In 1994, Leland, Taqqu, Willinger and Wilson demonstrated the presence of ..... [2] J. Beran, R. Sherman, and T. Murad, âLong-Range. Dependence in Variable ...
Adaptive Sampling Methods to Determine Network Traffic Statistics including the Hurst Parameter
Jack Drobisz and Kenneth J. Christensen Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: {drobisz, christen}@csee.usf.edu
Abstract Accurate traffic characterization by packet source is needed to predict network behavior and to properly allocate network resources to achieve a desired Quality of Service for all network users. As networks have become faster, the processing load required for complete packet sampling has also grown. In some cases, for example Gigabit Ethernet, the network can deliver packets faster than a network management subsystem can process them. In order to prevent inaccurate traffic statistics due to “clipping” of traffic peaks, Claffy et al. applied several static sampling strategies to network traffic characterization. As shown in this paper, static sampling may produce inaccurate traffic statistics. In this paper, adaptive sampling methods are developed and evaluated to address inaccuracies of static sampling. In addition, the estimation of the Hurst parameter, a measure of traffic self-similarity, is studied for static and adaptive sampling. It is shown that adaptive sampling results in a more accurate estimation of the mean, variance, and Hurst parameter for packet counts.
1. Introduction With the advent of Gigabit Ethernet and other highspeed network technologies, direct measurement of packet-switched traffic by packet origin has become impossible unless a very fast processor is dedicated to traffic measurement. A slower, and thus less expensive, processor may be used if statistical sampling of network traffic is implemented. With sampling, not all packets are received and “measured” by a network management node, but only a selected fraction of all packets. Future high-
speed networks are likely to carry many distinct types of traffic including bulk data transfer, real-time voice and video, and playback video. Recent work (see [2] and [8]) have shown that network traffic may exhibit properties of Long-Range Dependence (LRD) or self-similarity. Selfsimilar traffic exhibits bursts at multiple time scales and results in greater resource requirements than if simple Poisson models are used for network capacity planning. One measure of self-similarity is the Hurst parameter (see [8]). Being able to estimate the Hurst parameter as part of ongoing traffic measurement is important. Statistical sampling of network traffic was first used by Claffy et al. (see [4]) in the early 1990’s for traffic measurement on the NSFNET backbone. Claffy et al. studied classical event and time driven static sampling methods to reduce the number of packets that would need to be received and processed by a network management node. With sampling during periods of peak traffic the network management processor would not be overutilized resulting in missed packets, or “clipped” peaks. However, during periods of low traffic, the network management processor may have idle capacity that could be used to more accurately characterize network traffic given a finer sampling granularity. This is the key observation to our research, that static sampling may result in under-utilization of a network management processor and inaccurate traffic measurements. In addition, Claffy et al. did not characterize network traffic by packet origin and did not estimate measures of selfsimilarity. In this paper an adaptive sampling method is developed that will be shown to more effectively utilize network management processing capabilities and result in better estimates of traffic measures than static sampling. The remainder of this paper is organized as follows. Section 2 reviews static sampling methods and Section 3 reviews self-similarity. Section 4 describes the Network
Management Subsystem (NMS) which implements traffic sampling. This NMS can be implemented as part of a switch, repeater, or other network component. Section 5 describes the new adaptive sampling methods and Section 6 describes the comparative evaluation of the sampling methods. Section 7 is a summary followed by references.
2. Review of Static Sampling Methods In the early 1990’s, the T1 NFS backbone traffic statistics collected using the NNStat collection mechanism (see [3]) were shown to occasionally result in a loss of statistical information during periods of high backbone utilization. Sampling every 50th packet resulted in a significant improvement in accuracy of statistics taken under high utilization periods [4]. In [4] Claffy et al. describe the application of event and timed-based sampling to network traffic measurement. The three algorithms studied were, systematic, stratified random, and simple random and are shown in Figure 1. In event based or “packet triggered” sampling, packets are counted to determine when the next packet is to be sampled, whereas in timer-based sampling a “timer trigger” is used. Time-based sampling was shown to be less accurate than event-based. Of the event-based sampling methods, all three algorithms could be used for characterizing network traffic.
