Hierarchical Characterization and Flow Modeling ... - Semantic Scholar

Hierarchical Characterization and Flow Modeling of Computer Network Trac Using Real-time Measurements Madhu K. Acharya a Bharati Bhalla a R.E. Newman-Wolfe a Haniph A. Latchman b Randy Chow a Computer and Information Sciences Department b Department of Electrical Engineering University of Florida Gainesville, Florida - 32611-2024 Email - [email protected], (nemo,latchman,chow,bb1)@reef.cis.u .edu a

1

Abstract A key ingredient in network management and design is a characterization of the trac patterns and volumes that are either experienced by or expected on the network. Without this ingredient, network management regimes tend to be either non-existent or very heuristic in nature, and furthermore, systematic and eective network design and performance analysis are virtually impossible. This paper seeks to provide such a trac characterization for typical campus area networks. Our results are based on real-time measurements on various parts of the University of Florida data communication network (UFNET) which includes the UFNET backbone network and several subnetworks. For each network, trac was characterized hierarchically as Intra-LAN, Inter-LAN, and LAN to WAN. The measured trac was further characterized hierarchically at the application, transport, and medium access layers. A comparative study was made for the subnets under consideration based on trac volumes and packet size, protocol, and application distributions. The observed trac characteristics led to the development of the ow model proposed in this paper. The proposed ow model is based on the user applications observed on the network and the complex dynamics of the data ow from the application layer down to the physical Madhu K. Acharya and Bharati Bhalla are presently working for IBM Corporation, 472 Wheelers Farm Road, Mail stop 94, Milford, CT 06460 (acharya,[email protected]). 1

1

layer. Applications are de ned using transport conversations, a quintuple of source and destination internet addresses, transport port numbers, and the transport protocol. This modeling technique diers from the traditional approach of workload modeling, in that, it examines the trac originating at the application layer and the changing trac pattern at each layer below it as the messages reach the physical medium. This study is an attempt to understand and describe the complex dynamics of trac appearing on the physical layer. The model parameters presented here were calculated based on 24 hour packet header data collected on the Engineering Consulting Services Subnet (ECSNET). The parameters were used as inputs to a simulation experiment to evaluate the performance of a Metropolitan Area Network providing Switched Multimegabit Data Services (SMDS). The ow model will be instrumental in the study of network switching and control mechanisms such as adaptive routing, ow and congestion control, etc. It will also enable a realistic assessment of protocol usage and changes in network behavior as the load increases.

Keywords: Network management, Trac characterization, Real-time measurements, Traf c Modeling

1 Introduction Computer networks are becoming the backbone of today's computer systems. The availability of LAN technology that provides high-capacity, low-latency performance, coupled with the sharp decline in the cost of powerful computing devices, has triggered the evolution of distributed computer network architectures. This is typically seen in a university environment where collaborative research among various groups requires shared access to remote resources and protocols. The problem of designing and evaluating the performance of such a heterogeneous network is a challenging one. Measuring the trac behavior of a large integrated network in real-time is a complex task. For such a network, we need to select a subset which will be representative of the network at large. In order to make a good estimate of the actual trac volume owing in 2

the network, we need to conduct measurements under varying load conditions. In addition, in a University type environment networking facilities are administered at various levels campus, departmental, sub-departmental, research groups, etc. and each subnet provides support for dierent user services resulting in surprisingly dierent trac characteristics. It can be observed that there is a large variation in the trac volume and utilization, preferred services, and load variations on a daily, weekly, monthly basis for these subnets. The intent of our study was to characterize the actual behavior of a real-time computer network under varying load conditions. A hierarchical approach to trac characterization provides a deeper insight into system behavior and was adopted for our study. There are several advantages in employing this approach over the traditional techniques for trac characterization [4, 6, 7, 8, 12]. First, it facilitates the measurement of intra-LAN, interLAN, and WAN trac for each subnet, which are found to demonstrate distinctive patterns. These patterns are important when choosing input parameters or building trac generators for simulation studies on network and protocol performance. Second, trac can be characterized at dierent OSI layers showing relationships between dierent protocols, message path down the layered hierarchy, and other ner details which cannot be observed using a non-hierarchical approach. The importance of signal multiplexing in transmission and switching equipment has been long established. Conventional techniques assign a xed subset of either the channel bandwidth (Frequency Division Multiplexing) or the time frame (Time Division Multiplexing) to several subscribers. Trac characteristics in a computer communications network are signi cantly dierent from those observed on voice networks. The bursty nature of computer trac makes it inecient to use these classical techniques and has led to the development of packet communication networks. The switch capacity (processing and storage) as well as the transmission capacity between switches are statistically multiplexed by subscribers of packet networks. Under peak loads, a balance between high average utilization and the acceptable level of congestion is desired. Several transmission schemes have been proposed in the past 3

to facilitate the sharing of resources that are not capable of meeting the simultaneous peak demand of subscribers. The need to evaluate and compare these schemes has led to the development of modeling techniques. Modeling tools help in the design and evaluation of packet communication networks. They can be employed in simulation experiments for assessing and evaluating new congestion control, ow control, and routing algorithms in the changing environment. To this end, estimates of transit delay, packet loss probability, line and buer utilization, network throughput, etc., are required. In the past, several mathematical tools (analytical, simulation, or measurement) have been used to predict the behavior of packet switching networks. Analytical techniques such as Markovian models and Markov decision processes have been applied to study multiaccess networks and ow control procedures [9, 10]. The theory of network optimization has also been successfully used by some [5]. Simulation techniques are used when available analytical models are not able to deal with the real properties of the network such as state dependent transition probability and correlation between interarrival and service time requirements [11]. However, to make simulations tractable gross assumptions are often made that may give results which do not conform too well to the real situation. The success of analytical and simulation techniques lies in the careful and accurate choice of input parameters and representation of the network. Real-time measurements can be used to identify these parameters [1, 2, 3, 12] and was therefore used in our study. Realtime measurements help model real-life situations accurately and can be used to improve network models iteratively. Real-time measurements provide valuable insights into network usage and behavior and facilitate the performance evaluation of operational protocols and identi cation of critical parameters related to system ineciency and design aws. However, this technique can only be used on existing networks. We found that network trac characteristics depend on several factors including network hierarchy, topology, and con guration, services provided such as News and Name services, 4

TO INTERNET IP ROUTER throu

NERDC DELNI

UFNET

WASP

MATRIX

128.227.116

PINE

BIKINI

ALPHA

128.227.100

128.227.224

ECSNET

CISNET

EENET

Bridge

128.227.176

128.227.8

128.227.96

MATHNET

CIRCA Measurement Points

Figure 1: Topology of UFNET - (October 1991)

class and number of users, etc. [1]. It was observed that user applications are primarily responsible for the trac characteristics that appear on the physical medium. Based on these observations we have developed a ow model for computer network trac. In what follows, we describe in Section 2, the experimental environment in which our measurements were performed. Section 3 describes the measurement tools, and trace data collection and analysis methodology employed for our study. Detailed results of our measurement and analysis of the observed trac are presented in Section 4. Section 5 describes the proposed ow model based on transport conversations and the model parameters as derived from conducted measurements. In Section 6, concluding remarks and a discussion of ongoing work are given. A list of Acronyms is included in Appendix.

