CiteSeerX — Adaptive Sampling Methods to Determine Network Traffic Statistics including the Hurst Parameter

(1)

Adaptive Sampling Methods to Determine Network Traffic Statistics including the Hurst Parameter

Jack Drobisz and Kenneth J. Christensen Department of Computer Science and Engineering

University of South Florida Tampa, FL 33620

Email: {drobisz, christen}@csee.usf.edu

Abstract

Accurate traffic characterization by packet source is needed to predict network behavior and to properly allocate network resources to achieve a desired Quality of Service for all network users. As networks have become faster, the processing load required for complete packet sampling has also grown. In some cases, for example Gigabit Ethernet, the network can deliver packets faster than a network management subsystem can process them. In order to prevent inaccurate traffic statistics due to “clipping” of traffic peaks, Claffy et al.

applied several static sampling strategies to network traffic characterization. As shown in this paper, static sampling may produce inaccurate traffic statistics. In this paper, adaptive sampling methods are developed and evaluated to address inaccuracies of static sampling. In addition, the estimation of the Hurst parameter, a measure of traffic self-similarity, is studied for static and adaptive sampling. It is shown that adaptive sampling results in a more accurate estimation of the mean, variance, and Hurst parameter for packet counts.

1. Introduction

With the advent of Gigabit Ethernet and other high- speed network technologies, direct measurement of packet-switched traffic by packet origin has become impossible unless a very fast processor is dedicated to traffic measurement. A slower, and thus less expensive, processor may be used if statistical sampling of network traffic is implemented. With sampling, not all packets are received and “measured” by a network management node, but only a selected fraction of all packets. Future high-

speed networks are likely to carry many distinct types of traffic including bulk data transfer, real-time voice and video, and playback video. Recent work (see [2] and [8]) have shown that network traffic may exhibit properties of Long-Range Dependence (LRD) or self-similarity. Self- similar traffic exhibits bursts at multiple time scales and results in greater resource requirements than if simple Poisson models are used for network capacity planning.

One measure of self-similarity is the Hurst parameter (see [8]). Being able to estimate the Hurst parameter as part of ongoing traffic measurement is important.

Statistical sampling of network traffic was first used by Claffy et al. (see [4]) in the early 1990’s for traffic measurement on the NSFNET backbone. Claffy et al.

studied classical event and time driven static sampling methods to reduce the number of packets that would need to be received and processed by a network management node. With sampling during periods of peak traffic the network management processor would not be over- utilized resulting in missed packets, or “clipped” peaks.

However, during periods of low traffic, the network management processor may have idle capacity that could be used to more accurately characterize network traffic given a finer sampling granularity. This is the key observation to our research, that static sampling may result in under-utilization of a network management processor and inaccurate traffic measurements. In addition, Claffy et al. did not characterize network traffic by packet origin and did not estimate measures of self- similarity. In this paper an adaptive sampling method is developed that will be shown to more effectively utilize network management processing capabilities and result in better estimates of traffic measures than static sampling.

The remainder of this paper is organized as follows.

Section 2 reviews static sampling methods and Section 3 reviews self-similarity. Section 4 describes the Network

(2)

Management Subsystem (NMS) which implements traffic sampling. This NMS can be implemented as part of a switch, repeater, or other network component. Section 5 describes the new adaptive sampling methods and Section 6 describes the comparative evaluation of the sampling methods. Section 7 is a summary followed by references.

2. Review of Static Sampling Methods

In the early 1990’s, the T1 NFS backbone traffic statistics collected using the NNStat collection mechanism (see [3]) were shown to occasionally result in a loss of statistical information during periods of high backbone utilization. Sampling every 50th packet resulted in a significant improvement in accuracy of statistics taken under high utilization periods [4]. In [4] Claffy et al.

describe the application of event and timed-based sampling to network traffic measurement. The three algorithms studied were, systematic, stratified random, and simple random and are shown in Figure 1. In event based or “packet triggered” sampling, packets are counted to determine when the next packet is to be sampled, whereas in timer-based sampling a “timer trigger” is used.

