Vega VoIP Traffic Analysis and Selfsimilarity

Transcription

1 A Traffic Analysis per Application in a real IP/MPLS Service Provider Network Paulo H. P. de Carvalho 1, Priscila Solís Barreto 1,2, Bruno G. Queiroz 1, Breno N. Carneiro 1, Marcio A. de Deus 1 1 Electrical Engineering Department, 2 Computer Science Department University of Brasilia, Campus Asa Norte, , Brasilia-DF, Brazil paulo@ene.unb.br, pris@cic.unb.br, marcio.deus@ieee.org Abstract. In this work, real traffic of a wide telecommunications service provider IP/MPLS network is analyzed. A classification per application using a traffic characterization procedure based on self-similarity is done on real traffic series, collected on several days in different time periods. The results show that the real traffic confirms high values of self-similarity, which appears with a relevant Hurst parameter. These results are used for the proposal of a method of network capacity planning which will allow a more efficient bandwidth use in function of each applications needs. Keywords: Traffic characterization, network analysis, self similarity, IMS, IP, MPLS. 1 Introduction One of the valuable contributions to the telecommunication industry in the next few years will be new methods to help capacity planning in a real service provider backbone considering the service convergence of the last years. The converged networks are expected to deliver audio and video transmissions with quality as good as that of a circuit switching network. In order to make it possible, the network must offer a guarantee when it comes to bandwidth provisioning, delay, jitter and packet loss. The provider backbones are the main mean of transport for all kind of applications with different behaviors which are aggregated in different links. The capacity planning becomes a hard task considering the multiple heterogeneous traffic sources such as video, voice, peer-to-peer applications, data file exchange, all with different QoS needs. One role of thumb applied in the fields is to overprovision the capacity link in function of a mean traffic value due to systematic traffic observations. The processes of traffic characterization and modeling are preponderant points of a

2 feasible network project. A precise traffic modeling may allow the understanding of a physical network problem under a mathematical view whose solution may not be simpler but may be more accurate and thereby result in a better relation of cost and benefit. One kind of traffic that is often present in wideband networks is the burst traffic. A traffic source that appears to have this behavior is formed from applications such as compressed video services and file transfers. This traffic is characterized by periods with activity (on periods) and periods without activity (off periods). To model this kind of traffic, one has configure the distribution of the on and off periods, in addition to the type of traffic sent during the on period. There are several mathematical models which intend to describe the behavior of traffic sources. Traditionally, the Poisson traffic model was originally applied in the switching networks. But, since 1994, motivated by [1], the Poisson model for Internet traffic started to be questioned. This study verified that the behavior of traffic on Ethernet networks was considerably different from a Poisson source and that it presented self-similar process characteristics as well as long-range dependence. A stochastic process Y(t) is said to be self-similar with Hurst parameter ½ < H < 1 when Y(t) = a -H Y(at) with a > 0, where the equality has probabilistic sense. The aforementioned Hurst parameter plays a major role on the measurement of the selfsimilarity degree of the traffic. The closer it is of the unity, the greatest the self-similarity degree is. The Hurst parameter may be view as a degree of burstiness of the traffic. One of the most popular self-similar processes is the fractional Brownian motion (fbm), which is the only self-similar Gaussian process with stationary increments. The increments process of the fbm is the fractional Gaussian noise (fgn). It is possible to generate self-similar traffic by aggregation of many sources of burst traffics that presents a heavy-tailed distribution for the on period [2]. This procedure may be valuable use to simulate the behavior of a real network before the introduction of new applications. In this article a self-similar traffic characterization of real traces in a wide geographic service provider company for network planning purposes is done. In section 2, the testbed for the traffic measurement is presented as well as the different traffic categories of real traffic, classified per application, collected in different time periods. In section 3, the traffic is characterized using four different methods of calculus for the Hurst parameter. Also a comparison of the Hurst parameter value for different applications and in different time scales is done. In section 4 is discussed the use of these information together with some proposed tools for the network planning task. In section 5 are presented the conclusions and future steps related to this work