2 Experimental Environment The University of Florida Campus Area Network primarily consists of three major computing and networking facilities, namely UFNET, North East Regional Data Center (NERDC), and 5

128.227 UFNET BACKBONE

DYN

WASP G 128.227.116.1

Bigguy Y’N’ W

Frisbee PZ

Cobra P

128.227.116

Frenulum P

Viper DC

Hornet P

Gnarley P

Heifer pc

Aerial G’

Y - YP Server N - Name Server G - Gateway W - News Server

D - Disk Server C - Compute Server Z - Zephyr Server P - Personal Workstation ’ - Indicates Backup

Figure 2: Topology of ECSNET

Center for Instructional and Research Computing Activities (CIRCA). UFNET provides campus wide network connectivity to several local area networks as well as to Internet via NERDC. There are over 50 departmental networks in UFNET alone, each of which consists of many LANs. Measuring trac behavior in such a large integrated network in real-time is a complex task. We therefore selected a subset of these networks for our trac characterization and ow model development study. We believe that the selected networks are representative of the type of LANs found in a typical University environment. Trac measurements were performed on UFNET through wasp.eng.u .edu, a SUN Sparcstation II, which acts as a gateway to the College of Engineering networks. In addition, three hierarchically lower subnets, namely CISNET, ECSNET, and EENET were selected for our study. Figure 1 illustrates the topologies of UFNET, CISNET, ECSNET, and EENET as they existed in October, 1991 and also shows the points of data collection. CISNET, a subnet in the Computer and Information Sciences Department, consists of 30 diskless workstations connected on a standard 10 Mb/sec Ethernet and is connected to the CISNET backbone via lightning.cis.u .edu. ECSNET is located in the College of Engineering 6

and consists of 12 workstations connected on a standard Ethernet. They have cross mounted local disks in addition to a central leserver. We believe that this con guration is a clear trend for future local area networks. EENET, a cluster of local pools with cross mountings of le systems, provides connectivity to various research groups in the Department of Electrical Engineering. The parameters for the ow model were calculated based on 24 hour packet header data collected on ECSNET. ECSNET consists of several workstations connected on a 10 Mbps standard Ethernet. We believe its con guration will be common in future local area networks and was therefore selected for this study. Figure 2 shows the topology and con guration of ECSNET. The network connects to the UFNET backbone through wasp.eng.u .edu which also acts as a leserver and an anonymous ftp site. The network provides news and domain name service to the University of Florida data communication network. Most of the workstations on this network have a local disk mounted on them. In addition, several lesystems mounted on the network for common applications. The users on the network are mostly consultants and researchers from other departments.

3 Measurement Details and Analysis Methodology

3.1 Measurement Tools

A wide variety of tools were evaluated for the purpose of our measurements. After careful consideration Nfswatch and Ether nd were chosen to perform measurements. Nfswatch was used to provide summary results. It monitors the incoming trac to a NFS le server and divides it into several categories based on protocol type, network le system utilization, number of packets over speci ed intervals, etc. [13]. Detailed packet header data was collected using Ether nd. Ether nd examines each packet and provides the packet arrival time and length, transport protocol used, source and destination addresses, and source and destination transport port numbers [13]. Our measurements were constrained by the fact that these tools do not measure outgoing 7

packets from the machine on which the measurements are being performed. This is an inherent limitation of the Network Interface Tap which both the tools use at the lower layer. Extreme care was taken to minimize packet losses by using machines dedicated to the task of conducting measurements and also, by performing measurements at dierent interfaces on the network.

3.2 Trace Data Collection and Analysis As mentioned earlier in Section 1, there is considerable load variation on each network on a daily, weekly, and monthly basis. We therefore, collected trace data on UFNET for 10 days spread over all the three academic semesters (Spring, Summer, and Fall of 1991) and for two days each on CISNET, ECSNET, and EENET during the Spring semester of 1992. In all, over 5000 MB of trace data was collected and analyzed. The hierarchical OSI model was the prime basis for trac characterization. The well known Internet port numbers were used to separate packets by application. At the transport layer, packets were categorized based on the transport protocol. Packet size was used to characterize the trac at the medium access layer. The variation of trac load over time of day was calculated for every 10 and 30 mins intervals using packet arrival time. These intervals are sucient to re ect variations in trac behavior.

4 Trac Characterization In this section, we present detailed results of our measurement and analysis. Although large volumes of trace data was analyzed, we present the results for three selected days on UFNET, one during each semester and one day for the subnets as shown in Table 1.

4.1 UFNET In this section, we present the results of our measurements performed on the campus-wide UFNET. 8

Net UF UF UF CIS ECS EE

Start

Day

Date

Sat Tues Wed Fri Thur Thur

02/23/91 06/19/91 10/23/91 01/03/92 03/05/92 02/13/92

Time in hrs 1245 0000 0000 1900 1200 1300

End

Day

Date

Sun Wed Thur Sat Fri Fri

02/24/91 06/19/91 10/24/91 01/04/92 03/06/92 02/14/92

Time in hrs 1243 2359 2359 1800 1159 1259

#Mb Note 763 714 720 119 168 270

Spring Weekend Summer day Fall day Spring Weekend Spring Day Spring Day

Table 1: Measurement Time Details

Utilization on UFNET for 24 hr period - Using Nfswatch 1.2

Percentage Utilization

1

Date : Wednesday, October 23, 1991 Max = 1.1986 Min = 0.2732 Mean = 0.6944 Std Dev = 0.2610 Median = 0.7073

0.8

0.6

0.4

0.2

0 ************************************************************************************************************************************************ 0 5 10 15 20 Time of day in 10 min interval

Figure 3: Load Distribution on UFNET

9

UFNET - Load Distribution Figure 3 shows the network utilization over a 24 hr period for the data collected on Wednesday, October 23, 1991. The utilization measured over 10 minute intervals rarely exceeds 1.19% which is very low. Utilization of over 13% was observed when the interval was reduced to one second showing that the trac was quite bursty. The daily load pattern was observed to be nearly the same for all days during a semester except for minor variations during weekends. The midnight trac (0 Hrs) is medium and reduces to low during early hours of the morning. The trac starts rising at about 8.00 AM and quickly reaches a high level by 10.00 AM. It remains high to very high for the next two hours. After the lunch time dip at 12.00 noon it rises again, reaching a peak at about 3.30 PM. The trac reduces to medium in the evening and starts rising again at 8.30 PM reaching another peak at about 10 PM, after which it remains medium until midnight.

UFNET - Characterization at Application Layer Table 2 summarizes trac characterization by application for three days. It is observed that amongst Internet applications, Telnet, NNTP, NTP, and IRC account for most of the trac. Other commonly used applications include Login, FTP, X-11, NFS, and SMTP. A striking observation is the relative distribution of trac between interactive and bulk transfer applications. We observed that the overall proportion of interactive and bulk transfer applications is 1:1 for Spring and Fall days. The Summer day shows an interactive to bulk transfer ratio of about 2:3. On an average, Internet applications show a ratio of 5:4 whereas the DECNET applications show a ratio of 2:3 for interactive and bulk transfer applications. As expected the average packet size for interactive applications (e.g., Telnet and Login) is relatively small as compared to that of bulk transfer applications (e.g., NFS and FTP). It can be seen that DECNET trac varied considerably over the semesters. It reduced from 29.27% in Spring to 18.46% in the Fall of 1991. Another interesting observation is that the DECNET trac that was 35% interactive and 66% bulk transfer in the Spring of 1991, changed to 43% interactive and 57% bulk transfer in the Fall of 1991, which implies a 10

considerable increase in usage of interactive applications, particularly DEC LAT.

UFNET - Characterization at Transport Layer Table 3 shows characterization of trac by protocol. TCP is observed to be the most commonly used protocol constituting an average of 55% of the overall trac. DECNET and UDP protocols contribute about 10-20% of usage each.

UFNET - Characterization at the Medium Access Layer Figure 4 shows the gross percentage packet size distribution for the data collected on Wednesday, October 23 1991. We observe a bimodal distribution of packet size. The rst mode represents interactive applications with a small packet size. The second mode at 600 bytes is due to FTP and NNTP which represent bulk transfer applications.