Systematic sampling
Stratified random sampling
Hurst [1]. In 1994, Leland, Taqqu, Willinger and Wilson demonstrated the presence of slowly decaying packet count bursts across all time scales in traffic on an operational corporate Ethernet LAN [8]. Time series with these characteristics are considered to exhibit LRD and are termed “self similar”. Figure 2 shows event counts of Poisson and Pareto distributions for multiple time scales. For each series, the mean number of events per second is 1000. It can be seen that the Poisson time series becomes “smoother” as the aggregation level increases, however the Pareto series maintains its bursty appearance and is hence “self-similar” across multiple time scales. In the past few years, several non-conventional models such as fractional Brownian motion, fractional AutoRegressive Integrated Moving Average (ARIMA) and chaotic maps had been proposed to simulate self-similar network traffic. Recently, it was shown that a simpler model based on a Pareto distribution might be sufficient. Gordon et al. [7] stipulated that self-similar network traffic is a consequence of power law tails in packet interarrival times. Based on this insight, a model based on the Pareto distribution is,
Pareto( x ) =
βα (β + x )α
where, α and β are constants and x ranges from 0 to ∞. This distribution can be used to generate self-similar synthetic network traffic (i.e., packet inter-arrival times). In this work, the inverse-transform method was used to generate a continuous random variate having distribution function:
Pareto −1 (x ) = − β +
β U
Simple random sampling
Figure 1 - Fixed granularity sampling (from [4])
3. Self Similarity of Network Traffic The concept of self-similarity in the communications field was first introduced by Mandelbrot [9]. He proposed a fractal like model of random error perturbations that appeared to come in bursts not unlike those observed in the early hydrological data studied by
(1)
1 α
.
(2)
The four measures considered in this study are the packet count mean, variance, peak-to-mean ratio (PMR), and Hurst parameter. The PMR is calculated by comparing the peak value with the average value from the population and it is often used as a measure of traffic burstiness, where high PMR means a high burstiness of traffic. This statistic is heavily dependent on the size of the intervals, and therefore may or may not represent the actual traffic [5]. A more accurate indicator of traffic burstiness is given by the Hurst parameter, which can be derived from the re-scaled adjusted range (R/S) statistic.
Interval packet count
1500
1500
1350
1350
1200
1200
1050
1050
900
900
750
750
600
600
450
450
300
300
150
150
0 1
11
21
31
41
51
61
71
81
91
0 1
11
21
Interval packet count
Time interval (size = 1 second) 250
250
225
225
200
200
175
175
150
150
125
125
100
100
75
75
50
50
25
25
0
0 1
11
21
31
41
51
61
71
81
91
1
11
Time interval (size = 0.1 second)
Interval packet count
31
41
51
61
71
81
91
Time interval (size = 1 second)
31
41
51
61
71
81
91
Time interval (size = 0.1 second)
50
50
45
45
40
40
35
35
30
30
25
25
20
20
15
15
10
10
5
5
0
21
0 1
11
21
31
41
51
61
71
81
91
Time interval (size = 0.01 second)
1
11
21
31
41
51
61
71
81
91
Time interval (size = 0.01 second)
Figure 2 - Illustration of self-similarity (Poisson with λ = 1000 versus inverse-Pareto with α = 1.1 and β = 0.0002) The R/S statistic is one of several methods to estimate the Hurst parameter (see also [1] and [6]). Hurst discovered that many naturally occurring time series are well represented by the relation,
E [R (n ) S (n )] ≈ cn H
(3)
where as n → ∞ c is an integer constant and H is a Hurst parameter ( 0.50 < H < 1.0 ). The estimation of H values can be based on a heuristic graphical approach involving linear regression as described in [8]. The data sets resulting in H values between 0.70 and 1.0 are considered to exhibit self-similarity.
4. A Network Management Subsystem Traffic sampling can be implemented within network devices such as repeaters, switches, routers and so on. Such a device would contain a network management subsystem (NMS) with functionality similar to that shown in Figure 3. Existing standards such as SNMP and RMON already address collection of network management data at remote nodes. Collected network management data, including traffic statistics, are the periodically transmitted from the remote nodes to a central “network manager” host that formats and presents the data to a network administrator.