3 2 Traffic Measurement Testbed The network under evaluation is a service provider in Brazil, with more than ten million PSTN (Public Switched Telephone Network) subscribers and more than one million ADSL as well. The IP network is formed by an Access, Distribution, Core and Internet Edge levels as shown figure 1. Each access layer is a PPPoX (Point to Point Protocol) router capable called BRAS (Broadband Router Access Server), and is connected to two distribution routers at least, the Distribution router is a Router with 200Gbps aggregate traffic and 40Mpps forwarding rate at least. The Core and Internet Edge are 200Gbps aggregate traffic and 200Mpps forwarding rate, including 200 BGP routes at least. The connections to other regions are done via core connections. All IP interfaces are Gigabit or 10Gigabit Ethernet. In some cases the bearer for theses interfaces is the SDH transport network over a DWDM network. The MPLS protocol is use in the backbone from the Access to the Core Level. There are others MPLS interconnections with several service providers which will not be analyzed in this paper. The network uses Diffserv and the Intserv structure can be deployed to give alternative paths between routing centers that needs resilient and backup path transition at less than 50ms(fifty milliseconds). Internet Internet Edge Layer To others Core routers Core Layer To others 10GEt Core routers Distribuition Layer BRAS BRAS BRAS BRAS Access Layer ADSL Subscribers DSLAMs Fig. 1. Testbed Network Architecture

4 The data collection point was a distribution Gigabit Ethernet interface with more than ADSL broadband subscribers. The scales of traffic collected were: five minutes, one minute and one millisecond, classified by application using Cisco Netflow[4] and the Ethereal open source application[5]. The applications of the network may be divided in two main categories: residential and corporate. The main difference between both is the time period of higher use, in the case of the corporate category this is from Monday to Friday, 08:30 to 19:00 with peaks at 11:00 and 15:00 during the day, as seen Fig. 2 for downstream traffic. The traffic traces in Mbps units are normalized in a sampled period of 31 days. In Fig.3 is showed a more detailed figure of these samples in a seven day period from Monday to Sunday. In Fig. 4 a more detailed analysis of the applications is done in a 24 hour period. In Fig. 5 is shown a classification per application for downstream traffic during a day. As can be seen in the above figures, the most important source of traffic is the HTTP(Browsing) followed by peer-to-peer applications. Also, the VoIP applications are still not a big concern in terms of traffic volume. In fact, the use of new CODECS (compression/decompression) types and with the low traffic volume, the bandwidth used does not present congestion problems. In fact, Skype s[13] CODECS ilbc [14] or isac [15] can uses rates as low as 13,33kbps in the same way that others VoIP applications. Traditionally, the capacity planning at service providers for IP Networks was done using the same premises for PSTN, mainly considering that the traffic was of a Poisson nature. Also, the over provisioning of links is a common task in the field. Both methods invoke some concern about the perspective of the evolution of these networks to achieve the service convergent requirements in the near future, since there is an expectation that the VoIP application users will increase in the next few years. The interconnection of the four Brazilian Tier-1 IP service providers to US and Europe the OPEX costs are around US$250 million per year. The over provisioning planning method appears as a non optimizing option. The business model for IP in emergent markets such as Brazil, Argentina, Chile, Venezuela, Peru and other South American countries have to consider both interconnection costs and transport costs. The complexity of this problem relies in how to increase quality of service without new charges to subscribers.

5 BANDWIDTH SUM Mbps / n SERVICE VoIP National VoIP International Skype P2P Browsing 50 0 (n = integer) 01-21:00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00:0 Day - Time TIMESLOT Fig.2. Downstream traffic on peak and off peak, 31 days sampled 300 BANDWIDTH SUM 250 Mbps / n SERVICE VoIP National VoIP International Skype P2P Browsing :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00:00 Day - Time TIMESLOT Fig.3. Downstream traffic on peak and off peak, 7 days sampled

6 300 BANDWIDTH SUM 250 Mbps / n SERVICE VoIP National VoIP International Skype P2P Browsing 50 (n = integer) :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00:00 Day - Time TIMESLOT Fig.4. Downstream traffic on peak and off peak, 24 hours sampled 100% BANDWIDTH SUM 90% 80% 70% 60% 50% 40% 30% SERVICE VoIP National VoIP International Skype P2P Browsing 20% 10% (n = integer) 0% 01-21:00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00: :00:00 Day - Time TIMESLOT Fig.5. Downstream traffic percent per Service