UFNET - Wide Area Trac It is not sucient to characterize Internet trac using the conventional method of employing interarrival times. This arises from the fact that the interarrival time distribution for Internet trac itself becomes a function of existing ow and congestion control mechanisms. Any simulation studies must therefore, include the distribution of number of bytes transmitted and bidirectionality of bulk trac sources [4]. Keeping this in mind, we separated the WAN trac with Internet on UFNET and characterized it by application. About 34% of the trac observed on the UFNET segment was destined to or came from the Internet. Table 4 shows a comparison of Internet trac on Wednesday, February 23, 1991 and Wednesday, October 23, 1991. Most of the wide area trac is due to the NNTP, IRC, FTP, Telnet, and SMTP on both the days. This is in line with trac measured on the NSFNET backbone [4]. A notable observation is the signi cant dierence in the interactive to bulk transfer ratio calculated on the basis of number of packets, and number of bytes. They were found to be 1:1 and 3:7 on Wednesday, February 23, 1991 and 2:3 and 1:4 on Wednesday, October 23, 1991 respectively. 11

Application Type Internet

Telnet Login NNTP SMTP NTP SNMP FTP FTP-data Who Echo-reply Dst Unreach Domain Route IRC X Talk Sunrpc Finger Timed Timestamp UUCP Shell Syslog NFS Printer Others

02/23/91 % pkts Size

06/19/91 % pkts Size

10/23/91 % pkts Size

26.48 3.49 18.57 0.77 6.62 1.60 0.41 7.61 0.11 0.32 0.57 1.03 1.50 17.89 3.49 0.01 0.17 0.02 0.02 0.01 0.03 0.07 0.02 6.66 * 4.45

72 75 248 211 102 163 74 346 147 101 70 109 307 112 89 102 85 100 118 62 172 492 112 278 * 166

25.21 1.95 16.50 2.98 8.15 0.94 0.29 1.76 0.60 2.70 0.55 1.64 1.24 9.56 * 0.03 0.07 0.04 0.02 0.01 0.14 0.09 0.02 * * 24.88

82 81 267 147 92 207 72 382 150 98 70 102 331 103 * 103 85 92 118 62 231 422 131 * * 149

22.04 3.66 23.35 3.83 13.29 1.05 0.42 4.85 0.02 1.40 0.44 2.17 1.01 10.43 2.68 0.03 0.03 0.06 0.03 0.14 0.05 -.12 4.44 0.01 8.70

84 78 249 134 121 136 73 408 172 99 70 114 399 96 153 93 78 106 118 202 537 110 215 283 115

26.51 32.31 39.88 1.30

130 76 91 91

24.95 34.64 39.03 1.36

113 75 90 103

32.11 41.93 24.42 1.54

99 73 90 83

Total/Avg % of Total Decnet

5796726 160 7646987 146 7621722 161 69.31 77.61 78.11 -

Total/Avg % of Total

2447565 29.27

Routing LAT LAVC Rem. Con.

96 2111829 21.43

91 1800997 18.46

* - Included in others

Table 2: UFNET - Characterization at Application Layer

12

86 -

Protocol

AppleTalk ARP DECNET ICMP Novell RARP TCP Broadcast UDP

02/23/91 % pkts Size 1.42 29.27 1.98 * 56.15 0.10 11.10

70 96 88 * 151 93 222

06/19/91 % pkts Size 1.61 0.56 21.43 5.36 0.21 0.02 47.87 22.91

79 60 91 95 193 60 151 152

10/23/91 % pkts Size 3.04 1.04 18.46 2.74 0.39 0.01 61.73 0.85 11.73

75 59 86 96 260 60 159 68 203

Total/Avg 8363358 140 9852732 134 9757451 145 * - Not Measured

Table 3: UFNET - Characterization at Transport Layer

Packet Size Distribution On UFNET for 24 Hr Period 50 Date - Wednesday, October 23, 1991 45 Mean Packet Size = 145 bytes 40

Percentage of Packets

35 30 25 20 15 10 5 0 0

200

400

600

800

1000

1200

1400

1600

Packet Size in 60 byte interval

Figure 4: UFNET - Characterization at MAC layer by Packet Size Distribution

13

Internet Application Telnet Login NNTP SMTP NTP FTP FTP DATA Echo Echo Reply Dst unreac Domain IRC X-11 Talk Sunrpc Finger UUCP Shell Syslog P 4000 P 9000 Others

Total/Avg % of Total

02/23/91 # pkts % pkts Size 331579 18958 845800 36427 4110 20777 422053 61594 274 3321 13999 951894 281 1302 1864 972 163 97449

11.79 0.67 30.07 1.30 0.15 0.74 15.00 2.19 0.01 0.12 0.50 33.84 0.01 0.05 0.07 0.03 0.01 3.46

84 83 236 209 90 74 350 97 98 70 99 113 102 100 171 334 100 84

10/23/91 # pkts % pkts Size

187792 55701 1328350 255774 8222 22218 296288 9793 7071 2938 74386 700896 38661 2267 152 4113 10787 886 146 169528 114968 81927

5.57 1.65 39.38 7.58 0.24 0.66 8.78 0.29 0.21 0.09 2.21 20.78 1.15 0.07 0.01 0.12 0.32 0.03 0.01 5.0 3.41 2.43

89 74 235 133 90 73 382 94 96 70 120 94 110 92 84 106 202 306 116 86 87 128

2812819 100.00 182 3372855 100.00 178 - 33.63 - 34.57 -

Table 4: UFNET - Characterization of Internet Trac at Application Layer

4.2 Subnets In this section we describe the trac characteristics of the three subnets. General characteristics of each subnet are described followed by a comparative study based on the application, transport and medium access layers.

CISNET Our measurement on sanddollar.cis.u .edu, a SUN workstation showed 2,235,743 packets over a period of 23 hrs with an average packet size of 377 bytes. The average utilization as a percentage of total ethernet bandwidth over the day was 0.78% and the utilization during the busiest half hour was 3.28%. Trac has been characterized as Intra-LAN (within subnet), Inter-Subnet (with CISNET backbone), Inter-LAN (with other LAN's on UFNET) and LAN-to-WAN (with Internet) based on the Internet addresses in the packet header. 14

Table 5 shows that 17% of the trac stays within the subnet and 72.85% of the trac goes to the CISNET backbone 128.227.224.*. This is due to the fact that all the machines on this network are diskless and the lesystems are mounted on CISNET backbone. The average packet size for Intra-LAN trac is very high (524 bytes) because of the NFS trac with lightning.cis.u .edu, the only leserver on this network which also acts as the gateway. 9.67% of the trac is destined to or coming from other subnets within the u .edu domain. The trac volume is very low due to the fact that it was a weekend and physical access to the machines was not available throughout the day. The TCP trac is quite high (54.39%) due to the typical hierarchy of CISNET under CISNET backbone. 81.23% of this trac is due to Telnet, Login and X-11 applications which are run on machines on the CISNET backbone. Locality was observed on this subnet. Seven machines out of a total of 30, contribute to 51.53% of the total number of packets and 63.96% of the total bytes on the network. 80.46% of the packets and 82.50% of bytes were destined to or coming from just one machine (lightning.cis.u .edu).

