F.D. Smith

Stochastic models for generating synthetic HTTP source traffic

New source-level models for aggregated HTTP traffic and a design for their integration with the TCP transport layer are built and validated using two large-scale collections of TCP/IP packet header traces. An implementation of the models and the design in the ns network simulator can be used to generate web traffic in network simulations

Transport and display mechanisms for multimedia conferencing across packet-switched networks

Abstract: A transport protocol that supports real-time communication ofaudio/video frames across campus-area packet switched networks is presented.It is a “best effort” protocol that attempts to ameliorate the effect of jitter, loadvariation, and packet loss, to provide low latency, synchronized audio and videocommunications. This goal is realized through four transport and displaymechanisms, and a real-time implementation of these mechanisms thatintegrates operating system services (e.g., scheduling and resource allocation,and device management) with network communication services (e.g., transportprotocols), and with application code (e.g., display routines). The fourmechanisms are: a facility for varying the synchronization between audio andvideo to achieve continuous audio in the face of jitter, a network congestionmonitoring mechanism that is used to control audio/video latency, a queueingmechanism at the sender that is used to maximize frame throughput withoutunnecessarily increasing latency, and a forward error correction mechanism fortransmitting audio frames multiple times to ameliorate the effects of packet lossin the network. The effectiveness of these techniques is demonstrated bymeasuring the performance of the protocol when transmitting audio and videoacross congested networks.Published in: Computer Networks and ISDN Systems,Vol. 26, No. 10, (July 1994) pp. 1281-1304.

Long-range dependence analysis of Internet traffic

Long-range-dependent time series are endemic in the statistical analysis of Internet traffic. The Hurst parameter provides a good summary of important self-similar scaling properties. We compare a number of different Hurst parameter estimation methods and some important variations. This is done in the context of a wide range of simulated, laboratory-generated, and real data sets. Important differences between the methods are highlighted. Deep insights are revealed on how well the laboratory data mimic the real data. Non-stationarities, which are local in time, are seen to be central issues and lead to both conceptual and practical recommendations.

A Performance Study of Loss Detection/Recovery in Real-world TCP Implementations

TCP is the dominant transport protocol used in the Internet and its performance fundamentally governs the performance of Internet applications. It is well-known that packet losses can adversely affect the connection duration of TCP connections - however, what is not fully understood is how well does the TCP design deal with losses. In this paper, we systematically evaluate the impact of design parameters associated with TCPs loss detection/recovery mechanisms on the performance of real-world TCP connections. For this, we rely on an analysis tool that partially emulates the sender-side TCP implementations of 5 prominent OSes for passively analyzing the traces of TCP connections. Our study conducts passive analysis of more than 2.8 million real Internet TCP connections. We find that the recommended as well as widely-implemented settings of TCP parameters are not optimal for a significant fraction of Internet connections.

Understanding patterns of TCP connection usage with statistical clustering

We describe a new methodology for understanding how applications use TCP to exchange data. The method is useful for characterizing TCP workloads and synthetic traffic generation. Given a packet header trace, the method automatically constructs a source-level model of the applications using TCP in a network without any a priori knowledge of which applications are actually present in a network. From this source-level model, statistical feature vectors can be defined for each TCP connection in the trace. Hierarchical cluster analysis can then be performed to identify connections that are statistically homogeneous and that are likely exerting similar demands on a network. We apply the methods to packet header traces taken from the UNC and Abilene networks and show how classes of similar connections can be automatically detected and modeled.

STOCHASTIC DIFFERENTIAL EQUATION FOR TCP WINDOW SIZE: ANALYSIS AND EXPERIMENTAL VALIDATION

In this paper we develop a stochastic differential equation to describe the dynamic evolution of the congestion window size of a single TCP session over a network. The model takes into account recovery from packet losses with both fast recovery and time-outs, boundary behavior at zero and maximum window size, and slow-start after time-outs. We solve the differential equation to derive the distribution of the window size in steady state. We compare the model predictions with the output from the NS simulator.

A Loss and Queuing-Delay Controller for Router Buffer Management

Active queue management (AQM) in routers has been proposed as a solution to some of the scalability issues associated with TCP’s pure end-to-end approach to congestion control. However, beyond congestion control, controlling queues in routers is important because unstable router queues can cause poor application performance. Existing AQM schemes explicitly try to control router queues by probabilistically dropping (or marking) packets. We argue that while controlling router queues is important, this control needs to be tempered by a consideration of the overall lossrate at the router. Solely attempting to control queue length can induce loss-rates that have as negative an effect on application and network performance as the large queues that existing AQM schemes were trying to avoid. Thus controlling queue length without regard to loss-rate can be counterproductive. In this work we demonstrate that by jointly controlling queue length and loss-rate, both network and application performance are improved. We present a novel AQM design that attempts to simultaneously optimize queue length and loss-rate. Our algorithm, called loss and queuing delay control (LQD), is a control theoretic scheme that explicitly treats loss-rate as a control parameter. LQD is shown to provide stable control analytically and is evaluated empirically by comparing its performance against other control theoretic AQM designs (PI and REM). The results of evaluation in a laboratory testbed under realistic traffic mixes and loads show that LQD results in lower overall loss rates and that applications see lower average queue lengths than with PI or REM.

Mice and Elephants Visualization of Internet Traffic

Internet traffic is composed of flows, sets of packets being transferred from one computer to another. Some visualizations for understanding the set of flows at a busy internet link are developed. These show graphically that the set of flows is dominated by a relatively few “elephants”, and a very large number of “mice”. It also becomes clear that “representative sampling” from heavy tail distributions is a challenging task.

System design for workstation-based conferencing with digital audio and video

An investigation is conducted of the use of computer technology to support collaboration among scientists and professionals. One component of this research is the construction of a distributed, real-time, digital video conferencing system on a network of high-performance workstations. A discussion is presented of the motivation for the construction of the system, and the design of operating system and network support mechanisms for real-time communication of digital audio and video streams is outlined. The authors introduce a novel paradigm of inter-process communication called the real-time producer/consumer (RTP/C) paradigm. The RTP/C paradigm provides a framework both for expressing processor-time-dependent computations and for reasoning about the real-time behavior of programs.<<ETX>>

Multi-Resolution Anomaly Detection for the internet

In the context of Internet traffic anomaly detection, we will show that some outliers in a time series can be difficult to detect at one scale while they are easy to find at another scale. In this paper, we develop an outlier detection method for a time series with long range dependence, and conclude that testing outliers at multiple time scales helps to reveal them. We present a multi-resolution anomaly detection (MRAD) procedure for detecting network anomalies. We show that the MRAD method is useful, especially when outliers appear as a slight local mean level shift with a rather long duration, e.g., as generated by a port scan. A novel MRAD outlier map is proposed to visualize the location of the outliers, and also to suggest the significance probabilities (p values) for them.