Upload
marian-wheeler
View
242
Download
2
Tags:
Embed Size (px)
Citation preview
Traffic dimensioning and traffic measurements in
IP networks
Konkoly Lászlóné
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 2
Traffic dimensioning
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 3
The objectives of traffic dimensioning
TRAFFIC FORECAST•QUANTITY•ORGANIZATION ofNETWORK ELEMENTS
PRESCRIBED
SERVICE QUALITY
Aim: low cost high utilization of equipments
Input data: New services (business, residential)Forecasts about number of customers (for old and new services)Probable changes in usage (e.g. changes in uplink utilization)Equipments and capabilities of the existing networkPlanning directivesetc.
Main objective:
Organization:•Topology (ring, meshed etc.) •Traffic routing (OSPF, IS-IS)•Transport (SDH, WDM etc.)•Queueing mechanisms etc.
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 4
Traffic dimensioning among network planning tasksTraffic measurements on
the existing network
Traffic analysis
Traffic forecast
Traffic dimensioning
Planning changes in network management and network operation
Probability theoryStochastic processes
Traffic theory Simulation and other
planning tools
Decide on changes of:network topology,
traffic routing architecture, network redundancies,
new functionalities, quality of service etc.
N E
T W
O R
K
P L
A N
N I
N G
Planning tasks needed for building
the planned network
Link and equipment levelLink and equipment level
Network levelNetwork level
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 5
First-choice circuit groupSubscribers
Dimensioning methods in PSTN networks(PSTN=Public Switched Telephone Network)
Dimensioning trunks (first-choice circuit groups):Erlang 1. (B) formula (loss systems, infinite population of sources, Poisson arrival process, exponentially distributed holding times, full availability group of circuits)Notice: the formula is valid for general holding time distributions as well Erlang 2. (C) formula (waiting systems)Engset formula (finite population of sources)
D1
Tandem exchange
Local exchange
T
Sec
ond-
choi
ce c
ircui
t gro
up
M1,V1
D2
D3
Dn
ERT (Equivalent Random Theory) method M=∑Mi
Mi=Ai* ENi(Ai) V=∑Vi
Vi=Mi(1-Mi+Ai/(Ni+1+Mi-Ai))Local exchanges
C
Overflow traffic is already bursty!V/M > 1
Erlang B formula
Dimensioning alternate routing systems (second-choice circuit groups): Dimensioning alternate routing systems (second-choice circuit groups):
Subscribers
Subscribers
Subscribers
Subscribers
smooth trafficV/M =1
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 6
Traffic dimensioning in ISDN networks(ISDN=Integrated services digital network)
PSTN:telephone (or telefax) calls need 1 time slot
ISDN:different services need 1 or more time slots
Services: telephone, video-telephony, data-transmission, video-conference etc.
64 kbit/sec by customers(homogenous sources)
n*64 kbit/sec by customersn=1, 2, 6, 12, 16 …(different service classes)
Traffic mix on shared resources is bursty ! Traffic mix on shared resources is bursty !
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 7
Multi-dimensional Erlang formula/1 Notation: N : number of circuits
M : number of service classes (Poisson arrival by service classes)
ai : offered traffic (in number of calls) for the ith service class
di : bandwidth factor (number of time slots) for the ith service class
P n nanPM
in
ii
M i
( ,..., )!
( ,..., )11
0 0
B P n ni Md n d n N dm M i
( ... )...
10 11 1
1
...0 111!
