Elsevier

Performance Evaluation

Volume 58, Issues 2–3, November 2004, Pages 243-260
Performance Evaluation

Network traffic behaviour in switched Ethernet systems

https://doi.org/10.1016/j.peva.2004.07.017Get rights and content

Abstract

Measurements on a high-performance Ethernet are shown to match well a truncated Cauchy probability distribution, with a much better fit over smaller file/request sizes than the commonly used Pareto distribution. We observe self-similar characteristics in the traffic at both file servers and at a CPU server elsewhere in the network, which targets, predominantly, file and web servers. This suggests propagation of self-similarity. A simulation model of a single server with Poisson arrivals and Cauchy service demands yields a departure process that follows a power law and matches closely the observed traffic. The simulation is also used to investigate the link between the power laws in the request size distribution and the network traffic by using Lévy distributions for the request sizes. This suggests a link between file/request size distribution and self-similarity in traffic, leading to the possibility of using conventional queueing network performance models with processor sharing queueing discipline. This idea is further supported by an additional simulation experiment and suitable models are proposed.

Section snippets

Introduction and related work

In preparation for the building of performance models for network performance we have been measuring and analysing network traffic at various parts of an academic departmental network, specifically the Computing Department of Imperial College London. The motivation is to provide a better understanding of networking issues and to provide a body of data that can be used to validate future models of networks and network traffic.

Like many earlier papers [1], [2], [3], [4], [5], [6], [7], [8], [9],

Data capture

For this paper network traffic data has been collected by two methods, firstly by using tcpdump which allows to monitor each individual packet, secondly by using information recorded by the Linux kernel in /proc/net/dev, which provides packet and byte counts.

The tcpdump program [16] operates by attaching itself to the network socket in the Linux kernel. It provides a copy of each network packet that passes through the network interface in the kernel. We have used this to look at every Ethernet

Network architecture and monitoring

For this study we investigated the traffic in our departmental network which is a switched Ethernet. The architecture of the network highlighting the three parts that we studied is in Fig. 1. We chose to monitor the connection to the outside, an arbitrary CPU server (MOA) and the departmental webserver, used both for the internal and the external webservices.

The Internet connection of the department is provided by a Black Diamond router from Extreme Networks [18]. The Black Diamond is used as

Analysis methods

The packet departures and arrivals investigated in this paper are described by point processes with events happening at time ti, iI. Assume that we observe n events during one observation period, the first happening at t1 and the last at tn. The observation itself may start at t0 and end at tn+1. So, the observation period can be defined as the interval T = [t0,tn+1] ⊂ with t0 < t1 < … < tntn+1 and the length T=tn+1t0. The inter-event times, Δti, 1 ≤ in − 1, are defined

Measurements

We begin with a routine analysis of the outgoing traffic at the Black Diamond router. We expect no surprises here and find, as has been observed numerously elsewhere, that there is strong evidence of a power law in underlying time series for packet departure times over the measurement interval, as measured using tcpdump. In particular it is clear that the inter-event times (Fig. 2) are distinctly non-exponential as evidenced in the figure. Rather, they have two humps corresponding to the

Modelling the traffic

In an attempt to model the observed traffic we now present a simulation of a single server queue where jobs arrive according to a Poisson process and where the service requirement is distributed according to a (truncated) Cauchy distribution. The server itself removes work from the queue in blocks (Ethernet frames) and waits after each frame for a short period (inter-frame gap). The blocks are all of the same size, i.e. we only have frames of one size. This very simple model should reflect some

Conclusions

The main contributions of this paper can be summarised as follows:

  • /proc/net/dev has been proposed as an effective and efficient alternative to tcpdump for monitoring network traffic. This was supported by comparing observations made using both methods.

  • The results of measurements taken from three locations on a state-of-the-art switched Ethernet have been investigated. These are publicly available via the world-wide web.

  • Measured traffic at these locations was shown to fit closely various

Acknowledgements

The authors would like to thank the Computer Support Group in helping with the data capture. We would also like to thank Jörn Davidsen of the Chemical Physics Theory Group (Department of Chemistry, University of Toronto) for fruitful discussions on self-similarity and criticality, and Will Knottenbelt and David Thornley for stimulating conversations. The research was funded by EPSRC (research grant QUAINT, GR/M80826).

References (34)

  • T. Huisinga et al.

    A microscopic model for packet transport in the internet

    Physica A

    (2001)
  • B. Pilgram et al.

    A comparison of estimators of 1/f noise

    Physica D

    (1998)
  • W.E. Leland, M.S. Taqq, W. Willinger, D.V. Wilson, On the self-similar nature of Ethernet traffic, in: D.P. Sidhu...
  • A. Erramilli et al.

    Experimental queueing analysis with long-range dependent packet traffic

    IEEE/ACM Trans. Network

    (1996)
  • G. Irlam, Unix file size survey,...
  • M. Crovella, A. Bestavros, Self-similarity in world wide web traffic: evidence and possible causes, in: Proceedings of...
  • K. Fukuda, H. Takayasu, M. Takayasu, Origin of Critical Behaviour in Ethernet Traffic,...
  • A. Veres et al.

    The chaotic nature of TCP congestion control

  • H.-P. Schwefel

    Behavior of TCP-like elastic traffic at a buffered bottleneck router

  • B. Sikdar, K. Vastola, The effect of tcp on the selfsimilarity of network traffic, in: Proceedings of the 35th...
  • D. Newman, N.D. Sizemore, B. Carreras, V. Lynch, Growth and propagation of disturbances in a communication network...
  • A.B. Downey

    The structural cause of file size distributions

  • R.N. Mantegna, H.E. Stanley, An Introduction to Econophysics, Cambridge University Press, Cambridge,...
  • J. Voit, The Statistical Mechanics of Financial Market, Springer, Berlin,...
  • W. Willinger, M. Taqqu, A. Erramilli, A bibliographical guide to self-similar traffic and performance modeling for...
  • S. Borst, O. Boxma, R. Nunez Queija, Heavy tails: the effect of the service discipline, in: Proceedings of the...
  • Tcpdump, website,...
  • Cited by (22)

    • Development of the convolutions of truncated normal random variables with three different quality characteristics in engineering applications

      2016, Computers and Industrial Engineering
      Citation Excerpt :

      Lipow, Mantel, and Wilkinson (1964) further developed the probability functions of convolutions of standard normal random variables and extended this concept to left truncated normal random variables. As for a single truncation, Field, Harder, and Harrison (2004) studied truncated distributions associated with the measurement of traffic from different locations in relation to high-performance Ethernet and data security, respectively. More recently, Flecher, Allard, and Naveau (2010) examined an expression of the moments based on a truncated skew normal distribution.

    • Correlated dynamics in human printing behavior

      2006, Physica A: Statistical Mechanics and its Applications
    • Electromagnetic Energy: Noise and Uncertainty

      2018, Geophysical Monograph Series
    • Stabilization of a high performance cluster model

      2014, International Congress on Ultra Modern Telecommunications and Control Systems and Workshops
    View all citing articles on Scopus
    View full text