Chapter In The Handbook Of Computer Networks, Hossein .
Chapter in The Handbook of Computer Networks, Hossein Bidgoli (ed.), Wiley, to appear 2007Network Traffic ModelingThomas M. ChenSouthern Methodist University, Dallas, TexasOUTLINE:1. Introduction1.1. Packets, flows, and sessions1.2. The modeling process1.3. Uses of traffic models2. Source Traffic Statistics2.1. Simple statistics2.2. Burstiness measures2.3. Long range dependence and self similarity2.4. Multiresolution timescale2.5. Scaling3. Continuous-Time Source Models3.1. Traditional Poisson process3.2. Simple on/off model3.3. Markov modulated Poisson process (MMPP)3.4. Stochastic fluid model3.5. Fractional Brownian motion4. Discrete-Time Source Models4.1. Time series4.2. Box-Jenkins methodology5. Application-Specific Models5.1. Web traffic5.2. Peer-to-peer traffic5.3. Video6. Access Regulated Sources6.1. Leaky bucket regulated sources6.2. Bounding-interval-dependent (BIND) model7. Congestion-Dependent Flows7.1. TCP flows with congestion avoidance7.2. TCP flows with active queue management8. Conclusions1
KEY WORDS: traffic model, burstiness, long range dependence, policing, self similarity,stochastic fluid, time series, Poisson process, Markov modulated process, transmission controlprotocol (TCP).ABSTRACTFrom the viewpoint of a service provider, demands on the network are not entirely predictable.Traffic modeling is the problem of representing our understanding of dynamic demands bystochastic processes. Accurate traffic models are necessary for service providers to properlymaintain quality of service. Many traffic models have been developed based on trafficmeasurement data. This chapter gives an overview of a number of common continuous-time anddiscrete-time traffic models. Sources are sometimes policed or regulated at the network access,usually by a leaky-bucket algorithm. Access policing can change the shape of source traffic bylimiting the peak rate or burstiness. Source traffic may also be regulated by protocol mechanismssuch as sliding windows or congestion windows (as in TCP), leading to other traffic models.INTRODUCTIONTeletraffic theory is the application of mathematics to the measurement, modeling, andcontrol of traffic in telecommunications networks (Willinger and Paxson, 1998). The aim oftraffic modeling is to find stochastic processes to represent the behavior of traffic. Working at theCopenhagen Telephone Company in the 1910s, A. K. Erlang famously characterized telephonetraffic at the call level by certain probability distributions for arrivals of new calls and theirholding times. Erlang applied the traffic models to estimate the telephone switch capacity needed2
to achieve a given call blocking probability. The Erlang blocking formulas had tremendouspractical interest for public carriers because telephone facilities (switching and transmission)involved considerable investments. Over several decades, Erlang’s work stimulated the use ofqueueing theory, and applied probability in general, to engineer the public switched telephonenetwork.Packet-switched networks started to be deployed on a large scale in the 1970s. Likecircuit-switched networks, packet networks are designed to handle a certain traffic capacity.Greater network capacity leads to better network performance and user satisfaction, but requiresmore investment by service providers. The network capacity is typically chosen to provide atarget level of quality of service (QoS). QoS is the network performance seen by a packet flow,measured mainly in terms of end-to-end packet loss probability, maximum packet delay, anddelay jitter or variation (Firoiu, et al., 2002). The target QoS is derived from the requirements ofapplications. For example, a real-time application can tolerate end-to-end packet delays up to amaximum bound.Unfortunately, teletraffic theory from traditional circuit-switched networks could not beapplied directly to emerging packet-switched networks for a number of reasons. First, voicetraffic is fairly consistent from call to call, and the aggregate behavior of telephone users doesnot vary much over time. However, packet networks carry more diverse data traffic, for example,e-mail, file transfers, remote login, and client-server transactions. Data applications are typically“bursty” (highly variable over time) and vary in behavior from each other. Also, the trafficdiversity has increased with the growing number of multimedia applications. Second, traffic iscontrolled differently in circuit- and packet-switched networks. A circuit-switched telephone callproceeds at a constant bit-rate after it is accepted by the network. It consumes a fixed amount of3