)0,...,0(
Nndnd
M
i i
ni
MM
i
n
aP
Blocking probability for the ith service class:
Calculation of state probabilities:
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 8
Multi-dimensional Erlang formula/2
Multi-dimensional Erlang formula
Erlang B formula
• Blocking probability for the bigger bandwidth service class will be higher• Erlang-B formula under-estimates blocking for both service classes• Blocking curve for calls using 1 time slot will be „wavering”
Conclusion: shared links can not be used without traffic controlSolution: blocking-equalizer trunk reservation (e.g. new telephone calls are not allowed entering the system if there are only 16 free time slots)
N=100d1=1a1=1→35 erlangd2=16a2=64 erlang (in time slot units)
0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35
a1 traffic [erlang]
Blo
ck
ing
Multi-dimensional Erlang formula
(d2=16)
a2=64 erlang
Erlang-B formula
Multi-dimensional Erlang formula (d1=1)
0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35
a1 traffic [erlang]
Blo
ck
ing
Multi-dimensional Erlang formula
(d2=16)
a2=64 erlang
Erlang-B formula
Multi-dimensional Erlang formula (d1=1)
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 9Fern
Cantor Set
Comparing features of telephone (circuit-switched) and IP (packet-switched) traffic
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 10
Comparing traffic dimensioning methodologies applied for telephone and for IP traffic [5]
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 11
IP traffic classification – elastic and real-time traffic
TCP=Transmission Control Protocol TCP=Transmission Control Protocol UDP=User Datagram Protocol UDP=User Datagram Protocol
Applications
VoIPVideo onDemand Net Games
Applications
Interactive case
Guarantee is needed for the throughput
Not interactive case
Guarantee is not necessaryfor the throughput
Dimensioning methods
Aggregated traffic
- Mean traffic
- Variance of traffic
-self-similarity (Hurst) parameter
Traffic descriptors
-Effective bandwidth calculation methods-Processor sharing methods-Queueing systems
Elastic (TCP)
Interactive case
Guarantee is necessary for:packet loss, delay, jitter, call blocking (e.g. voice)
Not interactive case
Guarantee is necessary for packet loss (e.g. video)
Aggregated traffic
-Distribution of the number of concurrent connections (or maximum)
-Connection bandwidth (withaverage and variance if it is not constant)
Traffic descriptors
Real Time (UDP)
http FTPTelnetSSH P2P E-mail
-Connection bandwidth (with average and variance if it is not constant)
-Effective bandwidth calculation methods-Call admission Control procedures-Priority queueing models
Dimensioning methods
User traffic-Average bandwidth (derivedeither from flow arrival intensityand flow length data or measurements of aggregated traffic
-Variance of traffic or peak traffic (variance can be estimated by using the access speed)
Multicastvideo
User traffic
-Maximum number of concurrent connections
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 12
n*GE, 10 GE
IP network structure outline IP core network
10GE
Aggregation network
Access network
1- 8 Mbps
PE (Provider Edge)
n*GE, 10 GEGE= GigabitEthernetGE= GigabitEthernet
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 13
Simplified show of the triple-play service
Triple-play (3-play):1. voice (VoIP=Voice over IP)2. data (internet)3. video (TV + VoD) VoD=Video on
Demand
DSLAM: Digital Subscriber Line Access MultiplexerBRAS: Broadband Remote Access ServerDSLAM: Digital Subscriber Line Access MultiplexerBRAS: Broadband Remote Access Server
Ethernetaggregatio
nnetwork
HGW
TV+STB
PC
IPnetwork
IP telephone
Accessnetwor
k
splitter
analog telephone
Switch/router
BRASData platform
Internet
Video platform
Voip platform
Encoders, servers
SSW
gateways
DSLAM
Telephone exchange
Switch Switch
Switch
Switch
router
router
router
router
PSTN network
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 14
IP dimensioning tasksLink dimensioning tasks (simple examples):
1.task:
How many ADSL user’s traffic can be aggregated on a given link if users have c kbit/s access speed and (m, σ) traffic parameters?
2.task: How many LAN network’s traffic can be aggregated on a given link if LANs have c kbit/s access speed and (m, σ, H) traffic parameters?
3.task: Is it possible to reach bandwidth gain (and how much) if we use bigger bandwidth links instead of smaller ones?
Aggregating network
IP core networkInternet
LAN
LAN
LAN
ISP1
ISP2
ISP3
?
?
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 15
Dimensioning principles/1:
What about link dimensioning for the peak rate of customers ??
Pay attention!Waste of bandwidth !
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 16
What about link dimensioning for the mean rate of customers ??
Pay attention! Unsafe!Coincident traffic peaks can occur!
