Traditional IP Measurements: What Changes in a Today Multimedia IP Network Delia Ciullo, Marco Mellia, Michela Meo Dipartimento di Elettronica, Politecnico di Torino Torino, Italy
[email protected]
Abstract— In this paper we present measurement results collected from real traces on the network of FastWeb, an Italian ISP which is the main broadband telecommunication company in Italy. The network relies on a fully IP architecture and delivers to the user data, VoIP and IPTV services over a single broadband connection. The aims of this work are the evaluation of traditional measurement indexes in a novel network environment with a mixture of traffic generated by various services and the identification of possible changes of the traffic properties due to this traffic mixture. Our measurement campaign, based on passive techniques, provides traffic characterization at both the packet and the connection/flow levels and focuses on time evolution, distributions, long range dependence and periodicity properties. We discover that the main characteristics of data traffic are kept unmodified, showing LRD properties both at the packet and flow levels. VoIP and IPTV traffic instead presents periodicities of the packet arrival process, due to periodicity of the sources. Considering the VoIP flow arrival process, the traditional Markovian assumption still holds true.
I. I NTRODUCTION Traffic monitoring and characterization has always been seen as a key methodology to understand telecommunication technology and operation; in particular, the complexity of the Internet has attracted many researchers to face traffic measurements since the pioneering times [1]. In the early 90’s, two seminal papers [2], [3] showed that traffic traces captured on both LANs and WANs exhibit long range dependence (LRD) properties, and self-similar characteristics at different time scales. Those discoveries spurred a significant research effort to understand data traffic in packet networks in general, and in the Internet in particular [4]. More recently, there has been an increasing interest in joint measurements of IP packets and TCP flows, and in network monitoring in itself, as testified by the work carried by several research groups [5], [6], [7]. Today, Voice over IP (VoIP) and IP television (IPTV) technologies, whose traffic is steadily increasing over the Internet, are leading the evolution of the Internet toward a universal communication network. It is therefore interesting to study possible changes in Internet traffic the new applications might introduce. Some works already deal with multimedia traffic measurement [8], [9]. They focus on VoIP traffic, and rely on traffic characterization and measurement obtained from active probes, in which controlled sources, either PCs or traffic generators, are used to inject packets in a LAN or simple WAN environment. All previous works present results
collected from data-centric networks, being them collected from either University campus LANs or data-centric backbone links. After having investigated VoIP [10] and IPTV [11] traffic in isolation, in this paper, we present, to the best of our knowledge, the first extended set of measurement results collected via passive monitoring of a mixture of data/voice/video IP traffic. Real traffic traces are collected from an ISP provider in Italy, called FastWeb [12], which is the main broadband telecommunication company in Italy, offering telecommunication services to more than 5 millions of families, with 1 million of subscribers (11% of market share). Due to its fully IP architecture, and the use of either Fiber to the Home (FTTH) or Digital Subscriber Line (xDSL) access, FastWeb has optimized the delivery of converged services, such as data, VoIP, and IPTV, over a single broadband connection. No traditional PSTN-like access is provided to end-user, being all services delivered following a pure IP-centric paradigm. The scenario we consider can be envisioned as a first environment in which traffic flows generated by different services (from traditional data services to new real-time multimedia applications) coexist up to the end-users. With our measurement campaign, we provide characterization at both the packet and the connection/flow levels, being our aim the identification of possible changes in the traffic properties due to the presence of a combination of different services. Following a traditional approach, for a sequence of samples of a given measurement index, we present: i) its evolution with time, ii) its estimated probability density function (pdf) collected during a stationary period of observation, iii) possible long range dependence and iv) periodicity properties. By considering each service separately, we discover that the main characteristics of data traffic are kept unmodified, showing LRD properties both at the packet and flow levels. VoIP and IPTV traffic instead presents periodicities of the packet arrival process, due to periodicity of the sources. Considering the VoIP flow arrival process, the traditional Markovian assumption still holds true. Considering the aggregate traffic, while packet size is very different from the one typical of data-centric networks, the stochastic characteristics are very similar, being the LRD properties of data traffic predominant.