ECSNET On ECSNET, 3,202,376 packets were observed during a period of 24 hours with an average packet size of 175 bytes. We attribute the smaller average packet size as compared to that of CISNET to the fact that most of the machines on the former subnet have local disks mounted on them thereby minimizing leserver access. The average utilization as a percentage of total ethernet bandwidth over the day was 0.51% and the utilization during the busiest half hour was 3.43%. We categorize trac as Intra-LAN, Inter-LAN and LAN-to-WAN. Table 6 summarizes the results of measurements performed on ECSNET. This subnet provides Name Service and News Service to u .edu domain users which justi es the fact that 57.07% of the trac is Inter-LAN. The high Name Service trac is re ected in the very high (64.37%) Inter-LAN UDP trac as it uses UDP as its transport layer protocol. Similarly we observe a very high 15

Packet type ARP Intra-LAN Total ICMP

Intra-LAN Inter-Subnet Inter-LAN LAN-to-WAN

Total TCP

Intra-LAN Inter-Subnet Inter-LAN LAN-to-WAN

Total Broadcast Intra-LAN Total UDP

Intra-LAN Inter-Subnet Inter-LAN LAN-to-WAN

# pkts 38463

# bytes % pkts % bytes Size

38463

2307780

2307780

100.00

100.00

0.28

60

12140 232 1699 8

14079

756216 22512 118930 560

898218

86.22 1.64 12.06 0.06

84.19 2.51 13.24 0.06

0.11

62 97 70 70

64

15422 987859 202482 10354

1789230 212607776 21877872 856992

1.26 81.23 16.65 0.85

54.39

0.75 89.66 9.23 0.36

116 215 108 83

28.15 195

1216117 237131870 3677

1.72

0.63

60

3677

423553

423553

100.00

100.00

115

310425 640855 12116 6

192531259 404995764 4206942 504

33.26 66.52 1.26 0.01

32.00 67.30 0.70 0.01

620 632 347 84

23.48 73.31 3.11 0.10

524 379 121 83

0.16

Total 963402 601734469 43.09 Sub-Total Intra-LAN 380127 197808038 17.00 Inter-Subnet 1628946 617626052 72.85 Inter-LAN 216297 26203744 9.67 LAN-to-WAN 10373 858541 0.46 Total/Avg 2235743 842496375 100.00

0.05 115

71.42 625

100.00 377

Table 5: Hierarchical trac characterization of CISNET

16

Packet type ARP Intra-LAN Total DECNET LAN-to-WAN Total ICMP Intra-LAN Inter-LAN LAN-to-WAN

Total TCP

Intra-LAN Inter-LAN LAN-to-WAN

Total UDP

Intra-LAN Inter-LAN LAN-to-WAN

# pkts 2398

2398

324

# bytes % pkts % bytes Size 143880

100.00

100.00

143880

0.07

0.03

60

60

324

33846

33846

100.00

100.00

0.01

104

2631 35192 198

38021

184590 2513304 14028

2711922

6.92 92.56 0.52

6.81 92.68 0.52

0.48

70 71 71

71

444650 436770 174467

42960841 116879942 32128739

42.11 41.36 16.52

22.38 60.88 16.74

97 268 184

736636 1355590 13520

172891168 190629069 1279621

1055887 191969522

0.01

1.19

32.97

34.30

182

34.98 64.37 0.64

47.39 52.26 0.04

235 141 95

Total 2105746 364799858 65.76 Sub-Total Intra-LAN 1186315 216180479 37.04 Inter-LAN 1827552 310022315 57.07 LAN-to-WAN 188509 33456234 5.89 Total/Avg 3202376 559659028 100.00

65.18

173

38.63 55.39 5.98

182 170 177

100.00

Table 6: Hierarchical trac characterization of ECSNET

17

104

175

(41.36%) TCP Inter-LAN trac due to Network News. Locality was also observed on ECSNET. Three machines out of a total of 15 contributed to 81.58% of the total number of packets and 77.71% of the total bytes. Adding one more machine resulted in increased locality of 86.03%.

EENET On EENET, 3,725,752 packets were observed during a period of 24 hours with an average packet size of 261 bytes. The average utilization over the whole day was 0.9% and the utilization during the busiest half hour was 1.89%. Once again we categorize trac as Intra-LAN, Inter-LAN and LAN-to-WAN. Table 7 summarizes the results of measurements performed on EENET. In contrast to other two subnets most of the trac here is Intra-LAN (85.23%) as would be expected in a general LAN. DEC machines mounted on this subnet contribute to nearly half of the trac. 94.03% of the UDP trac is Intra-LAN due to the le system trac while 80% of the TCP trac is Inter-LAN. AppleTalk and Novell protocols contribute 6.46% and 1.49% of the packets respectively.

4.3 Comparative Study of Three Subnets In the previous section we described general trac characteristics of the three subnets. A comparative study of the trac in the three subnets is now presented.

Comparison at Application Layer Table 8 shows the application distribution for the three subnets. Internet trac contributes 100.00%, 99.98%, and 42.29% of the trac on CISNET, ECSNET, and EENET respectively. DECNET trac contributes 49.86% of the overall trac in EENET, with the other two subnets showing no such or a negligible amount of DECNET trac. We observe that each network has a distinct application distribution. For example, the CISNET has Login, X-11, Shell, and NFS, ECSNET has NNTP, NTP, Domain Name Service, X-11, and NFS, and EENET has NTP, X-11, NFS, LAVC, and DEC Routing as their major applications. 18

Packet type AppleTalk Intra-LAN Total ARP

# pkts

Total Broadcast Intra-LAN Total DECNET Intra-LAN Total ICMP

2134

Intra-LAN Inter-LAN LAN-to-WAN

Intra-LAN Inter-LAN LAN-to-WAN

Total Novell Intra-LAN Total RARP LAN-to-WAN Total TCP Intra-LAN Inter-LAN LAN-to-WAN

Total UDP

Intra-LAN Inter-LAN LAN-to-WAN

237230

# bytes % pkts % bytes Size

237230

14775766

14775766

100.00

100.00

1.53

62

1464 6 664

87408 360 39840

68.60 0.28 31.12

68.50 0.28 31.22

60 60 60

224551

127608

6.36

0.06

0.01

62

60

224551

16256341

16256341

100.00

100.00

1858213

173675107

100.00

100.00

18.04

93

1632 9821 31

114240 747238 2170

14.21 85.52 0.27

13.23 86.52 0.25

70 76 70

24875360

100.00

100.00 453 100.00

1858213 173675107

11484

54861

54861

6768

863648 24875360

6.02

49.87

0.31 1.47

1.69

0.09

72

72

93

75

2.58 453

6768

406080

406080

100.00

77117 414943 20897

15917985 38611573 2396516

15.03 80.89 4.07

27.96 206 67.83 93 4.21 115 98.47 929 1.53 215 0.01 105

0.18

512957

56926074

13.77

768770 48780 4

674702122 10474095 420

94.03 5.97 0.01

Total 817554 685176637 21.94 Sub-Total Intra-LAN 3223838 920404329 85.23 Inter-LAN 473550 49833266 12.71 LAN-to-WAN 28364 2845026 0.58 Total/Avg 3725752 973082621 100.00

0.04

5.84 111

71.16 871

94.57 285 5.19 105 0.25 89

100.00 261

Table 7: Hierarchical trac characterization of EENET

19

60

60

Application Type Internet

CISNET % pkts Size

Telnet Login NNTP SMTP NTP FTP FTP-data Who Echo-reply Dst Unreach Domain Route X-11 Talk Sunrpc Finger Timed Timestamp Shell Syslog NFS Others

Total/Avg % of Total Decnet

Routing LAT LAVC Rem. Con.