Time-based sampling was shown to be less accurate than event-based. Of the event-based sampling methods, all three algorithms could be used for characterizing network traffic.

Systematic sampling

Stratified random sampling

Simple random sampling

Figure 1 - Fixed granularity sampling (from [4])

3. Self Similarity of Network Traffic

The concept of self-similarity in the communications field was first introduced by Mandelbrot [9]. He proposed a fractal like model of random error perturbations that appeared to come in bursts not unlike those observed in the early hydrological data studied by

Hurst [1]. In 1994, Leland, Taqqu, Willinger and Wilson demonstrated the presence of slowly decaying packet count bursts across all time scales in traffic on an operational corporate Ethernet LAN [8]. Time series with these characteristics are considered to exhibit LRD and are termed “self similar”. Figure 2 shows event counts of Poisson and Pareto distributions for multiple time scales.

For each series, the mean number of events per second is 1000. It can be seen that the Poisson time series becomes

“smoother” as the aggregation level increases, however the Pareto series maintains its bursty appearance and is hence “self-similar” across multiple time scales.

In the past few years, several non-conventional models such as fractional Brownian motion, fractional Auto- Regressive Integrated Moving Average (ARIMA) and chaotic maps had been proposed to simulate self-similar network traffic. Recently, it was shown that a simpler model based on a Pareto distribution might be sufficient.

Gordon et al. [7] stipulated that self-similar network traffic is a consequence of power law tails in packet inter- arrival times. Based on this insight, a model based on the Pareto distribution is,

( )

^α

α

β β

x x

Pareto

= + )

( (1)

where, α and β are constants and x ranges from 0 to ∞.

This distribution can be used to generate self-similar synthetic network traffic (i.e., packet inter-arrival times).

In this work, the inverse-transform method was used to generate a continuous random variate having distribution function:

( )

α

β β₁

1

U x

Pareto⁻ =− + . (2)

The four measures considered in this study are the packet count mean, variance, peak-to-mean ratio (PMR), and Hurst parameter. The PMR is calculated by comparing the peak value with the average value from the population and it is often used as a measure of traffic burstiness, where high PMR means a high burstiness of traffic. This statistic is heavily dependent on the size of the intervals, and therefore may or may not represent the actual traffic [5]. A more accurate indicator of traffic burstiness is given by the Hurst parameter, which can be derived from the re-scaled adjusted range (R/S) statistic.

(3)

0 150 300 450 600 750 900 1050 1200 1350 1500

1 11 21 31 41 51 61 71 81 91 0

150 300 450 600 750 900 1050 1200 1350 1500

1 11 21 31 41 51 61 71 81 91

0 25 50 75 100 125 150 175 200 225 250

1 11 21 31 41 51 61 71 81 91

0 25 50 75 100 125 150 175 200 225 250

1 11 21 31 41 51 61 71 81 91

0 5 10 15 20 25 30 35 40 45 50

1 11 21 31 41 51 61 71 81 91 0

5 10 15 20 25 30 35 40 45 50

1 11 21 31 41 51 61 71 81 91

Interval packet countInterval packet countInterval packet count

Time interval (size = 1 second) Time interval (size = 1 second)

Time interval (size = 0.1 second)

Time interval (size = 0.01 second) Figure 2 - Illustration of self-similarity (Poisson with λ = 1000 versus inverse-Pareto with α = 1.1 and β = 0.0002)

The R/S statistic is one of several methods to estimate the Hurst parameter (see also [1] and [6]).

Hurst discovered that many naturally occurring time series are well represented by the relation,

( ) ( ) [

^Rⁿ ^Sⁿ

]

^cn^H

E ≈ (3)

where as n→∞ c is an integer constant and H is a Hurst parameter (0.50<H<1.0). The estimation of H values can be based on a heuristic graphical approach involving linear regression as described in [8]. The data sets resulting in H values between 0.70 and 1.0 are considered to exhibit self-similarity.

4. A Network Management Subsystem

Traffic sampling can be implemented within network devices such as repeaters, switches, routers and so on.