Fig. 1. The FastWeb infrastructure: FTTH and xDSL access, MiniPoP, PoP and backbone layers.
II. T HE FAST W EB N ETWORK FastWeb was born in October 1999 with a novel idea of delivering only Internet access to end users (consumers, SOHOs, and large business customers) and then providing telecommunication services over IP only. In October 2000, the service was opened to consumers and business customers, offering Internet access, VoIP telephony, IPTV and video on demand services. Since then, FastWeb has become the main broadband telecommunication company in Italy. Due to its fully IP architecture, and the use of either Fiber-To-The-Home (FTTH) or xDSL access technologies, FastWeb has optimized the delivery of converged services, like data, VoIP, IPTV, over a single broadband connection. As shown in Fig. 1, a Metropolitan Area Network (MAN) Ethernet-based architecture is adopted in the last mile of Fastweb architecture. Residential and small business customers are connected to a Home Access Gateway (HAG), which offers Ethernet ports to connect PCs and the VideoBox, as well as Plain Old Telephone Service (POTS) plugs to connect traditional phones. The HAG is essentially an Ethernet Switch, combined with a SIP or H.323 gateway to convert POTS analog input to VoIP transport. In case of FTTH access, a 10Base-F port is used to connect the HAG to a L2 switch installed in the basement; while a modem port is used when xDSL access is offered. In the first case, L2 switches are interconnected by 1000Base-SX links forming a bidirectional ring. Rings are terminated at the so called MiniPoP by means of two L2 switches. A trunk of several 1000Base-SX links connects each MiniPoP switch to a L2 switch in the PoP, in which two routers are used to connect the backbone by means of Packet-Over-Sonet (POS) STM16 or STM48 links. In case of xDSL access, the HAG is connected to the traditional twisted pair phone cable terminated directly to a DSLAM. Then, either a STM4 or STM16 link is used to connect DSLAMs to the PoP by means of an additional router, as shown in the right part of Fig. 1; notice that no analog circuit is present even when using xDSL access. When FTTH access is adopted, customers are offered 10Mbps Half-Duplex Ethernet links, while when xDSL access is adopted, customers are offered 512 or 1024kbps upstream and 6Mbps or 20Mbps
downstream links. Finally, medium/top business customers are offered both MetroEthernet or SDH access by means of a router connected directly at the PoP layer. Cities covered by the MAN access infrastructure are interconnected by means of a high-speed backbone based on IPover-DWDM technology. The largest cities in Italy are directly connected by more than 12.400km of optical fibers. Considering the services provided to customers, FastWeb offers traditional data access, telephony, video on demand and multicast streaming of digital TV channels. At the risk of being tedious, we recall that all services use IP at the network layer. The IPTV architecture is based on IP multicast standard. In particular, at the time of measurement, 83 digital TV channels were broadcasted in the backbone. Each TV channel is encoded using high-quality (720x576@25fps) MPEG2 standard by a “VideoPump”. VideoPumps are responsible of transcoding the original high-definition digital TV source into broadcasting quality MPEG-2 system stream. Different MPEG-2 encoders are used, resulting in stream bitrate ranging from 2.5Mbps up to 4Mbps, being either CBR or VBR [11]. 1336B long packets are used by the VideoPump to avoid IP fragmentation problems1 . At the network layer, standard IP multicast is adopted to transport video streams through the FastWeb network, forming a multicast tree spanning all network routers and switches. The VoIP architecture is based on both H.323 and SIP standards. The HAG converts traditional analog phone plugs to VoIP and performs both signaling and voice transport tasks. Phone calls between FastWeb users are then routed end-toend without any further conversion, while phone calls to traditional users are routed toward a Telecom Italia PSTN gateway. For voice transport, a simple G.711a Codec without silence suppression and loss concealment is used, so that two 64kbps streams are required to carry the bidirectional phone call. Packetization time is set to 20ms, leading to 160B of voice samples per packet. RTP and RTCP over UDP are used to transport the voice streams, adding 40 bytes of overhead. Per-class differentiation is performed by the network layer, so that VoIP, and video streams are given higher priority when multiplexed with data traffic into a single aggregate stream. III. M EASUREMENT M ETHODOLOGY In this section, we define our measurement methodology. A monitoring probe is used to sniff packet headers from traffic flowing on a link at the MiniPoP level. The probe node is based on high-end PCs running Linux, and has been installed in a PoP located in Torino, Italy. The first bytes of the packet payload are exposed to the Tstat [13] analyzer, that identifies the application generating each packet (see [10], [11] for details). We therefore distinguish the traffic in the following classes, • TCP: data traffic carried over TCP/IP protocols • UDP: data traffic carried over UDP/IP protocols • VoIP: VoIP traffic carried over RTP/UDP/IP protocols 1 Different
bitrates are obtained using variable inter-packet times.