Total/Avg % of Total

ECSNET % pkts Size

EENET % pkts Size

3.33 5.80 0.61 0.13 3.12 0.01 0.01 0.20 0.01 0.10 0.37 0.41 39.23 0.01 0.66 0.01 0.41 0.26 4.43 35.33 5.55

73 82 487 153 72 82 131 120 98 70 105 447 172 92 68 91 118 62 611 731 133

2.57 0.71 14.80 0.65 10.82 0.10 0.75 0.04 1.14 40.20 0.27 12.62 0.06 0.01 0.17 0.38 12.16 2.46

92 84 267 186 90 73 323 105 70 127 541 95 76 122 118 117 401 141

2.21 0.58 2.39 0.30 33.00 0.12 0.20 0.06 0.09 0.55 0.95 1.27 23.19 0.01 0.05 0.01 0.01 0.01 45.16 7.94

88 72 347 161 107 70 317 139 91 70 112 297 82 102 100 192 119 119 934 168

-

-

0.01 -

104 -

37.31 11.20 49.48 2.00

93 100 93 82

2235743 377 3202052 175 1575448 482 100.00 99.98 42.29 -

0.01 0.01 0.01 -

324 104 1858213 0.01 49.86

Table 8: Comparison at Application Layer

20

93 -

Protocol AppleTalk ARP DECNET ICMP Novell RARP TCP Broadcast UDP

CISNET % pkts Size 1.72 0.63 54.39 0.16 43.10

60 64 195 115 625

ECSNET % pkts Size 0.07 0.01 1.19 32.97 65.76

60 104 71 182 173

EENET % pkts Size 6.36 0.06 49.86 0.31 1.47 0.18 13.76 6.02 21.94

62 60 93 75 453 60 111 73 838

Total/Avg 2235743 377 3202376 175 3725752 261 Table 9: Comparison at Transport Layer

X-11 constitutes a large portion of trac on CISNET as most of the machines on the network are SUN and HP workstations running X-Windows. As before we see a large percentage of NNTP and Name Service trac on ECSNET as compared to the other two subnets, as some machines on this network provide these services to u .edu domain users. NTP trac is signi cant on EENET, possibly due to a poor implementation of Network time synchronization protocol.

Comparison at Transport Layer Table 9 compares the three subnets at the transport layer by protocols. The predominantly used protocols on CISNET, ECSNET and EENET are TCP, UDP, and DECNET respectively. The typical topology of CISNET gives rise to large TCP trac as most users connect to the CISNET backbone using reliable connection-oriented protocol.

Comparison at Medium Access Layer Figure 5 shows the packet size distribution for the three subnets. CISNET and EENET exhibit a quadramodal distribution whereas ECSNET shows a trimodal distribution. The rst mode is due to interactive applications like Login, Telnet etc, the second mode at about 600 bytes is caused by Network News trac, the third mode at about 1000 bytes is due to Shell and NFS trac, and the fourth mode is contributed by the largest packets due to NFS 21

trac.

5 Flow Model Network trac characteristics depend on several factors: its hierarchy, topology, and con guration, services provided (News, Name, etc.), and the class and number of users, as can be seen from the previous section. It was also observed that the applications originating at the top layer are primarily responsible for the arrival of messages and each layer below it was responsible for changing its behavior and pattern till the packets reach the physical layer. These observations have led to the development of the ow model described below. Although the model parameters were derived for a TCP/IP network, we believe that the model holds good for other types of networks such as DECNET, Novell, SNA, etc.

5.1 Model Development One of the major goals of computer network system design is ecient resource management. Packet handling strategies can be better implemented if the arrival of packets could be accurately predicted in advance. A commonly made assumption is to treat packet arrivals as independent events, and to assume that the packet inter-arrival time is exponentially distributed. Jain [8] has shown that this assumption is often invalid and instead proposed a Packet Train model. A packet train consists of packets owing between a pair of hosts with the inter-car time between them being smaller than a speci ed maximum called the Maximum Allowable Inter-car Gap (MAIG). If no packets are seen on the track for MAIG time units, the train is assumed to have ended and the next packet is regarded as the locomotive of the next train. It was also shown that this model increases predictability due to locality, which improves resource management. The Packet Train model as well as the Tandem Trailer model proposed in his study use information available at the network and transport layers respectively. Guesella's [6] study analyzes the trac on a Ethernet LAN with many diskless worksta22

Packet Size Distrubution On CISNET For 24 Hr Period 35 From 7.00 PM (Fri) on 01/03/92

30

To 6.00 PM (Sat) on 01/04/92

Percentage of packets

25

20

15

10

5

0 0

200

400

600

800

1000

1200

1400

1600

Packet Size in 60 byte interval Packet Size Distrubution On ECSNET For 24 Hr Period 60

From 12.00 PM (Thur) on 03/05/92

50

Percentage of packets

To 11.59 AM (Fri) on 03/06/92 40

30

20

10

0 0

200

400

600

800

1000

1200

1400

1600

Packet Size in 60 byte interval Packet Size Distrubution On EENET For 24 Hr Period 45 From 1.00 PM (Thur) on 02/13/92 To 12.59 PM (Fri) on 02/14/92

40

Percentage of packets

35 30 25 20 15 10 5 0 0

200

400

600

800

1000

1200

1400

Packet Size in 60 byte interval

Figure 5: Comparison at MAC layer by Packet Size Distribution 23

1600

tions. The study provides insight into the packet arrival time and length distributions, and oers solutions to improve the performance of virtual memory diskless workstations. Heimlich [7] veri ed the existence of packet trains on the NFSNET national backbone network and compared the packet train parameters for a few applications and transport protocols. However, we argue that these models which are based on the information available at transport, network, or physical layers are not adequate to model actual computer network trac. We believe that the type of trac observed is primarily dependent on user applications, and trac characteristics appearing on the physical layer are determined by the complex dynamic changes taking place as the application messages come down the OSI layers. For example, once the application message is received by the transport layer it will send it using either a connection oriented or a connectionless protocol. The network protocol will decide where to send the data, which will be done using a connection oriented or connectionless protocol. The medium access layer puts the message in frames which decide the actual length of the packet. The packet arrival time is also dependent on the medium access method. Hence, to actually model the trac we need to look at trac at every layers. Caceres et. al. [4] used a similar model to describe the characteristics of wide area network TCP/IP conversations. Based on our observations of trac characteristics on various physically hierarchical networks and subnetworks, we feel that trac is also dependent on the queueing delay at the network boundaries, presence of application gateways, routers, and bridges, and also, presence of network management trac. Our model is based on transport conversations which are de ned as a quintuple of source and destination interent addresses, transport ports, and the transport protocol. Figure 6 illustrates the proposed model which describes the trac appearing on the physical medium. The transport conversations which represent a particular application arrive on the physical medium with a inter-conversation time distribution. The conversation arrival is indicated by the arrival of the rst packet in the TC. New TCs start after inter-conversation time intervals (C). Three conversations arrivals are shown in the Figure 6. Packets within a particular TC 24

Packet Size in bytes

P

P C

Time in msecs

C L

P C L

Conversation 1 Conversation 2 Conversation 3

Inter packet time Inter Conversation time Conversation Length

Figure 6: Transport Conversation (TC) model

arrive after inter-packet time intervals (P). The conversation length or the number of bytes of a TC is used to delimit the conversation as indicated by the parameter L. The nal trac appearing on the network is the aggregate of all the active transport conversations at any given time. If the conversation arrival process and inter-packet arrival process are assumed to be Poisson, then the overall process can be called a Poisson aggregate. A transport conversation consists of bidirectional packets between source ports and destination ports on the source and destination machines and are separated by a maximum allowable inter-packet gap (MIPG). We consider a transport conversation to be broken if it is inactive for a period more than 15 minutes (the maximum idle time allowable for a ftp connection). This is done to ensure that idle conversations, such as open telnet sessions, are broken and a new conversation is created when the user comes back and does an operation using the open session. The inter-packet time in a transport conversation is parameterized for dierent applications by a distribution. We have divided all packets in a Transport Conversation into two types - packets going from initiator to respondent and packets going in 25

