IEEE International Conference on Emerging Technologies September 17-18, Islamabad

Transcription

1 Sajjad Ali Mushtaq 1 & Azhar A. Rizvi 2 CIIT Abbottabad Pakistan 1 & Department of Electronics, Quaid-I-Azam University Islamabad, Pakistan 2. alisajjad_mushtaq@yahoo.com 1 & azhar@qau.edu.pk 2 Abstract Network traffic due to its heterogeneity can be modeled by heavy tail distributions. A 100 Mbps Ethernet link has been used to capture the network traffic(ip Packets) and the measurements on a Switched Ethernet System are presented that reveal new insights into the statistical nature of the traffic. Various parameters of sniffed network traffic from six different datasets are parsed for its characterization. Packet inter-arrival time and packet size are statistically evaluated and analyzed. Packet inter-arrival time follows power law and can be modeled by heavy tail distribution (Pareto distribution). Hybrid mathematical model of packet size has also been presented. Keywords Wor d Wide Web(WWW), Quality of Service(QoS), Switched Network, Probability Density Function, Heavy Tail Distribution I. INTRODUCTION The last decade has been an active era for research in local and global communication networks which includes telephony networks, mobile communication, LAN/WAN and the Internet. Data networks have become trendy while giving birth to smart and cool technology along with computing since the magical development of WWW (World Wide Web) [1] at CERN. Internet is the most multifarious, versatile, and dynamic system ever since developed on the planet. There are many varieties of network connectivity, architecture, equipment and accordingly different types of traffic flows. It has converted the world into a global village and now-a-days you can not even think of a micro second down time. The alteration of this network of network is immensely complicated and difficult as there is no centralized control and administration and this huge network is not owned by any organization or an individual. However, because of such factors there is always a need for an in depth analysis and study of the system for its smooth operation and future planning and every segment have to play its role and should feel the responsibility. Due to the scale and diversity of its physical infrastructure, the distributed nature of its administrative control, the distributed operation of its protocols, the variability of traffic patterns, the diversity of applications, users and most importantly the interplay of these and other factors, a coherent understanding of the network traffic behavior has to be developed by the experts and researchers. To solve the problem of modeling the network traffic, a multi-disciplinary approach from electronics, computer science, mathematics and statistics point of view is required. In this regard, it is emphasized that what is intended is not a mathematical model, although this could be one outcome, but rather the development of a deep understanding of the scientific and engineering principles underlying the current network/internet, in particular, and distributed communications systems, in general. In addition, the outcomes will help to better design, control, manage, interpolate and extrapolate the network. It will enable us to develop professional simulators, design and develop fast, efficient and robust protocols resulting in the optimization of computer and communication systems along with applications Circuit switched networks are highly static in their topology and their loading. They have typical users whose patterns are well known. Averages describe the system well and it is possible to make use of relatively simple mathematical models which have direct physical interpretation. These models require only inputs which are readily estimated from available data. Growth rates are very predictable and network controls are highly or fully centralized which means that the information about the network s global state can be utilized for system optimization. The packet switched networks on the other hand exhibit entirely different characteristics due to its dynamicity and versatility. Without an appropriate model it is impossible to obtain an insight that is required to efficiently plan, manage and operate a network to render a satisfactory quality of service (QoS). The packet switched traffic due to its complicated structure and stochastic behavior [2] require a number of parameters for its characterization. The rapid growth of network/internet technologies has created an urgent need for predictive models of performance. To this end it has become imperative to obtain a good abstraction of the diverse types of network traffic. In preparation for the building of performance models for network performance, we have measured and analyzed network traffic. In the good old days of traffic engineering, modeling congestion in telecommunications networks was simpler than today. There was only one kind of traffic of any significance, and that was voice. It had (and has) well-known characteristics; namely, Poisson inter-arrival rates (time between calls reaching the central office switch) and exponential call length distribution. There was no need to worry about things such as network layers, as they did not exist. It was easy to measure critical values of the important parameters. Queuing /05/$ IEEE 246