IPTV: multicast video traffic carried over UDP/IP protocols • ALL: the aggregate traffic observed on the link. Based on the observation of the source and destination IP addresses, we distinguish among incoming (IN) and outgoing (OUT) traffic, i.e., packets coming from a host outside the FastWeb MiniPoP and destined to a host inside it, or viceversa. In the case of IPTV traffic, we have only IN traffic. Results will be presented considering both the packet (network) level, and the flow (transport) level. In particular, a flow is identified by the usual 5-tuple (IP source address, IP destination address, source port, destination port, protocol type). The flow starts when the SYN segment is observed, in the case of TCP, or a packet with a given tuple is first observed, in the case of UDP. A flow ends when either the teardown procedure is observed (in the case of TCP only), or after an idle period, set conservatively to 200s, during which no packets are observed. Let X(n) be a discrete-time stochastic process, obtained by observing any of the previously mentioned classes of traffic for one of the following quantities, • ARR: the packet (flow) arrival process, in which X(n) = tn , being tn the time at which packet (flow) n arrived. • GAP: the inter-packet-gap (inter-flow-gap) process, in which X(n) = tn − tn−1 . • COUNT: the packet (flow) counting process, in which X(n) is equal to the number of packets (flows) arrived during the n−th time interval of size ∆T . For example, X(n) represents the amount of TCP packets arrived on the link, or the inter-packet-gap between VoIP packets. To characterize X(n), we present measurements of • The evolution of X(n) versus time n. • The probability density function (pdf) or Cumulative Distribution Function (CDF) estimated during a stationary period of observation of X(n). • The Autocorrelation Function (ACF) •
R(k) =
E[(X(n) − µ)(X(n − k) − µ)] σ 2 (X)
where µ = E[X] and σ(X) are the average and standard deviation of X(n). The corresponding Power Spectral Density S(f ), i.e., the discrete Fourier transform of R(k). • The estimation of the Hurst parameter of X(n). Several classes of discrete-time stochastic processes can be distinguished, and a huge amount of work is present in the literature to classify X(n). In the following, we will distinguish among: i) Markovian , ii) Self-Similar (SS) - Long Range Dependent (LDR) and iii) Periodic (PER) processes. Markovian processes, of which Poisson processes are a subset, are well-know for their memoryless properties, so that the system evolution X(n + 1) depends only from the current system status X(n). On the contrary, a stationary process X(n) is LRD if its ACF decaysPto zero so slowly that its integral does not converge, i.e., |R(k)| = ∞. Intuitively,
memory is built-in to the process because the dependence among widely separated values is significant, even across large time shifts. X(n) is SS if X(at) = aH X(t), a > 0, where the equality refers to equality in distributions, a is a scaling factor, and the self-similarity parameter H, 0.5 ≤ H < 1, is called the Hurst exponent. Intuitively, self-similarity describes the phenomenon in which certain process properties are preserved irrespectively of scaling in time. If the process is uncorrelated, then H = 0.5. If H > 0.5, some correlation exists, being it higher for larger values of H. SS processes are LRD, but LRD processes can be non-SS. Finally, X(n) is periodic if S(f ) shows some peaks, i.e., a large amount of the process power is related to small frequency subset. Equivalently, if R(k) is periodic, then some periodicity exists in X(n). To classify X(n), we start by applying the Lewis-Robinson test [15] to verify if X(n) is Markovian. If