Pubs/itc2000-col.pdf[2] Lindberger, K.: Dimensioning and Design methods for Integrated ATM Networks Proceedings of ITC 14. Antibes Juan-les-Pins, France[3] A. Patel: Statistical Multiplexing of Self-Similar Traffic: Theoretical and Simulation Results

http://www.cs.usask.ca/faculty/carey/papers/statmuxing.ps[4]: S. Bodamer, J. Charzinsky: Evaluation of Effective Bandwidth Schemes for self-Similar

traffic, http://www.ikr.uni-stuttgart.de/Content/Publications/Archive/Bo_IP00_32462.pdf[5] W. Paxson, S. Floyd: Wide-Area traffic: The failure of Poisson modeling

http://www.cs.berkeley.edu/~istoica/classes/cs268/05/papers/paxson95widearea.pdf[6] Cost-257, Final Report

http://www3.informatik.uni-wuerzburg.de/cost/FinalReport/report_web.pdf[7] Converged networks and services. Internal lecture presentation material of Norwegian

University of Science and Technologyhttp://www.item.ntnu.no/fag/ttm7/Lectures/4_1_Convergence_Fix_Net.ppt

[8] Salman A. Baset and Henning Schulzrinne: An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol, Department of Computer Science

Columbia University, New York NY 10027, September 15, 2004 http://arxiv.org/ftp/cs/papers/0412/0412017.pdf[9] Dario Rossi, Marco Mellia, Michela Meo: A Detailed Measurement of Skype Network Traffic http://perso.telecom-paristech.fr/~drossi/paper/rossi08iptps.pdf

2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 50

Thank you for

your attention !Thank you for

your attention !