2 theory permitted analysis of voice networks to meet any desired performance characteristics; for example, call-blocking probability. Unfortunately, those days are gone forever. With packet networks, multilayer protocols are here to stay. This means many more invariants, as one or more are generally associated with each network layer, far more complicated traffic statistics, and accordingly much greater difficulty while analyzing and simulating network traffic. There is also a far greater number of applications (not just voice conversation), each with its own traffic characteristics, and new applications can arise at any time. There are many more varieties of network connectivity, architecture, equipment, and, accordingly, different types of traffic flow. There are no standard network topologies around which all design efforts can be based, and the topologies that exist are subject to constant change. "Success disasters" occur regularly, new soft-ware technologies which spread like wildfire through the Internet before they can be optimally engineered. The design of circuit-switched networks, used for over 100 years to carry telephone traffic throughout the world, is a wellunderstood and highly refined discipline. Such networks can be engineered to provide any desired level of service. This is because the underlying voice traffic characteristics, first investigated by Erlang in , [5] are also well-understood and have been the basis of elaborate theoretical development. What is the goal of network analysis and design? Of course, it is to design reliable networks that will meet specified performance criteria under all expected load conditions. For packet networks considerable progress has been made for invariants. The parsimonious models are especially important, because they are mathematically tractable and which can be applied over a wide range of conditions with considerable confidence and limited need to guess parameter values. In particular, most of the tools developed for telephone networks do not work for packet networks. As an example, queuing theory, a highly refined discipline often used to analyze networks, requires "wellbehaved" probability distribution functions for its solutions to converge. Packet traffic is unfortunately characterized by illbehaved distributions with "heavy-tails". The first step in all modeling, simulation, and analysis is to look for invariants, defined as some facet of network/internet behavior shown to hold over a wide range of environments and to be observable by any observer. Such invariants are the "hooks" on which hangs mathematical analysis of networks. Poisson arrival rates and exponential call duration are two of them which have been used in voice telephony for 70 years, with great success. The problem is much more difficult in data networks such as network/internet, characterized by multiple layers, great heterogeneity of topology and applications, constantly changing and non-standard topologies, new applications arising, e.g., World Wide Web, changes within applications, e.g., shift from text to graphics to audio to video. The net result is many invariants, each of which occurs at a specific layer The motivation here is to provide a better understanding of network issues and to provide datasets which can be used to validate future networks and network traffic models. Network traffic has been measured by many researchers and been analyzed in many different ways ever since the seminal papers of Leland et al. and Eramili et al. [3, 4]. The main interest is to obtain a better understanding of the characteristics of network traffic. In addition, however, we want to build an accurate model of network traffic. To this end, we grabbed six different datasets from a LAN by tweaking the Redhat Linux 9.0 kernel to get optimal performance for our user level process. We have used Packet Capturing Libraries following the software engineering principal "Don t Reinvent the Wheel". During the process we have to face lot of problems like capturing continuous traffic for a long time span, parsing big files on an ordinary computer and plotting the parsed data. After having the required data we then carefully parameterized these datasets using insights from various observations of real traffic. The distribution of packet inter-arrival times exhibit power law and can be modeled by heavy tail distribution. Packet size distribution is a characteristic of the network traffic and describes the size of packets traveling across the network. If every packet in production workloads has the same size, we wouldn t have any need for a distribution statistics but in reality production networks are host to a wide range of packet sizes and the packet size distributions of most production workloads are far from ideal. Packet size distribution plays a significant role in the performance of networks. Packet size distribution reveal that there are different classes of packet size and about half of the packets carry the maximum number of data bytes while the remaining half are distributed in different classes. II. DATASETS FOR DESIRED ANALYSIS We have used Redhat Linux 9.0 for capturing packets. Although we have tried to run the same operation on windows but windows time stamp resolution was not precise as compared to the Redhat Linux due to architecture of the operating system. DAG cards are also available for having high time resolution and precise time stamping, but these cards were not available so we have to rely on simple network cards the only state of the art difference we can have is the choice of an efficient operating system so we choose Redhat Linux 9.0. The packet is time stamped as part of the process of the network interface s device driver, or the networking stack, handling it. This means that the packet is not time stamped at the instant that it arrives at the network interface; after the packet arrives at the network interface, there will be a delay until an interrupt is delivered or the network interface is polled (i.e., the network interface might not interrupt the host immediately - the driver may be set up to poll the interface if network traffic isheavy, to reduce the number of interrupts and process more packets per interrupt), and there will be a further delay between the point at which the interrupt starts being processed and the time stamp is generated. So packet are not time stamped as seen by the NIC(Network Interface Card) rather they are time stamped when seen by the kernel. The network shown in Fig. 1 we are dealing with is a conventional Ethernet Switched Network having hybrid star/bus topology. We had sniffed the traffic of a cache(proxy)/web Server conntecd 247