Such a device would contain a network management subsystem (NMS) with functionality similar to that shown in Figure 3. Existing standards such as SNMP and RMON already address collection of network management data at remote nodes. Collected network management data, including traffic statistics, are the periodically transmitted from the remote nodes to a central “network manager” host that formats and presents the data to a network administrator.

(4)

As shown in Figure 3, a hardware counter is used to count down all incoming packets and to open the processor register gate as dictated by the sampling strategy. During processing time in the CPU, the packet header is parsed and its source address is determined.

CPU memory

gate packet counter

Gigabit network

Figure 3 - Network management subsystem (NMS) The packet source is used to group the packets and it could be represented by the IP or MAC address of a machine where the traffic originated. Once the packet is processed and its source is known, it is added to the corresponding time “bucket” in the internal memory to be used in future traffic characterization by source as requested by the NMS software. Figure 4 shows the timing diagram for packet sampling. The fixed processing time of each packet is a constant t_proc. The time until the next sample should be taken is t_susp and the delay until the packet actually arrives at the gate is

twait. The total time T between two samples is:

wait susp

proc t t

t

T = + + (4)

and the CPU utilization for traffic measurements is given by:

T

U_CPU = t^proc (5)

After each packet is processed, the packet counter in the NMS is reset to a value determined by the sampling strategy. Packets may be of a variable length, but for the purpose of this study it was assumed that they take a fixed time to parse (e.g., based only on the first 64 bytes which contain the routing information used to group samples together). The gate is closed during the packet processing, or t_proc. This constant amount of time depends on the speed of the processor used as well as the number of instructions required to parse and process

the packet. During t_proc the following steps are performed:

• Receive the packet into to the NMS

• Parse the packet header and determined its source address

• Locate (e.g., via a hashing algorithm) and increment the current source counter in memory

• Compute and set the value of the packet counter

time t_proc t_susp t_wait

Packet into CPU and gate closes

Gate opens

Packet arrives and gate closes

Figure 4 - Deterministic packet sampling timing We estimate 50 to 200 lines of assembly code to perform the processing steps for a packet. In a Gigabit Ethernet, a 64-byte packet with 8 byte preamble and 12 byte interpacket gap is 672 nanoseconds in length, which equates to 1,488,095 packets per second maximum throughput. Thus, in a worst-case of 100%

network throughput with all small packets, an NMS that samples and processes all packets would require approximate 75 to 300 million instructions per second (MIPS) processing power, or greater processing power than even high-end 1998 PC and workstation processors. Even at lower network throughputs and with larger packet sizes, the amount of processing power needed for sampling and processing all packets is non- trivial.

In this study we assume a 50 MIPS processor and an optimistic 50 instructions to receive and process a packet resulting in t_proc =1 microsecond. Since the network management subsystem will perform tasks other than traffic measurement, the CPU was assumed to be available only half the time resulting in a target 50%

CPU utilization for the sampling task and up to 25% of the traffic sampled. Allocating 50% of the CPU time for the task of static traffic measurement. Since wire utilization is likely to vary greatly over time, it seems logical that a better approach would be to let the NMS sampling algorithm fully utilize the CPU within a desired limit. This is the basis of the three new adaptive sampling methods described in the next section.

(5)

5. Development of Adaptive Sampling

In [4] the developed sampling methods were use to characterize a traffic stream independent of packet origins. This greatly reduces the processing required per packet (e.g., the packet source address does not have to be parsed and counted). It is desirable to be able to characterize traffic by packet origin to be able to determine if one or many sources are contributing to a specific traffic characteristic, and which applications and hosts are identified with those characteristics.

Packet origin could be characterized by MAC address or IP address. Address pairs could also be monitored. The proposed adaptive sampling methods extend the work in [4] by adding source characterization and varying sampling granularity to control processor utilization. In this study Poisson and self-similar traffic streams are combined. Then, using sampling methods the characteristics of each stream are estimated. Figure 5 shows fixed granularity systematic sampling from [4].

counter = sampling granularity

start open gate

close gate

process packet packet ?

counter = 0?

Y

N N

t_proc Packet arrives at the gate.

Decrement the counter for each packet arriving at the gate.