As shown in Figure 3, a hardware counter is used to count down all incoming packets and to open the processor register gate as dictated by the sampling strategy. During processing time in the CPU, the packet header is parsed and its source address is determined. Gigabit network
During t proc the following steps are
the packet.
performed: • Receive the packet into to the NMS • Parse the packet header and determined its source address • Locate (e.g., via a hashing algorithm) and increment the current source counter in memory • Compute and set the value of the packet counter
packet counter gate
Packet into CPU and gate closes
CPU
Gate opens
memory
tproc
tsusp
twait
Packet arrives and gate closes
Figure 3 - Network management subsystem (NMS)
time
The packet source is used to group the packets and it could be represented by the IP or MAC address of a machine where the traffic originated. Once the packet is processed and its source is known, it is added to the corresponding time “bucket” in the internal memory to be used in future traffic characterization by source as requested by the NMS software. Figure 4 shows the timing diagram for packet sampling. The fixed processing time of each packet is a constant t proc . The time until the next sample should be taken is t susp and the delay until the packet actually arrives at the gate is t wait . The total time T between two samples is:
T = t proc + t susp + t wait
(4)
and the CPU utilization for traffic measurements is given by:
U CPU =
t proc T
(5)
After each packet is processed, the packet counter in the NMS is reset to a value determined by the sampling strategy. Packets may be of a variable length, but for the purpose of this study it was assumed that they take a fixed time to parse (e.g., based only on the first 64 bytes which contain the routing information used to group samples together). The gate is closed during the packet processing, or t proc . This constant amount of time depends on the speed of the processor used as well as the number of instructions required to parse and process
Figure 4 - Deterministic packet sampling timing We estimate 50 to 200 lines of assembly code to perform the processing steps for a packet. In a Gigabit Ethernet, a 64-byte packet with 8 byte preamble and 12 byte interpacket gap is 672 nanoseconds in length, which equates to 1,488,095 packets per second maximum throughput. Thus, in a worst-case of 100% network throughput with all small packets, an NMS that samples and processes all packets would require approximate 75 to 300 million instructions per second (MIPS) processing power, or greater processing power than even high-end 1998 PC and workstation processors. Even at lower network throughputs and with larger packet sizes, the amount of processing power needed for sampling and processing all packets is nontrivial. In this study we assume a 50 MIPS processor and an optimistic 50 instructions to receive and process a packet resulting in t proc = 1 microsecond. Since the network management subsystem will perform tasks other than traffic measurement, the CPU was assumed to be available only half the time resulting in a target 50% CPU utilization for the sampling task and up to 25% of the traffic sampled. Allocating 50% of the CPU time for the task of static traffic measurement. Since wire utilization is likely to vary greatly over time, it seems logical that a better approach would be to let the NMS sampling algorithm fully utilize the CPU within a desired limit. This is the basis of the three new adaptive sampling methods described in the next section.
5. Development of Adaptive Sampling In [4] the developed sampling methods were use to characterize a traffic stream independent of packet origins. This greatly reduces the processing required per packet (e.g., the packet source address does not have to be parsed and counted). It is desirable to be able to characterize traffic by packet origin to be able to determine if one or many sources are contributing to a specific traffic characteristic, and which applications and hosts are identified with those characteristics. Packet origin could be characterized by MAC address or IP address. Address pairs could also be monitored. The proposed adaptive sampling methods extend the work in [4] by adding source characterization and varying sampling granularity to control processor utilization. In this study Poisson and self-similar traffic streams are combined. Then, using sampling methods the characteristics of each stream are estimated. Figure 5 shows fixed granularity systematic sampling from [4].
open gate
Packet arrives at the gate.
most traffic peaks are preceded by warning signs of increasingly higher congestion. This decrease in the inter-arrival time rate was used to replace the CPU utilization ratio with an Interarrival time ratio to “anticipate” the incoming “burst”. Figure 7 shows the “IT guard” (IT = packet interarrival time) method. The last method combines the CPU and IT guard methods and is not shown in order to save space.
open gate
start Y N counter = 0?
packet ?
N Y close gate process packet
counter = sampling granularity * ratio
get actual UCPU
ratio = actual UCPU / desired UCPU tproc
start
Figure 6 - Adaptive sampling with “CPU guard”
N packet ? Y close gate
process packet
Y
Decrement the counter for each packet arriving at the gate.
open gate
start Y N
packet ?
counter = 0?