Consequence: High packet loss, big packet delay and jitter (slow downloads, bad service performance)
Dimensioning principles/2:
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 17
Dimensioning principles/3:
Bandwidth variation
Mean bandwidth
Effective bandwidth
Bandwidth variation
Mean bandwidth
Effective bandwidth
Bandwidth variation
Mean bandwidth
Effective bandwidth
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 18
Dimensioning principles/4:
The concept of effective (or equivalent) bandwidth:
Effective bandwidth (Eeff) is a portion of the link bandwidth C that is
„ensured” (only administratively!) for a traffic source with (m, σ, H) traffic parameters in order to fulfil the expected service quality (ε).
Eeff = f (C, m, σ, H, ε) where
C: link bandwidth, m: mean of traffic, σ: dispersion of trafficH: Hurst parameter (self-similarity measure)
ε : requirement for e.g. packet loss, delay, jitter
n= C/ Eeff
(n= number of users that can be aggregated on link C )
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 19
Bufferless multiplexing (in case of small buffer capacity)Small buffer ensures small delay principle: aggregated traffic can exceed link capacity with small probabilityaim: expected small packet loss should be realized
Advantage: simple methods dimensioning does not depend on the traffic correlations Disadvantage: moderate multiplexing gain
Classification of statistical multiplexing methods
Buffered multiplexing (in case of large buffer capacity)Maximum delay can be changed with buffer size settingsprinciple: queue length can be exceeded with small probabilityaim: expected small packet loss should be realizedAdvantage: bigger multiplexing gain than in the bufferless case
Disadvantage: more complex dimensioning procedures strongly depends on traffic correlations
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 20
Lindberger formula (Tidblom formula) [2, 6]
Bufferless multiplexing:
d=1.2m+602 /C
d: equivalent bandwidth m: mean traffic
: traffic dispersion C: link bandwidth
The formula is valid only in case of 10-9 loss probability (IP packet loss) and small (of the order of 100) buffer size.
For ON-OFF sources:
2=m*(h-m)
d=1.2m+60m(h-m)/C
h m
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 21
Application of the Tidblom formula (generalization of the Lindberger method)
Effective bandwidth as a function of the link speed
d=am[1+3y(1-m/h)] if 3y min(3,h/m) d=am[1+3y2(1-m/h)] if 3 < 3y2 h/m
d=ah otherwise,
where y=(-2log Ploss)/(C/h) and a=1-(2log Ploss / 100)
0
20
40
60
80
100
120
140
160
180
Link bandwidth
Eff
ec
tiv
e b
an
dw
idth
(K
b/s
)
2 M
b/s
8 M
b/s
6 M
b/s
4 M
b/s
10
Mb
/s
12
Mb
/s
14
Mb
/s
16
Mb
/s
59
6 M
b/s
10
00
Mb
/s
14
9 M
b/s
34
Mb
/s
m 38,4 Kbpsh 384 KbpslogP -3
Link speed (Mbps)
effektive bandwidth Kb/s
(Tidblom)
Number of users
(Tidblom)
2 167 12
4 104 38
6 83 72
8 72 111
10 66 151
12 62 194
14 59 238
16 57 283
34 48 706
149 42 3514
596 41 14491
1 000 41 24416
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 22
Effective bandwidth in case of self-similar traffic sources [3,4]
Ilkka Norros formula in case of buffered multiplexing:
c(m,a) = m +
Number of sources that can be admitted to a link of bandwidth C is expressed as: C/c(m,a)
)ln2)((/1
HH
H: Hurst parameter (self-similarity measure, value in range 0.5-1)κ(H) : HH(1-H)1-H
m: mean bit-rate of the traffic streama: variance coefficient of the traffic stream (Ω2/m) Ω2 :variance of the number of bits measured for 1 sec intervals B: buffer size ε : packet loss probability
B -(1-H)/H (m*a) 1/(2H)
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 23
Loadability of a 1 Gbps link with LAN flows of 10 Mbps peak bandwidth
H = 0.8buffer : 1.336 MbyteVariance coefficient=90000
M=2.5Mbps Util=25%M=5Mbps Util=50%M=7.5Mbps Util=75%
Utilization: 73-89 %
Loadability of 1 Gbps link with 10 Mbpssources
0
50
100
150
200
250
300
350
400
Util=25% Util=50% Util=75%
Access utilization
Nu
mb
ero
f 10
Mb
ps
sou
rces
Peak rate0.010.0010.00010.000010.000001
Loadability of 1 Gbps link with 10 Mbpssources