Sr. No. 1 2 3 4 5 6 7 8

Model Parameter Transport Conversation Inter-arrival Time Distribution Trac Matrix Transport Conversation Distribution by Application Conversation Duration (Interactive applications) Number of Bytes/TC Distribution (Bulk Transfer applications) Number of Transfers/TC Distribution and Number of Bytes/TC Distribution (Bulk Transfer Applications with Multiple Transfers) Inter-Packet Time Distribution per Direction per Application Packet Size Distribution per Direction per Application

Table 10: Model Parameters

the reverse direction. The size of the packet is determined using the packet size distributions in both directions for each application. The model divides applications into two types - interactive and bulk transfer. An interactive transport conversation is characterized by a conversation length which is also a measured distribution. Bulk transfer applications are classi ed into two types - single transfer per conversation and multiple transfers per conversation. The single transfer per conversation type of application is characterized using a distribution of number of bytes transferred in the conversation whereas for multiple transfers per conversation, we use a combination of the distribution of the number of transfers per conversation and the number of bytes transferred per conversation. The parameters of the model have been calculated after analyzing the measured data on ECSNET for a 24 hr period, and are listed as follows:

5.2 Summary Results 3,202,376 packets with an average size of 175 bytes were observed over a period of 24 hours. Figure 7 shows the capacity utilization over 30 minute intervals for the 24 hour period. Each vertical bar represents the percentage capacity utilization of the available bandwidth of 10MB/sec. The average utilization over the whole day was only 0.51% and the utilization during the busiest half hour was 3.43%. Table 11 shows the trac characterization at the application layer based on the well known 26

Network Utilization on ECSNET for 24 Hour Period 3.5

Start : 12:00 Noon 03/05/92 Thursday End : 11:59 AM 03/06/92 Friday

Percentage Network Utilization

3

Max : 3.4308 % Min : 0.0778 %

2.5 Mean : 0.5183 % St Dv : 0.7479 2

1.5

1

0.5

0

0

5

10

15

20

25

Normalized Time of Day in 30 Minute Interval

Figure 7: Capacity Utilization on ECSNET over a 24 Hour period

internet ports. We observed that Network News, Mail, Name service, Network le system, Network Time Protocol and X-11, were the major applications used. As expected, the interactive applications had a lower packet size as compared to le transfer applications. The table also shows the distribution of Transport Conversations by application. The characterization at the transport layer is shown in Table 12. UDP is the dominant protocol followed by TCP. Figure 8 shows the characterization at the medium access layer. We observed three distinct modes. The rst at about 120 bytes is due to interactive applications whereas the second at 600 bytes is due to News and Route trac packets. The last mode at 1500 bytes is due to the Network le system application messages which are fragmented at the medium access layer due to the MTU (Maximum Transferable Unit) of the Ethernet protocol.

5.3 Parameter Generation In this section we discuss the parameters which were obtained after analyzing the measured data. Parameters for interactive and bulk transfer applications were developed and are discussed below. 27

Application Interactive

# pkts % pkts

# bytes % bytes # TC's % TC's Size

Telnet Login X-11 NTP Domain Echo/reply Sunrpc Finger Dst unreach Syslog

82228 22710 404232 349551 1287440 706 1936 206 36489 12341

2.57 0.71 12.62 10.92 40.21 0.02 0.06 0.01 1.14 0.38

7565771 1920100 38569288 31398738 163743462 74604 147228 25060 2554230 1443389

1.35 0.34 6.89 5.61 29.26 0.01 0.03 0.01 0.46 0.26

75 35 107 250 2993 19 496 18 713 196

0.58 0.27 0.82 1.93 23.05 0.15 3.82 0.14 5.49 1.51

92 85 95 90 127 106 76 122 70 117

SMTP FTP/Data NNTP Route NFS Shell

20764 27027 473941 8683 389250 5533 79015

0.65 0.16 14.80 0.27 12.16 0.17 2.47

3857043 7993380 126622882 4696238 155919406 1972528 11121835

0.69 0.02 22.63 0.84 27.86 0.35 1.99

651 72 3848 2851 630 29 -

5.01 0.55 29.64 21.96 4.85 0.22 -

186 296 267 541 401 356 141

Bulk

Others Total/Avg.

3202052 100.00 559625182

100.00

12983

100.00 175

Table 11: ECSNET - Characterization at Application Layer

Protocol

ARP DECNET ICMP TCP UDP

# pkts % pkts 2398 324 38021 1055887 2105746

0.07 0.01 1.19 32.97 65.75

# bytes % bytes Size

143880 33846 2711922 191969522 364799858

Total/Avg. 3202376 100.00 559659028

0.03 0.01 0.48 34.30 65.18

100.00 175

Table 12: Characterization at Transport Layer

28

60 104 71 182 173

Packet Size Distrubution On ECSNET For 24 Hr Period 60

From 12.00 PM (Thur) on 03/05/92

50

Percentage of packets

To 11.59 AM (Fri) on 03/06/92 40

30

20

10

0 0

200

400

600

800

1000

1200

1400

1600

Packet Size in 60 byte interval

Figure 8: ECSNET - Characterization at Medium Access layer

1. Transport Conversation Inter-Arrival Time The inter-arrival time between the start of two consecutive transport conversation was calculated using their arrival times. Figure 9 shows the log distribution of the inter-transport conversation time. We observe that the graph nearly ts a straight line. This is true for a Poisson process for which the log of probabilities is a linear function. Thus, the intertransport conversation time can be described using a Poisson process. The arrival rate of transport conversations is plotted in Figure 10. The peak arrival rate is reached at midday and remains high throughout the afternoon.

2. Trac Matrix Trac was hierarchically classi ed as Intra-LAN (within ECSNET), Inter-LAN (with other LAN's on UFNET), and LAN to WAN (with Internet), based on the Internet addresses in the packet header. 38.63% of packets were Intra-LAN, 57.07% were Inter-LAN and the remaining 5.89% were either destined to or came from Internet. Although the trac matrix generated in this study may exhibit a few characteristics which 29

Inter Conversation Time Distribution 10 1

Log(Percentage of Conversations

Mean ICT - 6.14997 Secs 10 0

10 -1

10 -2

10 -3

0

5

10

15

20

25

30

Inter Conversation Time in Secs

Figure 9: Inter-Conversation time distribution

are unique to the network for which measurements were conducted, our observations can be used to generate useful trac matrices for a more general model. The best way to de ne such matrices would be to categorize the packets by application characteristics, con guration, and topology of the network so that suitable extrapolations to other type of networks can be made.

3. Application Distribution In the post-processing analysis, the measured data was separated into transport conversations. Table 11 shows the Transport Conversation Distribution for each application. The percentage of TC's for a particular application is an estimated probability with which transport conversations for that application arrive.

4. Conversation Duration Distribution Conversation Duration (CD) is a parameter for interactive applications such as Telnet, X11, etc. The conversation duration delimits the conversation upon arrival. Figure 11 shows 30

TC Arrival Distribution by Time of Day 700

600

Max = 671 Min = 187 Mean = 270

Number of TC Arrivals

StDv = 71 500

400

300

200

100 0

5

10

15

20

25

Normalized Time of Day in 30 Minute Interval

Figure 10: Conversation arrival distribution by time of day

the conversation duration distribution for the telnet application. The distribution was also calculated for other interactive applications and is available with the authors.

5. Number of Bytes/TC Distribution The number of bytes/TC distribution was calculated for bulk transfer applications such as SMTP, FTP, NNTP, etc. As mentioned earlier, bulk transfer applications may have either a single transfer per conversation or multiple transfers per conversation. SMTP and Route belong to the rst category while FTP and NNTP are examples of the second type. The distribution for the SMTP application is shown in Figure 12. This distribution provides a number of bytes after which a conversation can be considered as over. Bulk applications with multiple transfers use a dierent parameter which is a combination of the distribution of the number of transfers per conversation and the number of bytes per conversation. Figure 13 shows the distribution for the NNTP application.

