Transcript Document
A Nonstationary Poisson View of Internet Traffic Thomas Karagiannis joint work with Mart Molle, Michalis Faloutsos, Andre Broido What is the nature of Internet traffic? The fundamental question • How does Internet traffic look like? Two competing models • Poisson and independence assumption Kleinrock (1976) • Self-similarity, Long-Range Dependence, heavy tails Revolutionized modeling Poisson has largely been discredited 2 The Poisson assumption may still be applicable ! We revisit the question: LRD or Poisson? • We focus on Internet core • Things may have changed: massive scale and multiplexing Our observations: • Packet arrivals appear Poisson and independent • We observe nonstationarity at multi-second time scales • Traffic exhibits LRD properties at scales of seconds and above Our conjecture: Traffic as a nonstationary Poisson process? • This view appears to reconcile the multifaceted behavior 3 Background: Self-similarity and LRD Self-similarity opens new horizons in traffic modeling • On the Self-Similar Nature of Ethernet Traffic. (1994) W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson. • Wide Area Traffic: The Failure of Poisson Modeling. (1995) V. Paxson and S. Floyd. • Self-similarity through high-variability: statistical analysis of ethernet LAN traffic at the source level (1995) W. Willinger, M. S. Taqqu, R. Sherman, and D. V. Wilson. • Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes. (1997) M. E. Crovella and A. Bestavros. New tools and models • Wavelet Analysis of Long-Range Dependence (1998) P. Abry and D. Veitch. 4 Traces Traces taken by CAIDA monitors at a Tier 1 Internet Service Provider (ISP) • OC48 link (2.4Gbps) • State of the art Dag4 monitors • August 2002, January 2003, April 2003 Traces from the WIDE backbone • Trans-Pacific 100Mbps link (June 2003) 5 Packet arrivals appear Poisson! Backbone: Interarrival times follow the exponential distribution • CCDF is a straight line with 99.99% correlation coefficient Arrivals appear uncorrelated • We examine correlations with several tools CCDF of packet interarrival times (100Mbps) log(P[X>x]) log(P[X>x]) CCDF of packet interarrival times (OC48) interarrival times (microsec) interarrival times (microsec) 6 LAN 1989 vs. Backbone 2003 LAN - August 1989 • Bellcore traces • The trace that started the LRD revolution Backbone - January 2003 • Current backbone traces Packet interarrival distribution 7 At the same time, traffic exhibits LRD properties Statistical tools show LRD at large scales Dichotomy in scaling behavior • Hurst exponent 0.7-0.85 at larger scales Abry-Veitch Wavelet estimator 8 Backbone traffic appears smooth but nonstationary at multi-second time-scales Rate changes at second scales Canny Edge Detector algorithm from image processing to detect changes 9 Could nonstationarity appear as LRD? LRD properties diminish when global average is replaced by moving average in ACF 10 How can we reconcile the observed behavior? Observed behavior • Poisson packet arrivals • Nonstationary rate variation • Long-range dependence Our conjecture: A time-dependent Poisson characterization of traffic • when viewed across very long time scales, exhibits the observed long-range dependence • It has been supported by theoretical work (e.g., Andersen et al. JSAC ’98) 11 Caveats – Why we don’t have a definitive answer Data collection • Duration, representative sample • Backbone versus access link Estimation not calculation • Tools offer approximations and not definite conclusions Approaching the truth • Different theories may explain different facets of the behavior at different scales 12