Figure 5 - Systematic sampling with processing delay.

Figure 6 shows the “CPU guard” adaptive sampling method where the sampling granularity as controlled by the counter is a function of CPU utilization. If CPU utilization is low (due to a low rate of packet arrivals), the counter set value is reduced for the next sample with a limit of complete sampling (i.e., all packets are sampled). Alternatively, if the CPU utilization is above a preset desired utilization, the counter set value is increased. The actual CPU utilization is calculated by dividing the desired processing time by the average time between two samples since the beginning of the trace.

The second and third adaptive methods are partially based on the expectation that the network traffic exhibits temporal and source locality. In [6] it is observed that

most traffic peaks are preceded by warning signs of increasingly higher congestion. This decrease in the inter-arrival time rate was used to replace the CPU utilization ratio with an Interarrival time ratio to

“anticipate” the incoming “burst”. Figure 7 shows the

“IT guard” (IT = packet interarrival time) method. The last method combines the CPU and IT guard methods and is not shown in order to save space.

get actual U_CPU

start open gate

close gate

process packet

packet ? counter = 0?

Y

N N

ratio = actual U_CPU / desired U_CPU counter = sampling granularity * ratio

t_proc

Figure 6 - Adaptive sampling with “CPU guard”

get packet IT

start open gate

close gate

process packet packet ?

counter = 0?

Y

N N

ratio = LAST(IT) / AVG(IT) counter = sampling granularity * ratio

t_proc

Figure 7 - Adaptive sampling with “IT guard”

In summary, the four methods of interest are:

• Method #1 - Fixed granularity systematic sampling (Figure 5)

• Method #2 - Adaptive sampling with “CPU guard” (Figure 6)

• Method #3 - Adaptive sampling with “IT guard”

(Figure 7)

• Method #4 - Adaptive sampling with combined

“CPU guard” and “IT guard” (not shown)

(6)

1000 Packet Counts (1 millisecond each)

Name Contribution Description

Mean Variance PMR Hurst

ds01 50% Exponential distribution of 97768 Its generated over 1

second interval with λ = 97500. 97.768 99.676 1.30922 0.59306

ds02 50% Self-Similar distribution of 97279 Its generated over 1

second interval with α = 1.1 and β = 0.00000173. 97.277 4743.40 2.67278 0.74572

ds0102 100% 195045 ITs merged from ds01 and ds02. 195.05 4861.54 1.87649 0.75542

Table 1 - Population measures for experimental traffic

6. Evaluation of Adaptive Sampling

Table 1 contains a summary of the traffic data used in this study. The three data sets, ds0102, ds0304 and ds0506 each consists of an exponential and self-similar components based on 50/50, 10/90, and 90/10 percent packet contributions. The data sets were generated using Poisson and inverse-Pareto distribution as described earlier in this paper.

0 1 2 3 4 5

0 1 2 3 4

Log(des ire d granula rity)

Log(actual granularity)

m e thod 1 m e thod 2 m e thod 3 m e thod 4

-3 -2 -1 0 1 2 3

0 1 2 3 4

Log(des ired granularity)

Log(CPU utilization) m e thod 1

m e thod 2 m e thod 3 m e thod 4

Figure 8 - Evaluation of CPU utilization

The four sampling method were implemented in ANSI C with the simulated traffic input from a file. First, the CPU utilization study was performed. The graph in Figure 8 shows the behavior of the adaptive methods with respect to sampling granularity and CPU utilization based on the aggregate data set ds0102. The static sampling method maintains the same sampling granularity and the CPU utilization decreases as the desired sampling granularity increases. In contrast, the other three methods attempt to sample as much as possible within the limit set on CPU utilization.