6. Inter-Packet Time Distribution for each application For each application, the packets owing in either direction in a transport conversation 31

Percentage of Packets

Interarrival Time Dist. for Telnet Packets ______ Src-Dst ...... Dst-Src

10

5

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Number of Conversations

Interarrival Time in Secs Conversation Length Distribution for Telnet

20

Mean CL - 790 secs # of Intervals - 100

15 10 5

0 **************************************************************************************************** 0 1000 2000 3000 4000 5000 6000 7000

8000

Conversation Duration in Secs

Figure 11: Model parameters for the Telnet application (Interactive)

Interarrival Time Dist. for SMTP Packets

Percentage of Packets

30

______ Src-Dst ...... Dst-Src 20

10

0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Number of Conversations

Interarrival Time in Secs Number of Bytes Dist. for SMTP

100

No. of TC = 651 Mean Bytes/TC = 5924 No. of Intervals = 100

80 60 40 20 0

****************************************************************************************************

0

0.5

1

1.5

2

Number of Bytes

2.5

3

3.5 x10 4

Figure 12: Model parameters for the SMTP application (Bulk Transfer) 32

Interarrival Time Dist. for NNTP Packets

Percentage of Packets

30

______ Src-Dst ...... Dst-Src 20

10

0

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

0.45

0.5

Log(No. of Conversations)

Interarrival Time in Secs Number of Bytes Dist. for NNTP

10 4

No. of TCs = 3848 Mean Bytes/TC = 32906 No. of Intervals = 100

10 3 10 2 10 1 10 0 0

1

2

3 Number of Bytes

4

5

6 x10 6

Figure 13: Model parameters for the NNTP application (Bulk Transfer)

were separated for nding the inter-packet time distributions. This is very important as the packets in each direction exhibit distinct inter-packet arrival time characteristics. The interpacket time distributions for Telnet, SMTP, and NNTP applications are plotted in Figures 11, 12, and 13 respectively. It can be observed that they tend to exhibit a Poisson arrival rate with a similar distribution for forward and reverse packets. This is a signi cant observation and is in accordance with intuition since requests and responses are related. Arrival rates which were found are only representative and the actual rate will depend on dierent factors for dierent types of networks.

7. Packet Size Distribution for each application The packet size distribution for interactive applications is shown in Table 13. We can see that for the most part the packet size is small for trac in both directions. Some applications such as NTP, have a xed packet size of 90 bytes. The packet size distribution in both directions serves as a parameter for the ow model for interactive applications. Table 14 shows a similar distribution for bulk transfer applications. Once again, we observe 33

Packet Size

Percentage of Packets Telnet Login X-11 NTP Domain Interactive Bulk S-D D-S S-D D-S S-D D-S S-D D-S S-D D-S S-D D-S

0-60 97.38 65.16 99.51 59.27 45.38 56.80 61-120 1.21 17.86 0.48 19.27 46.68 41.77 121-180 0.53 3.51 4.67 2.46 0.49 181-240 0.11 1.13 0.01 2.35 1.78 0.16 241-300 0.07 0.92 2.61 0.38 0.05 301-360 0.06 1.66 2.03 0.12 0.06 361-420 0.06 1.02 1.23 0.09 0.02 421-480 0.03 1.01 1.08 0.07 0.03 481-540 0.12 0.72 0.78 0.06 0.02 541-600 0.45 5.17 4.93 0.07 0.06 601-660 0.11 0.27 0.10 0.03 661-720 0.14 0.29 0.05 0.01 721-780 0.05 0.19 0.02 0.01 781-840 1.36 0.32 0.05 0.01 841-900 901-960 0.02 0.15 0.03 0.01 961-1020 0.03 0.11 0.03 1021-1080 0.12 0.19 0.02 1081-1140 0.04 0.01 1141-1200 0.07 0.02 0.01 1201-1260 0.04 0.01 1261-1320 0.02 0.01 1321-1380 0.01 0.01 0.01 1381-1440 0.02 1441-1500 0.07 0.01 0.03 1501-1560 0.04 2.50 0.41

100

7.80 6.07 100 90.37 21.82 78.18 65.57 1.79 55.86 0.49 6.89 0.01 9.46 0.06 0.02 5.10 21.32 27.47 1.44 0.03 0.07 0.06 0.09

Table 13: Packet Size Distribution (Interactive applications)

many packets that are small in size. However, there are a signi cant number of packets in the 541-600 bytes range as the network MTU (Maximum Transferable Unit) falls in this range. NFS is the only application with packets of varying sizes.

5.4 Summary of Parameters Table 15 summarizes the parameters derived for the proposed ow model. ICT represents the mean inter-transport conversation time for each application, and CD represents the mean conversation duration for each application. The Pkts/TC is the mean number of packets

owing in either direction during a transport conversation. IAT is the mean inter-arrival time of the packets in each direction. The Bytes/TC column shows the average number of 34

Packet Size

Percentage of Packets SMTP FTP NNTP Route NFS S-D D-S S-D D-S S-D D-S S-D D-S S-D D-S

0-60 46.46 53.33 93.79 5.95 35.84 29.67 61-120 15.68 36.88 4.47 5.84 24.06 28.00 0.41 121-180 0.63 9.25 1.03 0.92 2.51 0.12 181-240 0.57 0.04 0.16 0.88 0.36 0.02 241-300 0.56 0.17 0.89 0.37 301-360 0.60 0.01 0.06 0.82 0.22 361-420 0.50 0.23 0.09 0.86 0.22 421-480 2.85 0.01 0.10 0.87 0.21 481-540 0.57 0.08 0.92 0.31 7.49 541-600 29.09 0.25 1.74 86.44 33.89 36.41 91.96 601-660 0.02 661-720 0.01 0.02 721-780 0.01 0.02 781-840 0.02 0.01 0.05 841-900 901-960 0.02 0.03 961-1020 0.02 1021-1080 0.01 0.03 1081-1140 0.01 0.02 1141-1200 0.02 1201-1260 0.01 0.01 0.01 0.35 1261-1320 0.01 0.03 1321-1380 0.02 0.02 1381-1440 0.02 1441-1500 0.06 0.02 1501-1560 2.39 0.03 1.05

0.02 0.02 19.21 16.48 67.95 47.37 6.24 0.13 0.18 0.57 0.08 0.11 0.07 0.11 0.09 0.15 0.06 0.11 0.10 0.06 0.08 0.18 0.08 0.06 0.08 0.04 0.17 0.27 0.20 4.13 0.27 0.03 0.07 0.03 0.08 1.42 1.30 5.16 0.08 0.10 1.36 0.08 0.02 0.06 0.02 0.05 0.04 3.28 22.13

Table 14: Packet Size Distribution (Bulk Transfer applications)

35

Application Type Interactive

ICT TC

Characteristics Transport Conversations (TC) CD Pkts/TC IAT Bytes/TC Size TC S-D D-S S-D D-S S-D D-S S-D D-S

Telnet Login X-11 NTP Domain (I) Domain (B) Echo/reply Sunrpc Finger Dst unreach Syslog

1151.03 790.52 605 490 0.868 1.054 38968 61908 2457.55 2893.06 435 213 5.685 1.921 26135 28724 797.39 487.34 1630 2147 0.151 0.115 191551 168909 311.08 56996.38 801 584 0.452 0.596 72132 52587 79.57 463.68 29 29 2.746 2.738 2483 4394 45.28 501.59 378 263 0.120 0.172 46145 35763 4543.70 1080.39 37 37 28.996 29.467 3942 3926 174.05 78.72 2 1 98.532 63.810 192 104 4778.91 4.07 6 4 6.201 4.220 632 759 121.06 2225.04 49 1 2.501 5.061 3461 120 439.43 1913.10 62 0 7.113 7364 0