0
50
100
150
200
250
300
350
400
Util=25% Util=50% Util=75%
Access utilization
Nu
mb
ero
f 10
Mb
ps
sou
rces
Peak rate0.010.0010.00010.000010.000001
Utilization of a 1 Gbps link
0
20
40
60
80
100
Util=25% Util=50% Util=75%
Access utilization
Lin
k u
tiliz
ati
on
%
Peak rate
0.01
0.001
0.0001
0.00001
0.000001
Utilization of a 1 Gbps link
0
20
40
60
80
100
Util=25% Util=50% Util=75%
Access utilization
Lin
k u
tiliz
ati
on
%
Peak rate
0.01
0.001
0.0001
0.00001
0.000001
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 24
Delay calculation on a 1 Gb/s link - M/M/1 model
Question is: what load limit will ensure a given delay performance for packets in case of Poisson arrivals? M/M/1 model:
Mean packet size: 1500 byte Link speed: 1 Gb/s
Average service time (s) is a function of the mean packet size and of link speed: s = 1500 byte/1 Gb/s=0.012 msec
For waiting calls:P (waiting time > t) =e –t(1-A)/s
A: link utilization (offered traffic)
Applicable only in cases when traffic is „smooth” enough !
Waiting places Link (server)Complementary distribution function of
delay in case of 1 Gb/s link
0
0,2
0,4
0,6
0,8
1
1,2
0 0,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8
msec
P(x
>t)
Utilization=0.8
Utilization=0.9
Utilization=0.95
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 25
Introduction of the Processor Sharing (PS) model/1 (simple case)
Modeling TCP fairness: in ideal cases TCP sources share available bandwidth fairly on bottleneck links
TimeTime
Ba
nd
wid
th [
kbit/
sec]
Ba
nd
wid
th [
kbit/
sec]
TCP congestion control – the saw-tooth diagramTCP congestion control – the saw-tooth diagram
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 26
Notations:X: size of the file to be downloaded (Kbit)T(X): download time for X , E(T(X)) :expectation value of the download time T(X)Cuser : download access peak rate of a customer (Kbit/s)C: link capacity (Kbit/s), RO: link utilization (measurable parameter)R=C/ Cuser : important model parameter, the C link can accomodate R times the user’s peak rate
Advantages: does not need information about traffic mix characteristics takes into account only the average load of the link
Basic idea: the link services the users at their access rate deals with not all demand at a time! - some users are waiting in a queue
file download time = file download time at access speed + waiting time
Introduction of the processor sharing model/2 (simple case)
delay factor (>1)reciproc : Fun factor (<1)
ideal download time
Erlang 2.formula for fractional circuit numbers
useruser C
Xf
ROR
RORRE
C
XXTE
)1(
),(1)( 2
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 27
Variation of the delay factor as a function of link utilization (C=1Mbps – 10 Mbps), Cuser=512 Kbps
Results of the processor sharing model
1,000
1,100
1,200
1,300
1,400
1,500
1,600
1,700
1,800
1,900
2,000
0,56 0,59 0,62 0,65 0,68 0,71 0,74 0,77 0,8 0,83 0,86 0,89 0,92 0,95 0,98
Link kihasználtság
Kés
lelt
etés
i té
nye
ző 1 000 0002 000 0003 000 0004 000 0005 000 0006 000 0007 000 0008 000 0009 000 00010 000 000
Link utilization
De
lay
fact
or
1,000
1,100
1,200
1,300
1,400
1,500
1,600
1,700
1,800
1,900
2,000
0,56 0,59 0,62 0,65 0,68 0,71 0,74 0,77 0,8 0,83 0,86 0,89 0,92 0,95 0,98
Link kihasználtság
Kés
lelt
etés
i té
nye
ző 1 000 0002 000 0003 000 0004 000 0005 000 0006 000 0007 000 0008 000 0009 000 00010 000 000
Link utilization
De
lay
fact
or
= C
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 28
IP network traffic analysis by using flow
and packet based measurements
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 29
IP traffic measurement types
Passive Active(workload measurements) (test traffic generation)
Passive measurement tools usable in network planning:MRTG (Multi-Router Traffic Grapher) - measures aggregated traffic on links
Netflow - measures traffic flows
Tools above do not give information about:packet level features (e.g. packet size distribution, input process of packets), variance and burstiness, self-similarity, auto-correlations etc.