counter = 0? N
counter = sampling granularity
Y
N
close gate
tproc
process packet
Figure 5 - Systematic sampling with processing delay. Figure 6 shows the “CPU guard” adaptive sampling method where the sampling granularity as controlled by the counter is a function of CPU utilization. If CPU utilization is low (due to a low rate of packet arrivals), the counter set value is reduced for the next sample with a limit of complete sampling (i.e., all packets are sampled). Alternatively, if the CPU utilization is above a preset desired utilization, the counter set value is increased. The actual CPU utilization is calculated by dividing the desired processing time by the average time between two samples since the beginning of the trace. The second and third adaptive methods are partially based on the expectation that the network traffic exhibits temporal and source locality. In [6] it is observed that
get packet IT
counter = sampling granularity * ratio
ratio = LAST(IT) / AVG(IT) tproc
Figure 7 - Adaptive sampling with “IT guard” In summary, the four methods of interest are: • Method #1 - Fixed granularity systematic sampling (Figure 5) • Method #2 - Adaptive sampling with “CPU guard” (Figure 6) • Method #3 - Adaptive sampling with “IT guard” (Figure 7) • Method #4 - Adaptive sampling with combined “CPU guard” and “IT guard” (not shown)
1000 Packet Counts (1 millisecond each) Name
Contribution
Description Mean
ds01
50%
ds02
50%
ds0102
100%
ds03
10%
ds04
90%
ds0304
100%
ds05
90%
ds06
10%
ds0506
100%
Exponential distribution of 97768 Its generated over 1 second interval with λ = 97500. Self-Similar distribution of 97279 Its generated over 1 second interval with α = 1.1 and β = 0.00000173. 195045 ITs merged from ds01 and ds02. Exponential distribution of 19572 Its generated over 1 second interval with λ = 19500. Self-Similar distribution of 175431 Its generated over 1 second interval with α = 1.1 and β = 0.00000101. 194990 ITs merged from ds03 and ds04. Exponential distribution of 176046 Its generated over 1 second interval with λ = 175500. Self-Similar distribution of 19220 Its generated over 1 second interval with α = 1.1 and β = 0.00000710. 195266 ITs merged from ds05 and ds06.
PMR
Hurst
97.768
99.676
Variance
1.30922
0.59306
97.277
4743.40
2.67278
0.74572
195.05
4861.54
1.87649
0.75542
19.571
19.813
1.68617
0.58275
175.419
10583.5
2.26885
0.71506
194.99
10626.8
2.1437
0.71444
176.046
183.814
1.22127
0.59678
19.22
508.284
4.68262
0.81721
195.266
665.837
1.38273
0.73654
Table 1 - Population measures for experimental traffic
6. Evaluation of Adaptive Sampling
Log(a ctual gra nularity)
Table 1 contains a summary of the traffic data used in this study. The three data sets, ds0102, ds0304 and ds0506 each consists of an exponential and self-similar components based on 50/50, 10/90, and 90/10 percent packet contributions. The data sets were generated using Poisson and inverse-Pareto distribution as described earlier in this paper. 5 4 3
m e thod m e thod m e thod m e thod
1 2 3 4
m e thod m e thod m e thod m e thod
1 2 3 4
2 1 0 0
1
2
3
4
Log(CPU utiliza tion)
Log(des ire d granula rity)
3 2 1 0 -1 -2 -3 0
1
2
3
4
Log(des ired granularity)
Figure 8 - Evaluation of CPU utilization
The four sampling method were implemented in ANSI C with the simulated traffic input from a file. First, the CPU utilization study was performed. The graph in Figure 8 shows the behavior of the adaptive methods with respect to sampling granularity and CPU utilization based on the aggregate data set ds0102. The static sampling method maintains the same sampling granularity and the CPU utilization decreases as the desired sampling granularity increases. In contrast, the other three methods attempt to sample as much as possible within the limit set on CPU utilization. In the second set of experiments the accuracy of the computed mean, variance, PMR, and Hurst parameter for the three data sets were conducted. The following figures show plots of the four statistics for the exponential and self-similar components of data sets ds0102 and ds0304 over increasing sampling granularity. The last two graphs summarize the percent errors. Figures 9, 10, 11, and 12 show the accuracy of the four sampling methods in estimating the mean, variance, PMR, and Hurst parameter. Figures 9 and 10 shows the estimates for the exponential and self similar components of dataset ds0102 (50% exponential and 50% Pareto), Figures 11 and 12 for dataset ds0304 (10% exponential and 90% Pareto). In all cases, the population statistic is indicated on the Y-axis with Log(0) sampling granularity (i.e., all packets are sampled). As the sampling granularity increases, the accuracy of each method deviates from the population statistic, however in all cases except for PMR, the adaptive methods (method #’s 2, 3, and 4) are more accurate than the static method (method #1). For example, for the Hurst parameter method #’s 2, 3, and 4 are all approximately equal in accuracy and all better than method #1.
