A Real-Time Packet Burst Metric

TERENA Networking Conference 2004

Klaus MochalskiComputer Science DepartmentUniversity of Leipzig, GermanyJörg MicheelNLANR Measurement and Network Analysis GroupSan Diego Supercomputer CenterUniversity of California San Diego, USA

Objective and Motivation

QoS-aware measurement of network link utilization

• on a small time scale

• with respect to different traffic profiles (burstiness)

• to provide useful data to network operatorsfor troubleshooting and resource planning

• to provide a more meaningful alternative toaverage utilization values

Think of a network speedometer

Current Practice

coarse averages are collected and exported by routers

• meaning of averages depends on the interval being used

• common intervals on the order of minutes hide traffic characteristics

• packet level time scale: a link is either idle or busy

What to measure?

Proactive approach:How much bandwidth is available for additional traffic of a certain profile?

Reactive approach:What happens to my packets?

Delay, Jitter caused by long router queues which in turn are caused by and cause

packet bursts

If we know all about bursts, then we know all about the traffic and the router’s problems.

Each Packet Needs its Gap

Proactive:• (potential) traffic needs idle intervals (gaps)

Reactive:• gaps are the opposite of bursts

characterize their distribution in a meaningful way

Problem: there are as many gaps as packets

aggregation and visualization

Aggregation and Visualization: Histograms

... of gap lengths• calculated over short intervals (1 second)

provide a lot of information about traffic profile

Problem:• How to visualize progression of time?

Solution:• 3-D plots poor readability

unsuitable for real-time measurements

• display sequence of histograms (movie)

University of LeipzigInternet access link18.02.2004 14:00

black: relative number of gaps

blue: cumulated number of gaps (CDF)

Live Snapshot

compare the information density with a single average per second!

3-D Offline Visualization

two similarly loaded links• University of Erlangen, Germany vs.

National Center of Atmospheric Research, Boulder, CO, USA

• NCAR is a lot more bursty!!!

Comparison Example

Example: A Busy Link

gaps become shorter scale gap axis

Future work

•How does a curve correspond to the current QoS?• What was the delay at the upstream router?

• What is the expected jitter of my VoIP traffic?

•How does a curve describe the available bandwidth?

• How many VoIP connections still fit in?

•What is the best way to capture long-term trends?• use floor and cap curves for ressource planning

•What about intrusion detection?• use the histogram shape as a fingerprint

Thank you!