Protocol analyzer measurements are needed to be able to analyze the traffic on the packet level !
link load, processor load,number of connections on a link,packet and flow level data about connections,traffic per user, etc.
packet delaypacket delay variance (jitter)RTT (Round Trip Time)packet loss
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 30
MRTG (Multi-Router Traffic Grapher) - Tobias OetikerBy using this tool, statistics can be obtained from the inner counters of routers (MIB - Management Information Base)
Appropriate protocol (e.g. SNMP=Simple Network Management Protocol) can be used for querying routers
■MRTG is a tool to •collect•monitor •save and store traffic load of links
MRTG uses cyclic database
(efficient buffer utilization)
■Aggregates data daily data → → weekly data →
→ monthly data → → yearly data
weekly
monthly
yearly
daily
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 31
MRTG measurement exampleBudapest Internet Exchange (www.bix.hu)/1
Daily traffic profile5 minute’s averages
Weekly traffic profile30 minute’s averages
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 32
MRTG measurement exampleBudapest Internet Exchange (www.bix.hu)/2
Monthly traffic profile2 hour’s averages
Yearly traffic profileDaily averages
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 33
NetFlow – collecting IP traffic information on the flow-level
Flow: unidirectional sequence of packets aggregated by some features
Basic information involved in the flows: Source IP address, Destination IP address Source port for UDP or TCP Destination port for UDP or TCP IP protocol, ingress interface IP Type of Service
Different aggregation schemes (e.g. Call record, AS record)
Further information involved in NetFlow records:
start and end-time of the flow (flow holding time)carried bytes and carried packets in the flow (mean packet size) etc.
: :
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 34
An example for analyzing NetFlow measurements/1(data from 2005)
Night1-2 o’clock
Night1-2 o’clock
Night4-5 o’clock
Night4-5 o’clock
Morning8-9 o’clockMorning
8-9 o’clock
Changes in the ratio of peer-to-peer file downloads and web browsingChanges in the ratio of peer-to-peer file downloads and web browsing
TCP other: peer-to-peer (P2P) file downloadTCP www: web browsingTCP other: peer-to-peer (P2P) file downloadTCP www: web browsing
TCP-Other
TCP-WWW
TCP-FTP
UDP-Other
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 35
HTTP WEB
HTTP P2P
FTP
Edonkey
Kazaa, Morpheus
Gnutella
BitTorrent
DC++
EgyébOther
An example for analyzing NetFlow measurements/2(data from 2006)
Traffic partition according to applicationsTraffic partition according to applications
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 36
PC + software (Sniffer portable)
Measurement methods on packet level
SnifferBook Ultra256 MB memoryfrequent archiving,packet loss
PC+ appropriate measurement card•Data saved directly to hard disc (640 GB) •Measurements done through several days •0 % packet loss
GE interface traffic mirrored on a free interface(port monitoring)
Object: save packet headers and elaborate information gained from the headers
Results may be used for different tasks:• Explore bottlenecks in the network• Detect and analyze special traffic types (e.g. Skype or other peer-to-peer)• Outline network performance measures
(packet loss, delay, jitter, burstiness etc.)• Collect packet length statistics
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 37
Searching bottleneck links in IP networks/1
Object: conclude for blocking realized farther from the measurement point on the basis of packet header statistics calculated from measurement data collected on a given link
X-measure – peakedness (V/M) of the throughput of TCP flows„relatively small values on bottleneck links”
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 38
Delay factor investigations„Assumption: on bottleneck links the value of the delay factor is >3”
Investigation of the Packet Interarrival Times (4.moment=PIT-kurtosis)„if the bottleneck is before the measurement point” – peaks can be seen in the 4.moments