In the second set of experiments the accuracy of the computed mean, variance, PMR, and Hurst parameter for the three data sets were conducted. The following figures show plots of the four statistics for the exponential and self-similar components of data sets ds0102 and ds0304 over increasing sampling granularity. The last two graphs summarize the percent errors. Figures 9, 10, 11, and 12 show the accuracy of the four sampling methods in estimating the mean, variance, PMR, and Hurst parameter. Figures 9 and 10 shows the estimates for the exponential and self similar components of dataset ds0102 (50% exponential and 50% Pareto), Figures 11 and 12 for dataset ds0304 (10% exponential and 90% Pareto). In all cases, the population statistic is indicated on the Y-axis with Log(0) sampling granularity (i.e., all packets are sampled). As the sampling granularity increases, the accuracy of each method deviates from the population statistic, however in all cases except for PMR, the adaptive methods (method #’s 2, 3, and 4) are more accurate than the static method (method #1). For example, for the Hurst parameter method #’s 2, 3, and 4 are all approximately equal in accuracy and all better than method #1.

(7)

8.50E+ 01 9.00E+ 01 9.50E+ 01 1.00E+ 02 1.05E+ 02

0 1 2 3 4

Log(sa m pling gra nula rity)

mean

0.00E+ 00 1.00E+ 03 2.00E+ 03 3.00E+ 03 4.00E+ 03 5.00E+ 03

0 1 2 3 4

variance

0.00E+ 00 1.00E+ 00 2.00E+ 00 3.00E+ 00 4.00E+ 00 5.00E+ 00

0 1 2 3 4

PMR

0.0 0.2 0.4 0.6 0.8 1.0 1.2

0 1 2 3 4

Hurst

Figure 9 - Exponential component of ds0102

From the graphs in Figures 9 through 12 we observe that adaptive sampling methods are better suited to estimating both Poisson and self-similar inter-arrival times under a high initial sampling granularity.

9.00E+ 01 9.50E+ 01 1.00E+ 02 1.05E+ 02 1.10E+ 02

0 1 2 3 4

mean

0.00E+ 00 1.00E+ 03 2.00E+ 03 3.00E+ 03 4.00E+ 03 5.00E+ 03 6.00E+ 03 7.00E+ 03

0 1 2 3 4

variance

0.00E+ 00 1.00E+ 00 2.00E+ 00 3.00E+ 00 4.00E+ 00 5.00E+ 00 6.00E+ 00

0 1 2 3 4

PMR

0.0 0.2 0.4 0.6 0.8 1.0 1.2

0 1 2 3 4

Hurst

Figure 10 - Self-similar component of ds0102

Resulting plots for methods using the CPU guard and IT guard are generally more consistent and more accurate than static sampling plots.

(8)

0.00E+ 00 5.00E+ 00 1.00E+ 01 1.50E+ 01 2.00E+ 01 2.50E+ 01 3.00E+ 01 3.50E+ 01

0 1 2 3 4

mean

0.00E+ 00 5.00E+ 02 1.00E+ 03 1.50E+ 03 2.00E+ 03 2.50E+ 03

0 1 2 3 4

variance

0.00E+ 00 2.00E+ 00 4.00E+ 00 6.00E+ 00 8.00E+ 00 1.00E+ 01 1.20E+ 01

0 1 2 3 4

PMR

0.0 0.2 0.4 0.6 0.8 1.0 1.2

0 1 2 3 4

Hurst

Figure 11 - Exponential component of ds0304

1.55E+ 02 1.60E+ 02 1.65E+ 02 1.70E+ 02 1.75E+ 02 1.80E+ 02

0 1 2 3 4

mean

0.00E+ 00 2.00E+ 03 4.00E+ 03 6.00E+ 03 8.00E+ 03 1.00E+ 04 1.20E+ 04 1.40E+ 04

0 1 2 3 4

variance

0.00E+ 00 5.00E-01 1.00E+ 00 1.50E+ 00 2.00E+ 00 2.50E+ 00 3.00E+ 00 3.50E+ 00

0 1 2 3 4

PMR

0.0 0.2 0.4 0.6 0.8 1.0 1.2

0 1 2 3 4

Hurst

Figure 12 - Self-similar component of ds0304

(9)

Additional graphs for data set ds0506 (90% exponential and 10% Pareto) are not shown in this paper, but show the same results as the previous graphs.