m e thod 1
1.05E+ 02
m e thod 1
1.10E+ 02
m e thod 2
m e thod 2 1.05E+ 02
m e thod 3 m e thod 4
9.50E+ 01
mean
mean
1.00E+ 02
9.00E+ 01
9.00E+ 01
0
1
2
3
4
0
Log(sa m pling gra nula rity)
3.00E+ 03
2
3
4
7.00E+ 03
m e thod 1
m e thod 2
6.00E+ 03
m e thod 2
m e thod 3
5.00E+ 03
m e thod 3
4.00E+ 03
m e thod 4
m e thod 4
2.00E+ 03
va ria nce
va ria nce
4.00E+ 03
1
Log(sa m pling gra nula rity)
m e thod 1
5.00E+ 03
1.00E+ 03
3.00E+ 03 2.00E+ 03 1.00E+ 03
0.00E+ 00
0.00E+ 00
0
1
2
3
4
0
Log(sa m pling gra nula rity)
4.00E+ 00 3.00E+ 00
1
2
3
4
Log(sa m pling gra nula rity)
m e thod 1
6.00E+ 00
m e thod 2
5.00E+ 00
m e thod 3
4.00E+ 00
m e thod 4
2.00E+ 00
PM R
5.00E+ 00
PMR
m e thod 4
1.00E+ 02 9.50E+ 01
8.50E+ 01
m e thod 1 m e thod 2 m e thod 3 m e thod 4
3.00E+ 00 2.00E+ 00
1.00E+ 00
1.00E+ 00 0.00E+ 00
0.00E+ 00 0
1
2
3
0
4
1.0 0.8
3
4
1.2
m e thod 1
m e thod 2
1.0
m e thod 2
m e thod 3
0.8
m e thod 4
0.6
2
m e thod 1
Hurst
1.2
1
Log(sa m pling gra nula rity)
Log(sa m pling gra nula rity)
Hurst
m e thod 3
m e thod 3 m e thod 4
0.6
0.4
0.4
0.2
0.2 0.0
0.0 0
1
2
3
4
Log(sa m pling gra nula rity)
0
1
2
3
4
Log(sa m pling gra nula rity)
Figure 9 - Exponential component of ds0102
Figure 10 - Self-similar component of ds0102
From the graphs in Figures 9 through 12 we observe that adaptive sampling methods are better suited to estimating both Poisson and self-similar inter-arrival times under a high initial sampling granularity.
Resulting plots for methods using the CPU guard and IT guard are generally more consistent and more accurate than static sampling plots.
m e thod 1
3.00E+01
m e thod 2
2.50E+01
m e thod 3
2.00E+01
m e thod 4
1.50E+01
m e thod 1
1.80E+ 02
m e thod 2
1.75E+ 02
m e thod 3 mean
mean
3.50E+01
1.70E+ 02
m e thod 4
1.65E+ 02
1.00E+01 1.60E+ 02
5.00E+00 0.00E+00
1.55E+ 02
0
1
2
3
4
0
Log(sa m pling gra nula rity)
va ria nce
2.00E+03 1.50E+03
m e thod 1
1.20E+ 04
m e thod 2
m e thod 3
1.00E+ 04
m e thod 3
8.00E+ 03
m e thod 4
m e thod 4
6.00E+ 03 4.00E+ 03 2.00E+ 03 0.00E+ 00
0.00E+00 0
1
2
3
0
4
1.00E+01 8.00E+00 6.00E+00
2
3
4
m e thod 1
3.50E+ 00
m e thod 1
m e thod 2
3.00E+ 00
m e thod 2
m e thod 3
2.50E+ 00
m e thod 3
m e thod 4
2.00E+ 00
m e thod 4
4.00E+00
PMR
1.20E+01
1
Log(sa m pling gra nula rity)
Log(sa m pling gra nula rity)
PMR
4
1.40E+ 04
5.00E+02
1.50E+ 00 1.00E+ 00
2.00E+00
5.00E-01
0.00E+00
0.00E+ 00
0
1
2
3
0
4
Hurst
m e thod 4
0.6
0.2
0.2
0.0
0.0
3
4
Log(sa m pling gra nula rity)
Figure 11 - Exponential component of ds0304
m e thod 3 m e thod 4
0.6 0.4
2
m e thod 2
0.8
0.4
1
4
1.0
m e thod 3
0.8
3
1.2
m e thod 2
1.0
2
m e thod 1
m e thod 1
1.2
1
Log(sa m pling gra nula rity)
Log(sa m pling gra nula rity)
Hurst
3
m e thod 2
1.00E+03
0
2
m e thod 1
va ria nce
2.50E+03
1
Log(sa m pling gra nula rity)
0
1
2
3
4
Log(sa m pling gra nula rity)
Figure 12 - Self-similar component of ds0304
Additional graphs for data set ds0506 (90% exponential and 10% Pareto) are not shown in this paper, but show the same results as the previous graphs. Figures 13 and 14 quantify the percentage error in the estimates versus population statistics for the three datasets, ds0102, ds0304, and ds0506. The static method (method #1) results in the highest percent error in the Hurst parameter and also higher error in variance than the adaptive methods. This could be the result of “lost” congestion periods spread-out over a number of sampling intervals. Percentage error for the mean statistic are very low and about the same for all four methods. However, we notice that the adaptive method 3 which is based solely on the IT guard does not perform as well over the self-similar data set. The very high percentage error of the PMR statistic points out that it may not be a good indicator of traffic burstiness when sampling granularity is high. The Hurst parameter and the coefficient of variance (square root of variance divided by mean) can serve as good measures of traffic burstiness. method 1