3 (0) ack win (DF) tos[0x10]. As in the line the field "09:27: " is the time in hh(hours): mm(minutes): ss(seconds): fraction(note thatthe fraction is one millionth of a second), "eth0" is the interface type, " " is the source IP address with port, " telnet" is destination IP address, " : (0)" is the sequence number, "ack " mean acknowledgement number, "win 64770"is the packet size then a TCP flag like SYN, FIN etc appears, "DF" means don t fragment any more and "tos[0x10]" is the type of service. Fig. 1. Layout of the Network Where Traffic has been Captured connected with the "Main Switch" situated in ISP where most of the network traffic hits. The machine has 2.4 Giga Hertz Dual Processor with 512 MB RAM (Xeon Server with 1MB L2 cache). To monitor a conventional Ethernet switched network one simply requires only one NIC (Network Interface Card) and it has to be in promiscuous mode. We have grabbed only the first few (150) bytes of each packet which contain sufficient information about the source, destination, size and type of frame. The output of the Packet Capture Engine can be written to a file for later analysis. This allows monitoring over long periods of time. We have gathered six datasets and these datasets have 210 MB, 220 MB, 260 MB, 361 MB and 377 MB of captured data. The network traffic had been sniffed continuously and there were some packet losses which can be ignored due to its size, for example if 500 packets are dropped among E6 sniffed ones then the packet drop can be ignored. The traffic will be characterized based on the required parameters. We have developed a parser (Using C Language) which collects useful information from the raw data and stored it into a file. The parser gathers timestamp indicating when the packet reaches the kernel, source and destination IP addresses and port numbers, size of the frame (only the user data is reported, the headers for various protocol layers have to be added on to recover the actual size of the frame) and the traffic type (TCP, UDP, ICMP, etc). These parameters are then further parsed like calculation of inter-arrival time and the results are stored in a file for further analysis. The timestamp is the time the kernel first sees the packets rather than the time it seen by the ethernet card. Sample code for capturing the data is available. Let s have a brief overview of the data grabbed. 09:27: eth > telnet: : III. MEASUREMENT ERRORS We gained some idea of the size of the error in our measurements by looking at the reported inter-arrival times. Given the time stamp and size of the previous packet one can determine the time the Ethernet has been busy and therefore when the next arrival can possibly have happened. This is due to several factors. The network interface card introduces errors by buffering data unreliably. Our Program runs as a user-level process and hence can simply miss CPU cycles if the machine is under a heavy load. PC-based hardware is less reliable so it is relatively easy to attack, essentially by remotely reprogramming the switches. Another reason for the seemingly implausible inter-arrival times may be the fact that we monitor a full-duplex connection which is able to send and receive simultaneously. However, the kernel of the monitoring OS can only deal with one packet at a time and will hence introduce errors if sending and receiving happens closely together. IV. TRAFFIC ANALYSIS AND MODEL Network analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network. The analysis and modeling of LAN/WAN traffic data represents an important major challenge for engineers, computer scientists, statisticians and for probabilists. Really new ideas and models are needed due to high variability in the network traffic and due to diversity in the equipment. Novel graphical views of data play an important role in depicting and predicting the traffic patterns and behavior. Mathematical models are an abstraction used for analysis and design. A key issue is the appropriate level of abstraction to use networkmodels range from detailed packet level simulations (e.g. ms/s/ns) to statistical models of aggregate traffic patterns. Despite the fact that we are capturing the Network Traffic for Statistical Analysis and Mathematical Modeling of the Network, there can be numerous genuine and valid reasons like identifying network or communication issues, monitoring network performance, verifying network security, tracking communication transactions, logging network traffic, discovering source of unwanted traffic and discovering compromised workstations for building traffic datasets. But there can also be illicit and illegitimate motives to grab the network traffic which includes capturing passwords, sniffing network information, reading confidential information and determining network information. 248

4 Fig. 2. Packet Inter-Arrival Time Histogram V. INTER-ARRIVAL TIME ANALYSIS AND MODEL We concentrate here on the point processes formed by packet arrival events happening at times t i,i I IN. We assume that there are n IN events (observations of events), the first happening at t 1 and the last one at t n.the observation period may begin before the first event and end after the last, so we define it to be with T =[t 0 +t n+1 ] IR with t 0 t 1 t 2... t n t n+1 for the arbitrary, t 0 and t n+1. The inter arrival times t i, 1 i n 1, aredefined as Fig. 3. Log-log Scale Inter-Arrival Time Plot for Combined Data Set. t i = t i+1 t i (1) For a finite observation of a point process we can easily generate a histogram that approximates the probability density function of inter-arrival time. But we have used Origin- Lab(OriginPro 7.5 E) for further analysis and graphs. The time series X(t) resulting from our measurements describe point processes. One way to characterize the behavior of such a process is to compute the Probability distribution of inter arrival times of the events. To do this, we plot the interarrival time histograms (IIH) on log-log scale with bin size as showninfig.2 Fig. 4. Log-log Scale Inter-Arrival Time Plot for 377 MB Data Set. Next we have computed the probabilities and plot the Probability Density Function for packet inter-arrival time. The y-axis of the plot is the number of inter arrival times falling into a given bin divided by the size of the bin (to approximate a density function and make sure that bigger bins do not get a bigger weight) and also divided by the total number of arrivals (so that we can compare different observation periods). For most plots we find that a large part of the resulting graph can be fitted to straight line. This implies that there is a power law behavior of the probability density function y = p (x) =ax b. This is a characteristic behavior for heavy tail distributions like Pareto. Also from the values of a and b we can see that it is a heavy tail distribution and the values lies close to the Pareto distribution (Remember that we are plotting the values on log-log scale). The Fig. 3 encompasses the characterization of combined dataset. As we have mentioned that we have six different datasets and we are presenting plots of five datasets only. As we are dealing with values in micro scale while considering the inter-arrival time and on the other hand we have to play with huge number of packets which fall into that small scale bin so we have presented log-log scale analysis. From the Figs. 3, 4, 5, 6, 7 and 8, we found that the Probability Density Function has infinite mean as a 1 and infinite variance for b 2, so follow power law. In a power-law we have y = ax b,which means log (y) =log(a)+b log (x). This 249