bandwidth at each telephone switch. In contrast, packet flows may be subjected to access control(rate enforcement at the network boundary); flow control (the destination slowing down thesender); congestion control (the network slowing down the sender); and contention within thenetwork from other packet flows. Thus, packet traffic exhibits much more complex behaviorthan circuit-switched voice.Teletraffic theory for packet networks has seen considerable progress in recent decades(Adas, 1997; Frost and Melamed, 1994; Michiel and Laevens, 1997; Park and Willinger, 2000).Significant advances have been made in long-range dependence, wavelet, and multifractalapproaches. At the same time, traffic modeling continues to be challenged by evolving networktechnologies and new multimedia applications. For example, wireless technologies allow greatermobility of users. Mobility must be an additional consideration for modeling traffic in wirelessnetworks (Thajchayapong and Peha, 2006; Wu, Lin, and Lan, 2002). Traffic modeling is clearlyan ongoing process without a real end. Traffic models represent our best current understandingof traffic behavior, but our understanding will change and grow over time.This chapter presents an overview of commonly used traffic models reflecting recentdevelopments in the field. The first step in modeling is understanding the statisticalcharacteristics of the traffic. The first section reviews common statistical measures such asburstiness, long range dependence, and frequency analysis. Next, we examine commoncontinuous-time and discrete-time source models. These models are sufficiently general to applyto any type of traffic, but application-specific models are tailored closer to particularapplications. We highlight studies of the major Internet applications: World Wide Web, peer-topeer file sharing, and streaming video. In the last section, we examine two major ways that thenetwork affects the source traffic. First, traffic sources can be “policed” at the network access.4
Second, the dynamics of TCP flows (the majority of Internet traffic) are affected by networkcongestion and active queue management schemes at network nodes.Packets, flows, and sessionsSome terminology should be introduced at this point because traffic can be viewed atdifferent levels, as shown in Figure 1. When the need arises, a host will establish a session withanother host. A session is associated with a human activity. For example, a client host will opena TCP connection to port 21 on a server to initiate a FTP session. The TCP connection will beclosed at the end of the FTP session. Or a session may be viewed as the time interval when adial-up user is connected to an ISP. For connection-oriented networks such as ATM, a session isa call established and terminated by signaling messages. Traffic modeling at the session (or call)level consists of characterizing the start times and duration of each cketPacketFig. 1. Levels of traffic5
During a session, each host may transmit one or more packet flows to the other host(Roberts, 2004). Although the term is used inconsistently in the literature, a flow is commonlyconsidered to be a series of closely spaced packets in one direction between a specific pair ofhosts. Packets in a flow usually have common packet header fields such as protocol ID and portnumbers (in addition to source and destination addresses). For example, an FTP session involvestwo packet flows between a client and server: one flow is the control stream through TCP port21, and the second flow is the data stream (through a negotiated TCP port). Traffic modeling atthe flow level consists of characterizing the random start times and durations of each flow.TCP flows have been called “elephants” and “mice” depending on their size. Anelephant’s duration is longer than the TCP slow start phase (the initial rate increase of a TCPconnection until the first dropped packet). Due to their short duration, mice are subject to TCP’sslow start but not to TCP’s congestion avoidance algorithm. Less common terms are“dragonflies,” flows shorter than two seconds, and “tortoises,” flows longer than 15 minutes(Brownlee and Claffy, 2003). Traffic measurements have suggested that 40-70 percent ofInternet traffic consist of short flows, predominantly Web traffic. Long flows (mainly non-Webtraffic) are a minority of the overall traffic, but have a significant effect because they can lasthours to days.Viewed in more detail, a flow may be made up of intermittent bursts, each burstconsisting of consecutively transmitted packets. Bursts may arise in window-based protocolswhere a host is allowed to send a window of packets, then must wait to receive credit to sendanother window. Another example is an FTP session where a burst could result from each filetransferred. If a file is large, it will be segmented into multiple packets. A third example is atalkspurt in packet voice. In normal conversations, a person alternates between speaking and6
