Transcript Document
A Nonstationary Poisson View of
Internet Traffic
Thomas Karagiannis
joint work with
Mart Molle, Michalis Faloutsos, Andre Broido
What is the nature of Internet traffic?
The fundamental question
• How does Internet traffic look like?
Two competing models
• Poisson and independence assumption
Kleinrock (1976)
• Self-similarity, Long-Range Dependence, heavy tails
Revolutionized modeling
Poisson has largely been discredited
2
The Poisson assumption may still be applicable !
We revisit the question: LRD or Poisson?
• We focus on Internet core
• Things may have changed: massive scale and multiplexing
Our observations:
• Packet arrivals appear Poisson and independent
• We observe nonstationarity at multi-second time scales
• Traffic exhibits LRD properties at scales of seconds and above
Our conjecture: Traffic as a nonstationary Poisson process?
• This view appears to reconcile the multifaceted behavior
3
Background: Self-similarity and LRD
Self-similarity opens new horizons in traffic modeling
• On the Self-Similar Nature of Ethernet Traffic. (1994)
W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson.
• Wide Area Traffic: The Failure of Poisson Modeling. (1995)
V. Paxson and S. Floyd.
• Self-similarity through high-variability: statistical analysis of ethernet LAN
traffic at the source level (1995)
W. Willinger, M. S. Taqqu, R. Sherman, and D. V. Wilson.
• Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes.
(1997)
M. E. Crovella and A. Bestavros.
New tools and models
• Wavelet Analysis of Long-Range Dependence (1998)
P. Abry and D. Veitch.
4
Traces
Traces taken by CAIDA monitors at a Tier 1
Internet Service Provider (ISP)
• OC48 link (2.4Gbps)
• State of the art Dag4 monitors
• August 2002, January 2003, April 2003
Traces from the WIDE backbone
• Trans-Pacific 100Mbps link (June 2003)
5
Packet arrivals appear Poisson!
Backbone: Interarrival times follow the exponential distribution
• CCDF is a straight line with 99.99% correlation coefficient
Arrivals appear uncorrelated
• We examine correlations with several tools
CCDF of packet interarrival times (100Mbps)
log(P[X>x])
log(P[X>x])
CCDF of packet interarrival times (OC48)
interarrival times (microsec)
interarrival times (microsec)
6
LAN 1989 vs. Backbone 2003
LAN - August 1989
• Bellcore traces
• The trace that started the
LRD revolution
Backbone - January 2003
• Current backbone traces
Packet interarrival distribution
7
At the same time, traffic exhibits LRD properties
Statistical tools show LRD at large scales
Dichotomy in scaling behavior
• Hurst exponent 0.7-0.85 at larger scales
Abry-Veitch Wavelet estimator
8
Backbone traffic appears smooth but
nonstationary at multi-second time-scales
Rate changes at second scales
Canny Edge Detector algorithm from image
processing to detect changes
9
Could nonstationarity appear as LRD?
LRD properties diminish when global average
is replaced by moving average in ACF
10
How can we reconcile the observed behavior?
Observed behavior
• Poisson packet arrivals
• Nonstationary rate variation
• Long-range dependence
Our conjecture: A time-dependent Poisson
characterization of traffic
• when viewed across very long time scales, exhibits
the observed long-range dependence
• It has been supported by theoretical work
(e.g., Andersen et al. JSAC ’98)
11
Caveats – Why we don’t have a definitive answer
Data collection
• Duration, representative sample
• Backbone versus access link
Estimation not calculation
• Tools offer approximations and not definite
conclusions
Approaching the truth
• Different theories may explain different facets of the
behavior at different scales
12