the test fails, we look at the Hurst parameter, H, to test if the process is Self Similar. A large literature is available for the estimate of H. Among all the tools and methodologies, we selected the wavelet Abry-Veitch (AV) estimators [14]. Finally, by looking at the R(k) and S(f ), we check for the possible presence of periodicity in X(n). IV. M EASUREMENT R ESULTS In the following, we present results obtained by monitoring traffic at the MiniPoP level. A probe node based on highend PCs running Linux have been installed in a PoP located in Torino. The probe has been connected to one of the two PoP L2-switches, that was configured to replicate all traffic coming in and going out through the links connecting the PoP backbone router. Traffic was captured on disks, and later analyzed at the packet level and at the flow level by running a set of ad-hoc generated Matlab scripts. An average load of 380Mbps full-duplex with peaks up to 900Mbps of traffic has been processed for more than three weeks. In this paper, we present results considering a typical working day. Presented results are consistent to those obtained during other periods of time. A. Packet Level Measurements We start by showing measurement results at the packet level. Fig. 2 reports the evolution versus time since midnight of the average bitrate transported by the network every second; incoming traffic is shown. Log scale is used on the y-axis given the different orders of magnitude of the load imposed by different applications. It is possible to observe that the average load offered by IPTV services is constant over time, which is intuitively due to the fact that the network always carries IPTV traffic despite the number of users actually accessing the service. Data traffic carried by TCP, instead, follows the typical day and night trend, so that during the night traffic is about an order of magnitude smaller than during the day, due to the lower users activity. VoIP traffic amount is also driven by users accessing the service: it is negligible during night, and reaches the peak period from 9am. As noticed in [10], the main difference between users browsing the Internet or using
106
1
IN OUT
IPTV-UDP 105
0.8
104
VOIP-UDP
0.6 CDF
Bitrate [kbps]
DATA-TCP
103
DATA-UDP
0.4
2
0.2
10
101 00:00
Fig. 2.
0 02:00
04:00
06:00 08:00 Time
10:00
12:00
14:00
Bitrate evolution versus time for different traffic classes. IN traffic.
0
Fig. 3.
200
400
600 800 1000 IP Length [byte]
1200 1356 1500
Cumulative Distribution Function of the IP packet length. TABLE I
the phone is that during lunch time (12:00-13:30) people tend not to use the phone, as testified by the negative bump by end of Fig. 2. Finally, DATA carried over UDP is less sensitive to the day time. This is due to the fact that UDP traffic is mainly generated by control protocols which are less related to user activities, e.g., peer-to-peer traffic. From Fig. 2 it is possible to identify a stationary period during which a more detailed study of the properties of the packet arrival process can be performed. In particular, we select as peak period the time interval [10:00-12:00], which proved to be stationary for all traffic classes. Fig. 3 shows the CDF of the packet size measured during the peak period. Recall that typical data-centric packet size CDFs show biases versus either short packets (TCP acknowledgments) or full sized packets (MSS-sized TCP data segments); moreover, IN and OUT CDFs are usually very similar [5]. While the bimodal packet distribution is still noticeable, Fig.3 shows that our scenario has some major differences with respect to more traditional data-centric networks. First, packet size for IN or OUT traffic is drastically different. Indeed, considering