listening. An interval of continuous talking is a talkspurt, which results in a burst of consecutivepackets.Finally, traffic can be viewed at the level of individual packets. This level is concernedonly with the arrival process of packets and ignores any higher structure in the traffic (bursts,flows, sessions). The majority of research (and this chapter) address traffic models mainly at thepacket level. Studies at the packet level are relatively straightforward because packets can beeasily captured for minutes or hours.Studies of traffic flows and sessions require collection and analysis of greater trafficvolumes because flows and sessions change over minutes to hours, so hours or days of trafficneed to be examined. For example, one analysis involved a few packet traces of several hourseach (Barakat, Thiran, Iannaccone, Diot, and Owezarski, 2003). Another study collected eightdays of traffic (Brownlee and Claffy, 2002).The modeling processTraffic models reflect our best knowledge of traffic behavior. Traffic is easier tocharacterize at sources than within the network because flows of traffic mix together randomlywithin the network. When flows contend for limited bandwidth and buffer space, theirinteractions can be complex to model. The “shape” of a traffic flow can change unpredictably asthe flow progresses along its route. On the other hand, source traffic depends only on the rate ofdata generated by a host independent of other sources.Our knowledge is gained primarily from traces (measurements) of past traffic consistingof packet arrival times, packet header fields, and packet sizes. A publicly available trace ofEthernet traffic recorded in 1989 is shown in Figure 2. A trace of Star Wars IV encoded by7
MPEG-4 at medium quality is shown in Figure 3 (data rate per frame). Traffic can be measuredby packet sniffers or protocol analyzers, which are specialized pieces of hardware and softwarefor recording packets at link rates (Thompson, et al., 1997). Common sniffers are tcpdump,Snort, and Ethereal. These can be easily connected to transmission links, local area networks, ormirrored ports on switches and routers. Also, traffic volume is routinely recorded by routers aspart of the simple network management protocol (SNMP). In addition, some NetFlow-capablerouters are able to record simple flow information (e.g., flow start/stop times, number of bytes,and number of packets).Fig. 2. Ethernet traffic trace.8
Fig. 3. Trace of Star Wars IV encoded at medium quality MPEG-4.One of the practical difficulties in traffic modeling is collecting and analyzing large setsof traffic measurements. Traffic can be highly variable, even between two similar types ofsources. For example, one video might have many scene changes reflected by frequent spikes inthe source rate, while another video might have few scene changes resulting in a smoother sourcerate. Therefore, it is good practice to collect measurements from many sources or over manytime periods, and then look for common aspects in their behavior. In probabilistic terms, eachtraffic trace is a single realization or sample of the traffic behavior. A small sample set couldgive a misleading portrayal of the true traffic behavior.9
A good choice for stochastic model should exhibit accuracy and universality. Accuracyrefers to a close fit between the model and actual traffic traces in statistical terms. Sometimesaccuracy is judged by the usefulness of a model to predict future behavior of a traffic source.Universality refers to the suitability of a model for a wide range of sources. For example, anMPEG traffic model should be equally applicable to any particular video source, not just to StarWars (although the parameter values of the model may need to change to fit different sources).Our knowledge of traffic is augmented from analyses and simulations of protocols. Forexample, we know that TCP sources are limited by the TCP congestion avoidance algorithm.The TCP congestion avoidance algorithm has been analyzed extensively, and TCP sources havebeen