7 3 The Traffic Characterization The analysis considers a per application separation of traffic [4][6]. The statistical analysis was done using a self-similarity approach, calculating the Hurst parameter estimation using 4 model types. For real time traffic, the Hurst parameter calculation demands attention because in some cases if statistical process does not have a representative long range dependence characteristic the parameter may be wrongly interpreted. Another issue is the trend present in the periodic traffic. For a more accurate estimation, the trends that appeared in the samples were deleted by removing the cycle regularity. The estimation of the Hurst parameter was made using four different methods: the Whittle Hurst Method, the Variance-Time Plot Method, the Kettani-Gubner Method [9] and the Periodogram Method. Also a Chi-squared analysis was made as a non-parametric test of significance [12] due to the fact that it is necessary to verify the distribution similarity. The statistical significance test allows, with a certain degree of confidence, the acceptance or rejection of an hypothesis. The sampled links of the test bed show a load in the worst case of 70%, so we can consider that the routers are not congested most of the time. In Table 1 appears the Hurst parameter estimation for 5 minutes scale of traffic measurements using the Variance Time Plot and the Kettani-Gubner method. As can be seen, the Hurst parameter is always higher than 0.9, which shows a high degree of burstiness in the samples. The third column which shows the chi-square variable for the Gaussian distribution, infers that these were not acceptable for other distributions. Table 1. Total traffic Hurst parameter estimation for 5 minutes average. Day Hurst Hurst Chi-Square (Variance-Time Plot ) (Kettani-Gubner) (Gaussian Distribution) 1 0,928 0,965 47, ,951 0,976 70, ,944 0,967 51, ,916 0,943 37, ,91 0,943 16, ,911 0,941 26, ,955 0,974 42, ,945 0,973 31, ,955 0,979 46, ,939 0,964 48, ,887 0,944 21, ,916 0,947 52, ,954 0,978 35, ,947 0,97 51, ,948 0,973 45, ,951 0,975 23, ,938 0,966 38,146

8 Table 2. HTTP application traffic Hurst parameter estimation for 5 minutes average. Day Hurst Hurst Chi-Square (Variance-Time Plot ) (Kettani-Gubner) (Gaussian Distribution) 1 0,843 0,895 31, ,812 0,878 71, ,901 0,926 38, ,9 0,934 52, ,815 0,879 32, ,816 0,904 62, ,865 0,906 17,91 8 0,87 0,916 39, ,907 0,935 28, ,867 0,919 21, ,869 0,906 27, ,671 0,861 35, ,878 0,909 36, ,839 0,894 44, ,874 0,907 30, ,753 0,85 23, ,851 0,914 40,299 In Table 2 is shown the estimation of the H parameter for the HTTP (Hyper Text Transfer Protocol) applications. As can be seen, the H relies value between 0.67 and 0.93, which also shows a higher degree of self-similarity, considering that the lower value appears just in day 12. In Table 3, which shows the P2P applications, the H parameter relies between 0.86 and In Table 4 the results for the traffic traces in a 1 ms scale are shown. As can be seen, the VoIP applications have an H parameter value between 0.79 and In Table 4, the four applications are compared in a time scale of 1ms. Once again, the total traffic as well as the individual traffic traces is self similar. The number of xdsl access in all cases are 50,000 at least, with 40% of simultaneous connections. We verified that at this level of traffic aggregation, the self similar model can be used as good way to characterize the behavior of the traffic. The results shown in this section verify the existence of a high degree of the self-similarity in the real traffic for most of the applications. 4 Network Planning In Fig. 6 is shown the proposal of a network forecast tool. First, in the network the samples are collected. Then the traffic is classified per application. The estimation and characterization of the parameters of collected samples are made. These parameters are used as input to a traffic forecast tool based on a mathematical traffic model which intends

9 to find the sub-optimal capacity of the link for that traffic load, considering the selfsimilarity nature. The configuration tool does not consider the network element, since the hardware elements of the routers are not the focus of this work. A real backbone must have full time availability, so it cannot be affected by changes due the normal operation. But also, the physical links are not modified in an automatic way. Since the physical links are today over provisioned, the capacity planning procedure will act in a first phase in dimensioning the logical links of the network, so we intend to focus in the tunnels capacity specification in the very first moment. This procedure will be done by using the parameters that describe the traffic, the parameters that describe the network topology and the tunnel capacities as inputs of a simulation tool which is based in a self similar model of QoS measures. The tool will offer the sub-optimal capacities to achieve the QoS requirements and will be used as a feedback in for the network traffic engineering tasks. In figure 7 we describe one example of application of the feedback process using the auto configuration tool to change the tunnel characteristics for an egress traffic marked with Diffserv. In a second phase, the tool will work in the physical links considering the different tunnels and their capacities. Currently, this tool is in development and will be the focus of a future article, considering also multifractal traffic analysis. Table 3. P2P application traffic Hurst parameter estimation for 5 minutes average Day Hurst Hurst Chi-Square (Variance-Time Plot ) (Kettani-Gubner) (Gaussian Distribution) 1 0,915 0,948 63, ,942 0,962 49, ,937 0,963 45,25 4 0,902 0,935 28, ,902 0,928 20, ,901 0,942 30, ,939 0,964 43, ,932 0,964 52, ,937 0,968 39, ,922 0,948 38, ,86 0,926 37,5 12 0,904 0,942 33, ,937 0,965 55, ,922 0,958 46, ,935 0,963 46, ,935 0,967 49, ,933 0,964 37,285