IN traffic, most of the packets takes values around 1356B, which is the packet size used by VideoPump to transmit IPTV sources. OUT traffic does not present this bias since no IPTV traffic is going out of the POP. Second, the large presence of VoIP traffic imposes a bias toward 200B packets, which are negligible on data-centric networks. Finally, packets around 576B, that are typical of measurements over the Internet due to the presence of end-hosts adopting the minimum MTU supported by all Internet hosts to avoid fragmentation problems, are negligible in our scenario, since the totality of the hosts is connected by means of an high speed access with 1500B MTU. In order to characterize the packet arrival process ARR, we performed the Lewis-Robinson test to verify if any of the traffic classes exhibits Markovian properties. In all cases, the test failed, showing that more complex models must be adopted. We then tested the LRD or periodic properties of different mixes of traffic. We considered several sequences X(n), corresponding to different observation intervals, e.g.,
S UMMARY OF THE PROPERTIES OF PACKET LEVEL TRAFFIC . ARR GAP COUNT
TCP LRD+ LRD++ LRD++
UDP LRD LRD+ LRD+
VoIP PER PER PER
IPTV PER PER PER
ALL LRD+ LRD++ LRD++
during night, day, week or weekend days. IN and OUT traces were also separately analyzed. We considered different values of the length of X(n) (from 15min long traces, to 12hours long traces), and estimated the corresponding Hurst exponent. Instead of reporting detailed results, we summarize them by coarsely classifying them according to the scale (NO, LRD-, LRD, LRD+, LRD++), corresponding to values of H in the ranges[0.5 : 0.51), [0.51 : 0.6), [0.6 : 0.7), [0.7−0.8), [0.8 : 1). The term PER refers to the presence of periodicity. Table I summarizes our findings. As expected, the packet arrival process is highly correlated considering DATA traffic carried over TCP. A slightly larger correlation arises when considering the GAP and COUNT processes. Data traffic carried over UDP is correlated as well, while both VoIP and IPTV traffic cannot be modeled by LRD processes, but rather by periodic processes. The aggregate process shows mainly the characteristics of TCP-DATA process. To study the periodic behavior of VoIP, Fig. 4 shows the a zoom of the ACF function (inset) and the corresponding power spectrum density function. X(n) is the number of VoIP packets arrived in a time window of 10ms. Since the single VoIP source generates a packet every 20ms, we expect R(k) to be periodic of period 2. Similarly, we expect S(f ) to exhibit a peak at the normalized frequency of 0.5 = 10ms/20ms. Both periodicities are clearly visible: the S(f ) peak at f = 0.5 is 25dB higher than the second highest peak. Some noise and other peaks are visible, due to the number of calls that were not constant during observation time. By looking at the periodicity of the IPTV aggregate streams reported in Fig. 5, it is possible to notice that S(f ) exhibits several periodical patterns, being the most evident ones at 20ms, 25ms, 30ms, 40ms, 60ms. They possibly correspond
40
1 0.995 0.99 0.985 0.98 0.975 0.97
30
0.21 0.18 0.15 0.12 0.09 0.06 0.03 0
140 120 100 # Flows/s
50 ACF
Power Spectral Density [dB]
60
1 2 3 4 5 6 7 8 9 Lag
80
IN OUT
0
30 60 # Flows/s
90
60
20 40 10
20
0 0
0.1
0.2 0.3 Normalized Frequency
0.4
0 0:00
0.5
Fig. 4. Power spectrum (outset) and portion of the autocorrelation function (inset) of the VoIP packet counting process. ∆T = 10ms.
2:00
4:00
6:00 8:00 Time
10:00
12:00
14:00
Fig. 6. Counting process of data flows originated from (OUT) and destined to (IN) an internal address: time evolution (outset) and probability density function (inset). ∆t = 1s.