0.35
method 4
method 3
References method 2
method 4
method 3
method 1
method 4
method 3
method 4
method 2
0.1
method 3
0.15
method 2
0.2
method 2
method 1
0.25
method 1
Average % Error
0.3
of interest include mean, variance, peak-to-mean ratio, and Hurst parameter of packet counts. These traffic characteristics are used for capacity planning of network resources. Determining these traffic measures based on population measurements (i.e., processing of all packets) on a high-speed network, such as Gigabit Ethernet, is computationally expensive. Sampling methods can reduce the computational burden, as first demonstrated in [4] using fixed granularity sampling. The accuracy of the sample measures can be improved by extending fixed granularity sampling to adaptive sampling where the CPU utilization of the network management subsystem is set to a target, or desired, level. The adaptive sampling methods developed in this paper were shown to 1) be able to maintain a network management processor at a desired CPU utilization, and 2) generate more accurate traffic measures (especially for the Hurst parameter) than a static sampling method. Future work will address implementing the adaptive methods in existing network management systems.
0.05
[1]
J. Beran, “Statistical Methods for Data with LongRange Dependence”, Statistical Science, Vol. 7, No. 4., pp. 404 - 416, 1992.
[2]
J. Beran, R. Sherman, and T. Murad, “Long-Range Dependence in Variable -Bit-Rate Video Traffic”, IEEE Transactions on Communications, Vol.43, pp. 1566 - 1579, 1995.
[3]
R. Braden and A. Deschon, “NNStat: Internet Statistics Collection Package, Introduction and User’s Guide,” Technical Report RR-88-206, ISI, USC, 1988.
[4]
K. Claffy, G. Polyzos, and H. Braum, “Application of Sampling Methodologies to Network Traffic Characterization”, Computer Communication Review, Vol. 23, No. 4, pp. 194 - 203, 1993.
[5]
A. Erramilli and J. Wang, “Monitoring Packet Traffic Levels”, Proceedings of IEEE GLOBECOM, Vol. 1, pp. 274 - 280, 1994.
[6]
H. Fowler and W. Leland, “Local Area Network Traffic Characteristics, with Implications for Broadband Network Congestion Management”, IEEE Journal on Selected Areas in Communications, Vol. 9, No. 7, pp. 1139 - 1149, September 1991.
0
Mean
Variance
1
PMR
Hurst
Figure 13 - Percentage error in exponential traffic. Variance and PMR data scaled down by 100 and 10. method 1
0.16
0.02
method 3
method 4
method 2
method 3
method 4
method 1
method 2
method 3
method 4
0.04
method 1
0.06
method 1
0.08
method 2
0.1
method 4
method 3
0.12
method 2
Average % Error
0.14
0
Mean
Variance
1
PMR
Hurst
Figure 14 - Percentage error in self-similar traffic. Variance and PMR data scaled down by 100 and 10.
7. Summary Estimating traffic characteristics is an important task of network management of LANs. Traffic characteristics
[7]
J. Gordon, “Pareto Process as a Model of SelfSimilar Packet Traffic,” Proceedings of IEEE GLOBECOM, pp. 2232 - 2236, 1996.
[8]
W. Leland, M. Taqqu, W. Willinger, and D. Wilson, “On the Self-Similar Nature of Ethernet Traffic (Extended Version)”, IEEE ACM Transactions on Networking, Vol.2, No.1, pp. 1 - 15, February 1994.
[9]
B. Mandelbrot, “Self-Similar Error Clusters in Communication Systems and the concept of Conditional Stationarity.” IEEE Transactions on Communication Technology, Vol. COM-13, pp. 71 - 90, 1965.