simulated to investigate the interactions between multiple TCP flows to verify the stabilityand fairness of the algorithm.Ultimately, a traffic model is a mathematical approximation for real traffic behavior.There are typically more than one possible model for the same traffic source, and the choicedepends somewhat on subjective judgment. The choice often lies between simple, less accuratemodels and more complex, accurate models. An ideal traffic model would be both simple to useand accurate, but there is usually a trade-off between simplicity and accuracy. For example, acommon time series model is the p-order autoregressive model (discussed later). As the order pincreases, the autoregressive model can fit any data more accurately, but its complexity increaseswith the number of model parameters.Uses of traffic modelsGiven the capability to capture traffic traces, a natural question is why traffic models areneeded. Would not traffic measurements be sufficient to design, control, and manage networks?10
Indeed, measurements are useful and necessary for verifying the actual network performance.However, measurements do not have the level of abstraction that makes traffic models useful.Traffic models can be used for hypothetical problem solving whereas traffic measurements onlyreflect current reality. In probabilistic terms, a traffic trace is a realization of a random process,whereas a traffic model is a random process. Thus, traffic models have universality. A traffictrace gives insight about a particular traffic source, but a traffic model gives insight about alltraffic sources of that type.Traffic models have many uses, but at least three major ones. One important use of trafficmodels is to properly dimension network resources for a target level of QoS. It was mentionedearlier that Erlang developed models of voice calls to estimate telephone switch capacity toachieve a target call blocking probability. Similarly, models of packet traffic are needed toestimate the bandwidth and buffer resources to provide acceptable packet delays and packet lossprobability. Knowledge of the average traffic rate is not sufficient. It is known from queueingtheory that queue lengths increase with the variability of traffic (Kleinrock, 1976). Hence, anunderstanding of traffic burstiness or variability is needed to determine sufficient buffer sizes atnodes and link capacities (Barakat, et al., 2003).A second important use of traffic models is to verify network performance under specifictraffic controls. For example, given a packet scheduling algorithm, it would be possible toevaluate the network performance resulting from different traffic scenarios. For another example,a popular area of research is new improvements to the TCP congestion avoidance algorithm. It iscritical that any algorithm is stable and allows multiple hosts to share bandwidth fairly, whilesustaining a high throughput. Effective evaluation of the stability, fairness, and throughput ofnew algorithms would not be possible without realistic source models.11
A third important use of traffic models is admission control. In particular, connectionoriented networks such as ATM depend on admission control to block new connections tomaintain QoS guarantees. A simple admission strategy could be based on the peak rate of a newconnection; a new connection is admitted if the available bandwidth is greater than the peak rate.However, that strategy would be overly conservative because a variable bit-rate connection mayneed significantly less bandwidth than its peak rate. A more sophisticated admission strategy isbased on effective bandwidths (Kelly, 1996). The source traffic behavior is translated into aneffective bandwidth between the peak rate and average rate, which is the specific amount ofbandwidth required to meet a given QoS constraint. The effective bandwidth depends on thevariability of the source.SOURCE TRAFFIC STATISTICSThis section gives an overview of general statistics to characterize source traffic. Thetraffic may be represented by its time-varying rate X(t) in continuous time or Xn in discretetime. In practice, we are often measuring the amount of data generated over short periodic timeintervals, and then the traffic rate is the discrete-time process Xn . A discrete-time process is alsoeasier for computers to record and analyze (as a numerical vector) than a continuous-timeprocess. On the other hand, it might be preferable to view the traffic rate as a continuous-timeprocess X(t) for analysis purposes, because the analysis in continuous time can be more elegant.For example, video source rates are usually characterized by the data per frame, so Xn wouldrepresent the amount of data generated for the nth frame. But Xn could be closely approximatedby a suitable continuous-time process X(t) for convenience, if analysis is easier in continuous12