70 14 12 50 10 40
# Flows/10s
Power Spectral Density [dB]
60
30 20
8
0.18 0.16 0.14 0.12 0.1 0.08 0.06 0.04 0.02 0 0
6
2
4 6 8 10 12 14 # Flows/10s
4 10 2 0 0
0.1
0.2 0.3 Normalized Frequency
0.4
0.5
0 0:00
2:00
4:00
6:00 8:00 Time
10:00
12:00
14:00
Fig. 5. Power spectrum of the IPTV packet counting process. ∆T = 10ms.
to the periodicity of PAL and NTSC videostreams, and the different Group of Pictures (GOP) patterns inside single streams. Indeed, by observing a single video stream (not reported here) it is possible to notice several periodicities introduced by both the frame rate and the GOP pattern. In summary, the aggregate packet arrival process shows LRD characteristics that are inherited from DATA traffic. Periodicity is present, due to multimedia traffic. B. Flow Level Measurements In this section we analyze traffic properties at the flow level. In particular, we are interested in characterizing the property of the arrival process of data flows carried over TCP and VoIP flows. Fig. 6 reports the evolution of the arrival rate in terms of the number of new TCP flows observed in a time interval of 1s. Distinction is made between IN and OUT flows, i.e., flows generated from a client outside (inside) the MiniPoP and destined to a server inside (outside) it. As expected, the number of outgoing flows is higher than the one of incoming flows, since very few servers are present inside the MiniPoP. However, P2P applications are widely adopted by users, so that
Fig. 7. VoIP flow counting process: time evolution (outset) and probability density function (inset). ∆T = 10s.
IN flows are still possible. Considering the number of OUT flows, the daily pattern with higher activity during daylight time than during night is again clearly visible. For the sake of clarity, the inset of Fig. 6 reports the corresponding pdf as observed during the peak time interval. Notice in the case of OUT flows, the variability of the number of arrivals per second. Fig. 7 reports the number of new VoIP calls observed during time intervals of 10s. The number of arrivals of VoIP streams is much smaller than the number of TCP arrivals, but, also in this case, it is possible to observe the day/night trend, with the negative bump during lunchtime. Notice that, due to the small number of calls, it is difficult to observe LRD and SS properties for this process [16]. Fig. 8 reports the flow length in bytes. Considering TCP flows, the CDF shows that most of the TCP connections carries files of a few kbytes, with the outgoing flows that are shorter than the incoming ones. This is typical of clientserver communications, in which clients perform small queries
1 Tcp OUT Tcp IN VoIP IN
0.8
1 1-CDF
CDF
0.6
0.4
0.2
0.1 0.01
0.001 10
100 1000 kbyte
10000
0 0
10
20
30
40
50 kbyte
60
70
80
90
100
Fig. 8. Flow size in Bytes: cumulative distribution function (outset) and complementary cumulative distribution function of the distribution tail (inset). TABLE II S UMMARY OF THE PROPERTIES OF FLOW LEVEL TRAFFIC . ARR GAP COUNT
TCP LRD+ LRD LRD
VoIP Markovian Markovian Markovian
ALL LRD LRD LRD
and servers reply with long answers. This bias is reflected by the OUT/IN CDF, being again the hosts inside the MiniPoP typically clients. Both CDFs exhibit a heavy-tail behavior, as shown by the complementary cumulative distribution function in the inset (in log/log scale). In the case of VoIP flow size, the CDFs exhibit a completely different trend. Recall that a VoIP source is a Constant Bitrate Source that transmits (and receives) at 64kbps. No distinction is made between IN and OUT flows, since the service is symmetrical. The flow length in bytes is directly proportional to the phone call duration; it is therefore not surprising that the CDF grows almost linearly in the initial 100kbyte (i.e., 10s), with a small percentage of calls that, being the called user busy, terminates earlier. Since it is related to the phone call duration (see again [10] for more details), the flow size decreases exponentially, as shown in the inset of the figure. Finally, we analyze the stochastic properties of the flow arrival process, as