64 60 117 90 82 122 105 84 91 70 119

126 134 78 90 151 135 105 64 168 70 0

SMTP FTP/Data NNTP Route NFS Shell

132.62 1193.88 22.45 30.30 136.98 6499.33

267 69 255 549 216 521

80 502 277 0 560 79

Bulk

Total

30.99 147.61 79.89 0.34 2737.55 156.22

17 179 59 3 286 268

13 196 64 0 331 144

0.365 1.210 0.386 14.81 0.480 0.531

0.458 4803 1120 1.257 12430 98588 0.351 15116 17790 1647 0 0.414 62094 185396 0.984 139999 11511

6.51 1539.58 135 116 0.612 0.476 18869 23355 139 200

Note - All times in seconds and numbers in number of bytes Table 15: Characteristics of Transport Conversations

bytes per conversation in each direction. The last column shows the average packet size in each direction for a conversation. For example, a Telnet conversation arrives approximately once in every 20 minutes on an average and lasts for about 13 minutes. The average number of bytes owing from source to destination is 605 and from destination to source is 490. The Route application originating from the gateway broadcasts routes approximately every 30 seconds using 3 packets each of about 549 bytes.

6 Conclusions We measured the trac characteristics of the University of Florida data communication networks at various hierarchical levels. One of the goals of the experiment was to study the 36

quantitative behavior of the networks as well as gain a basic qualitative understanding of some of the possible network management problems that might occur in practice. Our measurements indicate a very low utilization, less than 3% for UFNET and less than 1% for the three subnetworks. However, utilization measured over short periods of time increases to almost 13% due to the bursty nature of trac. The trac pattern over the time of day during a semester remains fairly constant. However, there is a substantial change from semester to semester. For UFNET data, the proportion of interactive and bulk transfer applications remained nearly equal. However, because of the larger average packet size of the latter the network load proportion was much higher. The predominantly used Internet applications are Network News, Internet Relay Chat, File Transfer, and Telnet. Signi cantly dierent applications were seen on the three subnets. The packet size distribution is either quadramodal or trimodal. Locality was observed on all the subnets under consideration. Based on our observations, we conclude that trac characteristics depend on several factors: network hierarchy, topology, con guration, services provided (eg. News, Name, etc.), and the number and class of its users. Although, similar studies have been performed by others in the past, our study is unique in the sense that it adopts a hierarchical approach to measuring system performance. The bene ts of this approach have been discussed in Section 1. The results of our study can be of immense help to researchers and network managers to help design ecient networks and provide better services. We have also proposed a ow model model for computer network trac based on extensive real-time measurements that were conducted. The actual trac appearing on the physical medium is considered to be a complex aggregate of the arriving transport conversations. A signi cant observation was that the transport conversation arrival process was found to be Poisson in nature. The paper also attempts to explain the dynamics of the trac patterns appearing on the physical layer as the transport conversations originating at the application layer travel down through the lower layers. Each layer introduces a typical pattern change. For example, the medium access layer determines the actual packet size and arrival time. 37

The model parameters were calculated for a typical 24 hour period on the Engineering Consulting Services network. The derived parameters depend on features of the ECSNET subnetwork such as, topology, con guration, class and types of users, applications supported, etc. However, the intent of this study was to provide a general framework for conducting a similar exercise. The results of this study also provide a qualitative measure of network behavior and a basic understanding of some of the network management problems which occur in practice. The proposed ow model was used as a input parameter to a simulation experiment to evaluate the performance of a Metropolitan Area Network providing Switched Multimegabit Data Services. Currently the model is being used to design and implement an arti cial load generator to generate dierent types of trac which can be used in similar simulation experiments.

7 Acknowledgments We would like to thank Prof. Yann-Hang Lee for his guidance and support throughout this project. Bradley Spatz of the Engineering Consulting Services, Chuck Seeger of the Computer & Information Sciences Department and Kwang R. Hyun of the Telecommunication Research Lab provided us with the facilities to perform measurements. Special thanks to Dr. Parviz Kermani of IBM Research for all his help and guidance. Finally we would like to thank BellSouth for providing us with nancial support.

References

[1] Acharya, M. K., et. al., Real-time hierarchical trac characterization of a campus area network, Sixth International Conference on Modeling Techniques and Tools for Computer Performance Evaluation, Edinburgh, U. K., September 1992. [2] Acharya, M. K., et. al., Diskless workstation trac characterization in a university environment, 25th IEEE Southeastern Symposium on System Theory, Tuscaloosa, AL, March 1993. [3] Acharya, M. K., et. al., Local area network trac characterization in a university environment, International Conference on computer networks: Present status - Future trends, Ahmedabad, India, February 1993. 38

[4] Caceres, R., et. al., Characteristics of wide-area TCP/IP conversations, ACM SIGCOMM, 1991. [5] Gerla, M., et. al., A cut-saturation algorithm for topological design of packet switched communication networks, Proceedings of National Telecommunications Conference, San Diego, CA, December 1974. [6] Guesella, R., A measurement study of diskless workstation trac on an ethernet, IEEE Transactions on Communications, Vol. 38, No. 9, September 1990. [7] Heimlich, A. S., Trac characterization of the NSFNET national backbone, USENIX Conference Proceedings, Winter 1990. [8] Jain, R. and Routhier, A. S., Packet Trains - Measurements and a new model for computer network trac, IEEE Journal on Selected Areas in Communication, Vol. SAC4, No. 6, September 1986. [9] Kermani, P., Switching and ow control techniques in computer communication networks, Ph.D Dissertation, Department of Computer Science, University of California, Los Angeles, 1977. [10] Kleinrock, L. and Tobagi, F. A., Packet switching in radio channels: Part I - Carrier sense multiple-access modes and their throughput-delay characteristics, IEEE Transactions of Communications, Vol. COM-23, pp 1400-1416, December 1975. [11] Kleinrock, L., Analytical and simulation methods in computer network design, AFIPS Conference Proceedings (SJCC), Vol. 36, pp 569-579, 1970. [12] Shoch, J. F. and Hupp, J. A., Measured performance of an ethernet local network, Communications of the ACM, Vol. 23, No. 23, December 1980. [13] SUNOS SYSTEM, Nfswatch & Ether nd Manual Pages, 1991.

39

8 Appendix Acronym

ARP CISNET DECNET DOMAIN ECSNET EENET FINGER FTP ICMP IP IRC LAT LAVC LOGIN NFS NNTP NTP P 4000 and P 9000 RARP RLOGIN ROUTE SHELL SMTP SNMP SUNRPC TCP TELNET UDP UFNET UUCP WAN X-11

Description

Address Resolution Protocol Computer and Information Sciences Network Digital Equipment Corporation Network Protocol Domain Name Service Engineering Consulting Services Network Electrical Engineering Network User information query application File Transfer Protocol Internet Control Message Protocol Internet Protocol Internet Relay Chat Program Local Area Transport Local Area VAX Cluster Remote login application Network File System Network News Transfer Protocol Network Time Protocol Multi User Dungeon Game Reverse Address Resolution Protocol Remote login application Routing Information Exchange Protocol Remote Shell applications Simple Mail Transfer Protocol Simple Network Management Protocol SUN's Remote Procedure call Transmission Control Protocol Remote Terminal Application User Datagram Protocol University of Florida Network (Campus backbone) Unix to Unix Copy Program Wide Area network X Window System

40