A simulation study of IP switching
SIGCOMM '97 Proceedings of the ACM SIGCOMM '97 conference on Applications, technologies, architectures, and protocols for computer communication
IEEE/ACM Transactions on Networking (TON)
Efficient policies for carrying Web traffic over flow-switched networks
IEEE/ACM Transactions on Networking (TON)
Deriving traffic demands for operational IP networks: methodology and experience
Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Connection-level analysis and modeling of network traffic
IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites
Proceedings of the 11th international conference on World Wide Web
SNMP,SNMPV2,Snmpv3,and RMON 1 and 2
SNMP,SNMPV2,Snmpv3,and RMON 1 and 2
On the characteristics and origins of internet flow rates
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
New directions in traffic measurement and accounting
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
A flow-based model for internet backbone traffic
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
NetFlow: information loss or win?
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
A pragmatic definition of elephants in internet backbone traffic
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Observed structure of addresses in IP traffic
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
The War between Mice and Elephants
ICNP '01 Proceedings of the Ninth International Conference on Network Protocols
A parameterizable methodology for Internet traffic flow profiling
IEEE Journal on Selected Areas in Communications
Wide-area Internet traffic patterns and characteristics
IEEE Network: The Magazine of Global Internetworking
Dynamic rule-ordering optimization for high-speed firewall filtering
ASIACCS '06 Proceedings of the 2006 ACM Symposium on Information, computer and communications security
Traffic-Adaptive Packet Filtering of Denial of Service Attacks
WOWMOM '06 Proceedings of the 2006 International Symposium on on World of Wireless, Mobile and Multimedia Networks
Impact of packet sampling on anomaly detection metrics
Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Building a time machine for efficient recording and retrieval of high-volume network traffic
IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
Passive measurement of one-way and two-way flow lifetimes
ACM SIGCOMM Computer Communication Review
REPLEX: dynamic traffic engineering based on wardrop routing policies
CoNEXT '06 Proceedings of the 2006 ACM CoNEXT conference
CSAMP: a system for network-wide flow monitoring
NSDI'08 Proceedings of the 5th USENIX Symposium on Networked Systems Design and Implementation
Enriching network security analysis with time travel
Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Uncovering Artifacts of Flow Measurement Tools
PAM '09 Proceedings of the 10th International Conference on Passive and Active Network Measurement
A Statistical Analysis of Network Parameters for the Self-management of Lambda-Connections
AIMS '09 Proceedings of the 3rd International Conference on Autonomous Infrastructure, Management and Security: Scalability of Networks and Services
Self-management of hybrid networks: can we trust NetFlow data?
IM'09 Proceedings of the 11th IFIP/IEEE international conference on Symposium on Integrated Network Management
Fast classification and estimation of internet traffic flows
PAM'07 Proceedings of the 8th international conference on Passive and active network measurement
Offloading IP flows onto lambda-connections
DSOM'07 Proceedings of the Distributed systems: operations and management 18th IFIP/IEEE international conference on Managing virtualization of networks and services
ASTUTE: detecting a different class of traffic anomalies
Proceedings of the ACM SIGCOMM 2010 conference
A traffic-aware top-N firewall ruleset approximation algorithm
Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
Proceedings of the 6th International COnference
Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference
Leveraging Zipf's law for traffic offloading
ACM SIGCOMM Computer Communication Review
| Hi-index | 0.00 |
We focus in this paper on Internet flows, consider their contributions to the overall traffic per time unit or bin, and perform a multi-scale and multi-protocol analysis to explore the persistency properties of those flows that contribute the most (also known as "heavy hitters" or "elephants"). Knowing the persistency features (or a lack thereof) of the heavy hitters and understanding their underlying causes is crucial when developing traffic engineering tools that focus primarily on optimizing system performance for elephant flows.The main difficulty when studying the persistency properties of flows is that the available measurements are either too fine-grained to perform large-scale studies (i.e., packet-level traces) or too coarse-grained to extract the detailed information necessary for the purpose at hand (i.e., Netflow traces, SNMP). We deal with this problem by assuming that flows have constant throughput through their lifetime. We then check the validity of this assumption by comparing our Netflow-derived findings against those obtained from directly studying the corresponding detailed packet-level traces. By considering different time aggregations (e.g., bin sizes between 1--10 minutes) and flow abstractions (e.g., raw IP flows, pre-fix flows), varying the definition of what constitutes an "elephant", and slicing by different protocols and applications, we present a methodology for studying persistency aspects exhibited by Internet flows. For example, we find that raw IP flows that are elephant flows for at least once (i.e., one bin or time unit) in their lifetimes tend to show a remarkable persistence to be elephants for much of their lifetimes, but certain aggregate flows exhibit more intricate persistency properties.