Packet loss„In case of TCP traffic its higher size does not imply bottleneck” : its value can be a similar order of magnitude on bottleneck links as in cases without blocking
■ Connection bandwidth – depends on several factors, so its small value does not imply bottleneck definitely
Searching bottleneck links in IP networks/2
Delay factor (>1)Reciproc : Fun faktor (<1)
idealdownload time
felh
rfelh C
Xf
ROR
RORRE
C
XXTE
)1(
),(1)( 2
Erlang 2.formula forfractional circuit numbers
Delay factor (>1)Reciproc : Fun faktor (<1)
idealdownload time
felh
rfelh C
Xf
ROR
RORRE
C
XXTE
)1(
),(1)( 2
Erlang 2.formula forfractional circuit numbers
felh
rfelh C
Xf
ROR
RORRE
C
XXTE
)1(
),(1)( 2
Erlang 2.formula forfractional circuit numbers
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 39
Examining the micro-structure of traffic
•Burstiness investigations (msec) – for capacity planning Determining self similarity - Hurst parameter (H=0.5 - 0,7)
•Packet interarrival time investigations (if it can be supposed to be Poissonian)
Method:R/S (Rescaled Range)analysis
Method:R/S (Rescaled Range)analysis
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 40
Packet size statistics/1
1 (uplink) 2(downlink) 3 (uplink) 4 (downlink)
Number of elements 2 365 801 3 148 857 2 243 282 2 909 793
Minimal (byte) 40 40 40 40
Maximal (byte) 1 492 1 500 1 492 1 500
Mean (byte) 222.93 1017.92 246.37 952.16
Dispersion 434.44 620.73 461.33 641.48
10% percentile 40 40 40 40
20% percentile 40 79 40 56
30% percentile 40 576 40 239
40% percentile 40 1 400 40 1 064
50% percentile (median) 40 1 454 40 1 442
60% percentile 48 1 480 48 1 460
70% percentile 52 1 480 52 1 480
80% percentile 72 1 480 116 1 480
90% percentile 1 132 1 492 1 412 1 492
ParameterMorning (9 o'clock) Daily (13 o'clock)
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 41
Packet size distribution and density functions
Packet size statistics/2
Packet size (byte)
Nu
mb
er
of
pa
cket
s(l
og
)
Density function
Distribution function
Packet size (byte)
Nu
mb
er
of
pa
cket
s(l
og
)
Density function
Distribution function
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 42
Identification of P2P traffic
Main features of P2P applications: Continuously changing and often
encrypted protocols Random, fix, default ports or
usage of port 80 (HTTP port!) Big-sized (~1490 byte) packets
in file download
Some heuristics:1. Known non P2P applications (except http) can be filtered according to source_port
/destination_porte.g. FTP:21, telnet:23, ssh:22, http, web:80
2. Identification and separation of default P2P ports: e.g. gnutella:6346, Kazaa:12143. Separation of P2P applications using HTTP ports (www and P2P separation)
www: several parallel connections between source and destination we can identify web servers
P2P: several connections with many different hosts4. IP pairs having TCP and UDP connections at the same time → P2P traffic 5. If a host uses a given fix port several times → P2P traffic 6. Carried data > 1 MByte and/or holding time > 10 minutes
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 43
Usable for:•Internet telephony•video-telephony•Video and audio conference•Instant messaging (chat)•file transfer
Inside the Skype network it is freeof charge
There is a possibility for:•Skype In•Skype Out
Advantages: •Skype bypasses NAT and firewalls•Reasonable call quality if available bandwidth is only 32 Kbit/s (due to its VBR codec)•Tolerates higher packet losses
Disadvantage: •no guaranteed quality of service
Skype traffic identification [8,9]
Skype login server(user names, passwords)
ordinary node(client)
Super Node (Boot-strap SN)
Directs communication,gives address services, connects clients beingbehind NAT or firewall
Skype update server
updatemessages Buddy-list server
Partner-listupdates
loginmessages
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 44
Characteristics of Skype P2P application-layer protocol, encrypted therefore practically unsolvable Only transport layer protocols can be analyzed (IP addresses, TCP/UDP ports) Its identification can not be done unambiguously on the basis of bandwidth and
packet size, because other applications can have the same statistics.
