On Internet backbone traffic modeling

• Authors: Chadi Barakat;Patrick Thiran;Gianluca Iannaccone;Christophe Diot
• Venue: SIGMETRICS '02 Proceedings of the 2002 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
• Year: 2002

The motivation of this work is to design a traffic model that can be used in routers or by network administrators to assist in network design and management. Currently, network operators have very basic information about the traffic. They mostly use SNMP, which provides average throughput information over 5 minutes intervals. An analytical model can provide more accurate information on the traffic such as its variation and its auto-correlation at short timescales.In contrast to other works (see [2] and the references therein), we choose to model the traffic on a link that is not congested (congestion possibly appears elsewhere in the Internet). This assumption is valid (and in fact is the rule) for backbone links that are generally over-provisioned (i.e., the network is designed so that a backbone link does not reach 50% utilization in the absence of link failure [4]). This choice is driven by our main objective, which is to provide a link dimensioning tool usable in backbone network management.We opt for a model of the traffic at the flow level. Modeling the traffic at the packet level is very difficult, since traffic on a link is the result of a high level of multiplexing of numerous flows whose behavior is strongly influenced by the transport protocol and by the application. A flow in our model is a very generic notion. It can be a TCP connection or a UDP stream (described by source and destination IP addresses, source and destination port numbers and the protocol number), or it can be a destination address prefix (e.g., destination IP address in the form a.b.0.0/16). The definition of a flow is deliberately kept general, which allows our model to be applied to different applications and to different transport mechanisms. The model can however be specified to some particular traffic types such as FTP and HTTP. By specifying the model to a certain traffic type, one must expect to obtain better results.Data flows arrive to a backbone link at random times, transport a random volume of data, and stay active for random periods. Given information on flows, our model aims to compute the total (aggregate) rate of data observed on the backbone link. We are interested in capturing the dynamics of the total data rate at short timescales (i.e., of the order of hundreds of milliseconds). This dynamics can be completely characterized using simple mathematical tools, namely the shot-noise process [3]. Our main contribution is the computation of simple expressions for important measures of backbone traffic such as its average, its variance, and its auto-correlation function. These expressions are functions of a few number of parameters that can be easily computed by a router (e.g., using a tool such as NetFlow, which provides flow information in Cisco routers).Our model can be helpful for managing and dimensioning IP backbone networks. Knowing the average and the variance of the traffic allows an ISP to provision the links of its backbone so as to avoid congestion. Congestion can be avoided at short timescales of the order of hundreds of milliseconds. The auto-correlation function of the traffic can be used to propose predictors for its future values. The prediction of the traffic has diverse applications in managing the resources of the backbone. One interesting application is the use of a short-term prediction to optimize packet routing and load balancing. Our model can also be used to assess the impact on backbone traffic of changes made in the rest of the Internet such as the addition of a new customer, a new application, or a new transport mechanism. The ISP can plan the provisioning of its backbone so as to absorb the resulting change of traffic before this change takes place.