time. Alternatively, traffic may be viewed as a point process defined by a set of packet arrivaltimes {t1 ,t 2 , } or equivalently a set of interarrival times ! n t n " t n"1 .When a traffic trace is examined, one of the first analysis steps is calculation of variousstatistics. Statistics can suggest an appropriate traffic model. For example, an exponentialautocorrelation function is suggestive of a first-order autoregressive process (discussed later).Simple statisticsThe traffic rate is usually assumed to be a stationary or at least wide sense stationary(WSS) process for convenience, although stationarity of observed traffic is impossible to provebecause it is a property over an infinite (and unobservable) time horizon. WSS means that themean E(Xt ) is constant over all time t, and the autocovariance functionRX (t, s) E[(Xt ! E(Xt ))(X s ! E(X s ))](1)depends strictly on the lag t ! s and can be written as RX (t ! s) .First-order statistics such as peak rate and mean rate are easy to measure. The marginalprobability distribution function can be estimated by a histogram. Second-order statistics includethe variance and autocorrelation function! X (t " s) RX (t " s) / RX (0) .(2)An example of the autocorrelation function estimated for the Ethernet traffic from Figure 2 isshown in Figure 4 (lag is in units of 10 ms). The variance i
Chapter in The Handbook of Computer Networks, Hossein Bidgoli (ed.), Wiley, to appear 2007 Network Traffic Modeling Thomas M. Chen Southern Methodist University, Dallas, Texas OUTLINE: 1. Introduction 1.1. Packets, flows, and sessions 1.2. The modeling process 1.3. Uses of traffic models 2. Source Traffic Statistics 2.1. Simple statistics 2.2. Burstiness measures 2.3. Long range dependence and .
May 02, 2018 · D. Program Evaluation ͟The organization has provided a description of the framework for how each program will be evaluated. The framework should include all the elements below: ͟The evaluation methods are cost-effective for the organization ͟Quantitative and qualitative data is being collected (at Basics tier, data collection must have begun)
Silat is a combative art of self-defense and survival rooted from Matay archipelago. It was traced at thé early of Langkasuka Kingdom (2nd century CE) till thé reign of Melaka (Malaysia) Sultanate era (13th century). Silat has now evolved to become part of social culture and tradition with thé appearance of a fine physical and spiritual .
On an exceptional basis, Member States may request UNESCO to provide thé candidates with access to thé platform so they can complète thé form by themselves. Thèse requests must be addressed to esd rize unesco. or by 15 A ril 2021 UNESCO will provide thé nomineewith accessto thé platform via their émail address.
̶The leading indicator of employee engagement is based on the quality of the relationship between employee and supervisor Empower your managers! ̶Help them understand the impact on the organization ̶Share important changes, plan options, tasks, and deadlines ̶Provide key messages and talking points ̶Prepare them to answer employee questions
Dr. Sunita Bharatwal** Dr. Pawan Garga*** Abstract Customer satisfaction is derived from thè functionalities and values, a product or Service can provide. The current study aims to segregate thè dimensions of ordine Service quality and gather insights on its impact on web shopping. The trends of purchases have
Chính Văn.- Còn đức Thế tôn thì tuệ giác cực kỳ trong sạch 8: hiện hành bất nhị 9, đạt đến vô tướng 10, đứng vào chỗ đứng của các đức Thế tôn 11, thể hiện tính bình đẳng của các Ngài, đến chỗ không còn chướng ngại 12, giáo pháp không thể khuynh đảo, tâm thức không bị cản trở, cái được
Part One: Heir of Ash Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Chapter 12 Chapter 13 Chapter 14 Chapter 15 Chapter 16 Chapter 17 Chapter 18 Chapter 19 Chapter 20 Chapter 21 Chapter 22 Chapter 23 Chapter 24 Chapter 25 Chapter 26 Chapter 27 Chapter 28 Chapter 29 Chapter 30 .
TO KILL A MOCKINGBIRD. Contents Dedication Epigraph Part One Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Part Two Chapter 12 Chapter 13 Chapter 14 Chapter 15 Chapter 16 Chapter 17 Chapter 18. Chapter 19 Chapter 20 Chapter 21 Chapter 22 Chapter 23 Chapter 24 Chapter 25 Chapter 26