Figures 13 and 14 quantify the percentage error in the estimates versus population statistics for the three datasets, ds0102, ds0304, and ds0506. The static method (method #1) results in the highest percent error in the Hurst parameter and also higher error in variance than the adaptive methods. This could be the result of “lost”

congestion periods spread-out over a number of sampling intervals. Percentage error for the mean statistic are very low and about the same for all four methods. However, we notice that the adaptive method 3 which is based solely on the IT guard does not perform as well over the self-similar data set. The very high percentage error of the PMR statistic points out that it may not be a good indicator of traffic burstiness when sampling granularity is high. The Hurst parameter and the coefficient of variance (square root of variance divided by mean) can serve as good measures of traffic burstiness.

0 0.05 0.1 0.15 0.2 0.25 0.3 0.35

1

Average % Error method 4

method 2 method 3 method 1 method 1

method 1 method 2

method 2

method 2 method 3

method 3

method 3 method 4 method 4

method 4

Mean Variance PMR Hurst

method 1

Figure 13 - Percentage error in exponential traffic.

Variance and PMR data scaled down by 100 and 10.

0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16

1

method 1

Mean Variance PMR Hurst

Average % Error method 1 method 4

method 2 method 3 method 1 method 1 method 2

method 2

method 2 method 3

method 3

method 3 method 4 method 4

method 4

Figure 14 - Percentage error in self-similar traffic.

Variance and PMR data scaled down by 100 and 10.

7. Summary

Estimating traffic characteristics is an important task of network management of LANs. Traffic characteristics

of interest include mean, variance, peak-to-mean ratio, and Hurst parameter of packet counts. These traffic characteristics are used for capacity planning of network resources. Determining these traffic measures based on population measurements (i.e., processing of all packets) on a high-speed network, such as Gigabit Ethernet, is computationally expensive. Sampling methods can reduce the computational burden, as first demonstrated in [4] using fixed granularity sampling. The accuracy of the sample measures can be improved by extending fixed granularity sampling to adaptive sampling where the CPU utilization of the network management subsystem is set to a target, or desired, level. The adaptive sampling methods developed in this paper were shown to 1) be able to maintain a network management processor at a desired CPU utilization, and 2) generate more accurate traffic measures (especially for the Hurst parameter) than a static sampling method. Future work will address implementing the adaptive methods in existing network management systems.

References

[1] J. Beran, “Statistical Methods for Data with Long- Range Dependence”, Statistical Science, Vol. 7, No. 4., pp. 404 - 416, 1992.

[2] J. Beran, R. Sherman, and T. Murad, “Long-Range Dependence in Variable -Bit-Rate Video Traffic”, IEEE Transactions on Communications, Vol.43, pp. 1566 - 1579, 1995.

[3] R. Braden and A. Deschon, “NNStat: Internet Statistics Collection Package, Introduction and User’s Guide,” Technical Report RR-88-206, ISI, USC, 1988.

[4] K. Claffy, G. Polyzos, and H. Braum, “Application of Sampling Methodologies to Network Traffic Characterization”, Computer Communication Review, Vol. 23, No. 4, pp. 194 - 203, 1993.

[5] A. Erramilli and J. Wang, “Monitoring Packet Traffic Levels”, Proceedings of IEEE GLOBECOM, Vol. 1, pp. 274 - 280, 1994.

[6] H. Fowler and W. Leland, “Local Area Network Traffic Characteristics, with Implications for Broadband Network Congestion Management”, IEEE Journal on Selected Areas in Communications, Vol. 9, No. 7, pp. 1139 - 1149, September 1991.

(10)

[7] J. Gordon, “Pareto Process as a Model of Self- Similar Packet Traffic,” Proceedings of IEEE GLOBECOM, pp. 2232 - 2236, 1996.

[8] W. Leland, M. Taqqu, W. Willinger, and D. Wilson,

“On the Self-Similar Nature of Ethernet Traffic (Extended Version)”, IEEE ACM Transactions on Networking, Vol.2, No.1, pp. 1 - 15, February 1994.

[9] B. Mandelbrot, “Self-Similar Error Clusters in Communication Systems and the concept of Conditional Stationarity.” IEEE Transactions on Communication Technology, Vol. COM-13,

pp. 71 - 90, 1965.