Network traffic behaviour in switched Ethernet systems
Section snippets
Introduction and related work
In preparation for the building of performance models for network performance we have been measuring and analysing network traffic at various parts of an academic departmental network, specifically the Computing Department of Imperial College London. The motivation is to provide a better understanding of networking issues and to provide a body of data that can be used to validate future models of networks and network traffic.
Like many earlier papers [1], [2], [3], [4], [5], [6], [7], [8], [9],
Data capture
For this paper network traffic data has been collected by two methods, firstly by using tcpdump which allows to monitor each individual packet, secondly by using information recorded by the Linux kernel in /proc/net/dev, which provides packet and byte counts.
The tcpdump program [16] operates by attaching itself to the network socket in the Linux kernel. It provides a copy of each network packet that passes through the network interface in the kernel. We have used this to look at every Ethernet
Network architecture and monitoring
For this study we investigated the traffic in our departmental network which is a switched Ethernet. The architecture of the network highlighting the three parts that we studied is in Fig. 1. We chose to monitor the connection to the outside, an arbitrary CPU server (MOA) and the departmental webserver, used both for the internal and the external webservices.
The Internet connection of the department is provided by a Black Diamond router from Extreme Networks [18]. The Black Diamond is used as
Analysis methods
The packet departures and arrivals investigated in this paper are described by point processes with events happening at time ti ∈ , i ∈ I ⊆ . Assume that we observe n ∈ events during one observation period, the first happening at t1 and the last at tn. The observation itself may start at t0 and end at tn+1. So, the observation period can be defined as the interval T = [t0,tn+1] ⊂ with t0 < t1 < … < tn ≤ tn+1 and the length . The inter-event times, Δti, 1 ≤ i ≤ n − 1, are defined
Measurements
We begin with a routine analysis of the outgoing traffic at the Black Diamond router. We expect no surprises here and find, as has been observed numerously elsewhere, that there is strong evidence of a power law in underlying time series for packet departure times over the measurement interval, as measured using tcpdump. In particular it is clear that the inter-event times (Fig. 2) are distinctly non-exponential as evidenced in the figure. Rather, they have two humps corresponding to the
Modelling the traffic
In an attempt to model the observed traffic we now present a simulation of a single server queue where jobs arrive according to a Poisson process and where the service requirement is distributed according to a (truncated) Cauchy distribution. The server itself removes work from the queue in blocks (Ethernet frames) and waits after each frame for a short period (inter-frame gap). The blocks are all of the same size, i.e. we only have frames of one size. This very simple model should reflect some
Conclusions
The main contributions of this paper can be summarised as follows:
- •
/proc/net/dev has been proposed as an effective and efficient alternative to tcpdump for monitoring network traffic. This was supported by comparing observations made using both methods.
- •
The results of measurements taken from three locations on a state-of-the-art switched Ethernet have been investigated. These are publicly available via the world-wide web.
- •
Measured traffic at these locations was shown to fit closely various
Acknowledgements
The authors would like to thank the Computer Support Group in helping with the data capture. We would also like to thank Jörn Davidsen of the Chemical Physics Theory Group (Department of Chemistry, University of Toronto) for fruitful discussions on self-similarity and criticality, and Will Knottenbelt and David Thornley for stimulating conversations. The research was funded by EPSRC (research grant QUAINT, GR/M80826).
References (34)
- et al.
A microscopic model for packet transport in the internet
Physica A
(2001) - et al.
A comparison of estimators of 1/f noise
Physica D
(1998) - W.E. Leland, M.S. Taqq, W. Willinger, D.V. Wilson, On the self-similar nature of Ethernet traffic, in: D.P. Sidhu...
- et al.
Experimental queueing analysis with long-range dependent packet traffic
IEEE/ACM Trans. Network
(1996) - G. Irlam, Unix file size survey,...
- M. Crovella, A. Bestavros, Self-similarity in world wide web traffic: evidence and possible causes, in: Proceedings of...
- K. Fukuda, H. Takayasu, M. Takayasu, Origin of Critical Behaviour in Ethernet Traffic,...
- et al.
The chaotic nature of TCP congestion control
Behavior of TCP-like elastic traffic at a buffered bottleneck router
- B. Sikdar, K. Vastola, The effect of tcp on the selfsimilarity of network traffic, in: Proceedings of the 35th...
The structural cause of file size distributions
Cited by (22)
Development of the convolutions of truncated normal random variables with three different quality characteristics in engineering applications
2016, Computers and Industrial EngineeringCitation Excerpt :Lipow, Mantel, and Wilkinson (1964) further developed the probability functions of convolutions of standard normal random variables and extended this concept to left truncated normal random variables. As for a single truncation, Field, Harder, and Harrison (2004) studied truncated distributions associated with the measurement of traffic from different locations in relation to high-performance Ethernet and data security, respectively. More recently, Flecher, Allard, and Naveau (2010) examined an expression of the moments based on a truncated skew normal distribution.
Correlated dynamics in human printing behavior
2006, Physica A: Statistical Mechanics and its ApplicationsElectromagnetic Energy: Noise and Uncertainty
2018, Geophysical Monograph SeriesA delay reliability estimation method for avionics full duplex switched ethernet based on stochastic network calculus
2015, Eksploatacja i NiezawodnoscStabilization of a high performance cluster model
2014, International Congress on Ultra Modern Telecommunications and Control Systems and WorkshopsAbnormal network behavior analysis system based on traffic monitoring
2014, Applied Mechanics and Materials