• Packet size
• Bandwidth20-80 Kbit/secAverage 38 -45 Kbit/sec
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 45
Skype identification/1
1. Connection with servers (port- and IP address-based identification)
Can be used when the user enters (logins) into the Skype network after starting the measurement.
– Login Server (LS) – user identification
Direct connection: client→LS indirect: client→SN→LS
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 46
– Bootstrap Super Node – sure connection only at first login– Update Server – for searching new software version– Buddy-list Server – provide partner-list updates
The client will be connected rarely to the above servers, therefore the absence of these connections does not prove a denial of being a Skype user.
Typical traffic sample in the signalling traffic ! In outgoing direction (SC→SN) packets of a special packet size show1 minute periodicity (periodic „heart-beat” – keep alive - messages)
„heart-beat” packets
Skype identification/2
0 10 20 30 40 50 600
20
40
60
80
100
120
140
160
180
arrival-time modulo 60
Fre
qu
ency
Frequency of occurrences of different packet sizes according to arrival-timemodulo 60
2. SC ↔ SN signalling connection Can be used also in cases when the user made its login before starting the measurement.
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 47
OPNET Technologies, Inc.
NetDoctor
FlowAnalysisReachability Analysis Failure AnalysisDiscrete Event Simulation (DES)
Hybrid SimulationMPLS Traffic Engineering design
For validating network configurations
Routing simulator – for modeling and analysingthe routing procedure, determining link loadsquick – good for examining big networks
Performance analysis for applications and for network resources Long run times – accurate results
Network load and performance optimization (using optimal traffic routing instead of OSPF)
Service Provider GURU planning toolN
e t
w o
r k
a n
a l
y s
i sN
e t
w o
r k
a n
a l
y s
i s
Shorter run times – but less accurate results
OSPF:Open Shortest Path firstMPLS: Multi-Protocol Label SwitchingOSPF:Open Shortest Path firstMPLS: Multi-Protocol Label Switching
Pla
nn
ing
Pla
nn
ing
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 48
Interfaces with network databases, inventories
FLEXPLANET(building layered network model)
Network layers:IP, Ethernet, SDH/PDH, WDM, optical network
Auxiliary planning data:coordinates, hierarchy etc.
graficalrepresentation
lists
Network planner
Traffic and availability analysis
FLEXPLANET network planning tool
2010.10.20. Konkoly Lászlóné/Traffic dimensioning and traffic measurements in IP networks 49
References[1] J. Charzinski: Fun factor for dimensioning elastic traffic
http://www.jcho.de/jc/Pubs/itc2000-col.pdf[2] Lindberger, K.: Dimensioning and Design methods for Integrated ATM Networks Proceedings of ITC 14. Antibes Juan-les-Pins, France[3] A. Patel: Statistical Multiplexing of Self-Similar Traffic: Theoretical and Simulation Results
http://www.cs.usask.ca/faculty/carey/papers/statmuxing.ps[4]: S. Bodamer, J. Charzinsky: Evaluation of Effective Bandwidth Schemes for self-Similar
traffic, http://www.ikr.uni-stuttgart.de/Content/Publications/Archive/Bo_IP00_32462.pdf[5] W. Paxson, S. Floyd: Wide-Area traffic: The failure of Poisson modeling
http://www.cs.berkeley.edu/~istoica/classes/cs268/05/papers/paxson95widearea.pdf[6] Cost-257, Final Report
http://www3.informatik.uni-wuerzburg.de/cost/FinalReport/report_web.pdf[7] Converged networks and services. Internal lecture presentation material of Norwegian
University of Science and Technologyhttp://www.item.ntnu.no/fag/ttm7/Lectures/4_1_Convergence_Fix_Net.ppt
[8] Salman A. Baset and Henning Schulzrinne: An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol, Department of Computer Science
Columbia University, New York NY 10027, September 15, 2004 http://arxiv.org/ftp/cs/papers/0412/0412017.pdf[9] Dario Rossi, Marco Mellia, Michela Meo: A Detailed Measurement of Skype Network Traffic http://perso.telecom-paristech.fr/~drossi/paper/rossi08iptps.pdf