5 Fig. 5. Log-log Scale Inter-Arrival Time Plot for 361 MB Data Set. Fig. 7. Log-log Scale Inter-Arrival Time Plot for 220 MB Data Set. Fig. 6. Log-log Scale Inter-Arrival Time Plot for 260 MB Data Set. Fig. 8. Log-log Scale Inter-Arrival Time Plot for 201 MB Data Set. refers to the heavy tail Pareto distribution by looking at the values of a and b. All the six datasets yield almost similar Probability Density Function. VI. PACKET SIZE ANALYSIS AND MODEL If every packet in production workloads has the same size, we wouldn t have any need for a distribution statistics but in reality production networks are host to a wide range of packet sizes and the packet size distributions of most production workloads are far from ideal. Packet size distribution plays a significant role in the performance of networks Packet size distribution reveal that there are different classes of packet size and about half of the packets carry the maximum number of data bytes while the remaining half are distributed in different classes. We have analyzed network traffic packet size and also performed zoomed analysis for more details. The CDF for Combined dataset has been shown in Fig. 9 and the Fig. 10 is representing the actual curve in dotted lines while the fitted curve with solid lines in five different portions. Figure.11 is showing the normalized Probability Density Function. 250

6 Fig. 9. CDF for Combined Dataset Fig. 11. Normalized PDF(By a Factor of (10 4 ) IP Packets has most of the hardware architecture(sun, IBM, Intel), hybrid Operating System(Linux, Solaris, Windows etc) environment along with hybrid topology. It has almost 500 plus wired and wireless nodes which are up 24 hours a day. Keeping in view all these factors an in depth study and analysis has been done which reveals that the Switched LAN(segment) Traffic can be modeled by Pareto Distribution(A Class of heavy tail distribution). Network Topology and Media can also be a strong candidate for this model but these have not been evaluated and we will focus on them in our future work. Although Ethernet is very popular Local Area Network Standard but now it is almost 35 years old. The enhancements in the media, equipment are skying but the protocols and applications required to be revamped. Our work can help to get better insights into the nature of the LAN Traffic. Packet size has also different classes and most of the packets have very small(requests) and large(actual data) data while the rest of the packets fall into other three different classes, so segmentation algorithms on different layers can be a reason for this biased segmentation. Fig. 10. Piecewise Curve Fitting Having 5 Segments VII. CONCLUSIONS In many internet traffic engineering and modeling research works, authors are of the opinion that internet traffic (Datasets of the order of giga/tera bytes) can only be modeled by heavy tail distribution due to heterogeneity and variability of the network infrastructure. But we have proved that the segment (LAN) traffic (Datasets of the order of megabytes) can also be modeled by heavy tail distribution. It is due to the fact that now-a-days, LANs are moving towards heterogeneity and variability. The dynamicity, versatility and flexibility of the equipment, applications, architecture and topology are thekeyfactors.thelan(segment)wherewehavecaptured REFERENCES [1] M. Crovella and A. Bestavros, Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes, IEEE/ACM Transactions on Networking, vol. 5, no. 6,(1997) pp [2] D. Chakraborty, A. Ashir, T. Suganuma, G. Mansfield, T. Kinoshita, T.K. Roy, N. Shiratori "Self-similar and Fractal Nature of Internet Traffic". International Journal of Network Management. Vol.14, Issue 2, pp , March [3] Will E. Leland, Murad Taqqu, Walter Willinger and Daniel Wilson, On the Self-Similar Nature of Ethernet Traffic (Extended Version), IEEE/ACM Transactions on Networking, Vol. 2, No. 1, February 1994 [4] Ashok Eramilli, Onuttom Narayan and Walter Willinger, Experimental Queuing Analysis with Long-Range Dependent Packet Traffic, IEEE/ACM Transactions on Networking, Vol. 4, No. 2, April [5] Will E. Leland, Murad Taqqu, Walter Willinger and Daniel Wilson, On the Self-Similar Nature of Ethernet Traffic (Extended Version), IEEE/ACM Transactions on Networking, Vol. 2, No. 1, February