summarized in Tab. II. Also in this case, we performed several experiments, considering different traces, time of day, etc. Results are not surprising, since it is well known that the TCP flow arrival process is LRD, while the Markovian assumptions are true when considering the arrival process of phone calls. In the aggregate process (ALL), the LRD characteristics of data traffic dominate over the Markovian properties of VoIP traffic, also because of the much larger amount of data flow arrivals per second. V. C ONCLUSIONS In this paper we presented an extended set of measurement results collected from the network of the main broadband telecommunication company in Italy, which relies on a fully IP architecture, and offers end users data, VoIP and IPTV services over a single broadband network. Since almost the
totality of Internet traffic characterization has been done from measurement collected from data-centric networks, in this paper we revisited classic measurement indexes to observe the impact of large quantities of multimedia traffic over them. By considering each service separately, we discovered that the principal characteristics of data traffic are kept unmodified, showing LRD properties both at the packet and flow levels. VoIP and IPTV traffic instead presents periodical behaviors in the packet arrival process, due to periodicity in the sources. Considering the VoIP flow arrival process, the traditional Markovian assumption still holds. Finally, for what concerns the aggregate traffic, while packet size is very different from the typical one of data-centric networks, the stochastic characteristics are very similar, being the LRD properties of data traffic predominant. ACKNOWLEDGMENT This work was supported by the MIUR PRIN project MIMOSA. R EFERENCES [1] R. Caceres, P. Danzig, S. Jamin, and D. Mitzel, “Characteristics of WideArea TCP/IP Conversations”, ACM SIGCOMM, Zurich, SW, September 1991. [2] W.E. Leland, M.S. Taqqu, W. Willinger, V. Wilson, “On the Self-Similar Nature of Ethernet Traffic (Extended version),” IEEE/ACM Transaction on Networking, V.2, N.1, pp. 1–15, Jan. 1994. [3] V. Paxson, S. Floyd, “Wide-Area Traffic: The Failure of Poisson Modeling,” IEEE/ACM Transactions on Networking, V.3, N.3, pp. 226–244, Jun. 1995. [4] T.Karagiannis, M.Molle, M.Faloutsos, “Long-range dependence ten years of Internet traffic modeling” IEEE Internet Computing, V.8, N.5, pp.57-64, Sept. 2004. [5] C.Fraleigh, S.Moon, B.Lyles, C.Cotton, M.Khan, D.Moll, R.Rockell, T.Seely, C.Diot, “Packet-level traffic measurements from the sprint IP backbone.” IEEE Network,V.17, N.6, pp: 6-16, Nov. 2003. [6] Z.-L. Zhang, V. Ribeiro, S. Moon, C. Diot., “Small-time scaling behavior of Internet backbone traffic,” Computer Networks, V.48, N.3, pp.315334, June 2005. [7] L. Li, M. Thottan, B. Yao, S. Paul, Distributed Network Monitoring with Bounded Link Utilization in IP Networks, IEEE INFOCOM (2003) 1189–1198. [8] A.P. Markopoulou, F.A. Tobagi, M.J. Karam, “Assessment of VoIP Quality over Internet Backbones”, IEEE Infocom, New York, NY, June 2002. [9] P. Calyam, M. Sridharan, W. Mandrawa, P. Schopis, “Performance Measurement and Analysis of H.323 Traffic”, Passive and Active Measurement Workshop (PAM), April 2004. [10] R.Birke, M.Mellia, M.Petracca, D.Rossi, “Understanding VoIP from Backbone Measurements”, IEEE Infocom, Anchorage, Ak, May 2007. [11] K.Imran, M.Mellia, M.Meo, “Measurements of Multicast Television over IP”, IEEE LAN/MAN Workshop, Princeton, NJ, June 2007. [12] “FastWeb Company Information”, http://company.fastweb.it, 2007. [13] M. Mellia, D. Rossi, “TCP Statistic and Analysis Tool”, http:// tstat.tlc.polito.it, 2006. [14] P. Abry, D. Veitch, “Wavelet Analysis of Long-Range Dependence Traffic”, IEEE Transaction on Information Theory, V.44, N.1, pp.2-15, 1998. [15] S.M.Ross, “Introduction to Probability Models”, Academic Press, Inc., New York, NY, 2006. [16] T.D. Dang, B. Sonkoly, S. Molnar, “Fractal analysis and modeling of VoIP traffic”, 11th International Telecommunications Network Strategy and Planning Symposium (NETWORKS 2004), Vienna, Austria, June 2004.