10 Table 4. Hurst parameter estimation for 1ms sample average Application Variance Time-Plot Kettani Total Traffic 0,927 0,945 HTTP 0,916 0,924 P2P 0,89 0,871 VoIP 0,839 0,799 IP/MPLS Network Network Samples Collect Configuration Tool Abstraction of Network Element Packets classification α Estimation and σ Characterization Tool Parameter generation H Traffic forecast tool Auto-configuration Network Decision Fig. 6. The proposal to network real-time forecast. Aggregated Traffic Diffserv Tunnel Selection Interface Aggregated Traffic Intserv RSVP Tunnels Auto Configuration Tool Tunnel Selection Fig. 7. Tunnel selection between two routers

11 5 Conclusion and future works The management and the sizing of a telecom network is a challenging task in the actual scenario of convergence. This allows the operator to guarantee the satisfaction of the users since they are able to achieve a level of quality of the service that is expected and, in the other hand, to diminish the percentage of capital invested without immediate return. The capacity planning procedure with optimizing goals relies in accurate traffic models which describe the real traffic behavior of applications. The first step to begin this procedure is to characterize the traffic and classify the most important applications of a service provider, in terms to identify which are the most significant applications as well as the mathematical model that may describe them. In this work we showed this first step and its potential use for a service provider company which has one of the higher volumes of traffic and users in the South American Region. The traffic analysis showed a high Hurst parameter in almost of the verified applications. This result shows the importance of the development of adequate strategies to treat the traffic in wide range networks. This work proposed a new approach to aid the network planning task based on the applications and the characteristics of the traffic. We expect that this proposal will allow to increase the QoS per application in the network. In future works we will show the influence of the Hölder exponent to characterize the multifractal behavior of the traffic and use this result to produce more accurate models for a network planning tool. References 1. Cerf, Vinton G.: On the Evolution of Internet Technologies Proceedings of the IEEE, vol. 92, No. 9, SEPTEMBER 2004Bruce, K.B., 2. W. Leland, M. Taqqu, W. Willinger, and D. Wilson, On the self-similar nature of ethernet traffic (extended version), IEEE/ACM Trans. on Networking, vol. 2, no. 1, pp , 1994, 3. M. S. Taqqu, W. Willnger and B. Sherman, Proof of a fundamental result in self-similar traffic modeling. Computer Communication Review, vol. 27, p. 5-23, Netfow application and technologies from Cisco Systems accessed 10/15/2006 and available at: 5. Several authors Ethereal application,, accessed on 10/17/2006 and available at: 6. S. Zander, T. Nguyen, G. Armitage, Self-learning IP Traffic Classification based on Statistical Flow Characteristics on Passive & Active Measurement Workshop, Boston, USA, March, 2005 Springer 7. Clegg, R. A Practical Guide to Measuring the Hurst Parameter, Proceedings of 21st UK Performance Engineering Workshop, School of Computing Science, Andersen, A. T. e Newlsen, B. F. A Markovian Approach for Modeling Packet Traffic with Long-Range Dependence, IEEE Journal on Selected Areas in Communications, v.16, n.5, p , Junho 1998.

12 9. Kettani, H. e Gubner, J.A. A Novel Approach the Estimation of the Hurst Parameter in Selfsimilar Traffic, Proceedings of IEEE Conference on Local Computer Networks, Tampa, Flórida, Novembro Leland, W. et. al. On the self-similar nature of ethernet traffic (extended version), IEEE/ACM Trans. on Networking, vol. 2, no. 1, pp , Law, A.M. e Kelton, W. D. Simulation Modeling and Analysis, 2nd ed. Nova Iorque: McGraw- Hill, Connor-Linton, Jeff. Chi Square Tutorial accessed 10/18/2006 and available at: Skype FAQ ILBC codec isac codec.