phd student: ana novak supervisors: prof peter taylor & dr darryl veitch active probing using...

PhD Student: Ana Novak

Supervisors: Prof Peter Taylor & Dr Darryl Veitch

Active Probing

Using Packet-Pair Probing to Estimate Packet Size and Packet Arrival Rate

Department of Mathematics & Statistics

Melbourne University

IntroductionConcept of a Packet

NAME: Billy Bob

EMAIL: [email protected]

MESSAGE: How are you today Sarah Jo?

Billy Bob Sarah Jo

NAME: Billy Bob


NAME: Billy Bob



Billy Bob Sarah Jo

NAME: Billy Bob

DEPO

NAME: Billy Bob


Billy Bob Sarah Jo

DEPO


EMAIL: billybob@..


NAME: Billy Bob




Billy Bob Sarah Jo

DEPO

MESSAGEHow are ...


NAME: Billy Bob


MESSAGE: How are yo today Sara


Fundamental Approaches to Measurement

Passive measurement Monitoring Typically at a point Non-invasive Network authority

Active measurement Injecting artificial traffic stream End-to-End Fundamentally invasive Non-privileged users

Active Probing Infrastructure

Time stamp; Packet header; Packet contentRaw information captured:

Timestamps

Sender Monitor timestamps probe arrivals to the network. Receiver Monitor timestamps probe departures from the network.

Sender Receiver

Sender Monitor: Receiver Monitor:

Timestamps

As the clocks on the sender and receiver monitors may not be

synchronized we use inter-arrival and inter-departure times, rather

then the end-to-end delays.

Description of the 1-hop system Service is offered in a FIFO order. The server processes at rate .

Single Hop Model

Probe Traffic & Cross Traffic

Definitions:

Probe Traffic (PT) is an artificial stream of traffic, all of whose properties are known and

can be modified and controlled.

Cross Traffic (CT) is any traffic in the Internet that is not Probe Traffic.

Types of CT Arrivals

Single Channel (M/D/1 output)

Multi Channel (Poisson)

Packet-PairPairs of probes are sent periodically with period

T, intra-pair spacing r and packet service time xp.

Types of Probe Traffic

Lets construct the following experiment: Inject a packet-pair probe stream into the network s.t. probes are

“back-to-back” and , where xc is the CT service time.

Output of the experiment Probes capture 1 or 0 CT packets.

Estimating Cross Traffic Size


Cross Traffic packet size estimate:

where is the i-th inter-departure time, is the probe service time and is the link rate.

Estimating Cross Traffic Size


To Summarize:

Estimating CT SizeExample

Cross Traffic sizes: 100B, 500B, 1000B, 1500B Respective arrival rates: 600pkt/s, 100pkt/s, 300pkt/s, 800pkt/s Other parameters: Link rate: 2MBps; Cross Traffic packet size: 1000B;

Probes packet size: 40B; Probe rate: 10pkt/s; Probe separation: 10ms


Estimating CT SizeExample

Cross Traffic sizes: 100B, 500B, 1000B, 1500B Respective arrival rates: 600pkt/s, 100pkt/s, 300pkt/s, 800pkt/s Other parameters: Link rate: 2MBps; Cross Traffic packet size: 1000B;

Probes packet size: 40B; Probe rate: 10pkt/s; Probe separation: 0.0001s

100 500 1000 1500


Method 1: Back-to-back probes {M/D/1}

Method 2: Back-to-back probes {Poisson}

Method 3: Not back-to-back probes {Poisson}

Estimating CT Arrival Rate(Assumption: Single CT size)

Incentive: Exploit the same probe stream used for estimating Cross Traffic size.

Recap. Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times)

Recap. Outcome: Array of inter-departure times corresponding to catching 1 CT packet (success) or 0 CT packets (failure).

Model: Numerical outcome of the experiment is a r.v. Y with a Binomial distribution, B(n,p)

Method 1: Back-to-back probes


Cross Traffic arrival rate estimate in [pkt/s]:

For large values of n, if experimental value of Y is y, the 95.4% confidence interval for arrival rate estimate is:





xc=0.9

Predicted confidence interval

Example

• xc = 0.9ms

• CT a.r. = 1000 pkt/s

• n = 1000 p-p

• best c.i = +/- 10%

Mathematical Incentive: Rectify the problem of obtaining very low probabilities of packet capture, which result in a large confidence interval for arrival rate estimate (eliminate the upper bound ).

Physical Incentive: CT Traffic can be better approximated with a multi-channel (Poisson) arrivals.

Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times).



Model: Numerical outcome of the experiment is a r.v. Y with a Poisson distribution, .



Outcome: Array of inter-departure times corresponding to capturing m packets in an interval of length r.


The probability of capturing m packets in an interval of length r:

The sample average is the MLE of

where



Respective exact 95% confidence interval is:

where is the inverse of the chi-square cumulative distribution function.




Predicted confidence interval

Example

• xc = 0.01s

• CT a.r. = 1000 pkt/s

• n = 1000 p-p

• best c.i = +/- 1%

Incentive: Reduce invasiveness. In a multi-hop this is the inevitable effect.

Experiment: Inject a stream of n probe-pairs into the network with intra-pair separation r, such that we can capture at least k=ceil(r/xc) CT packets (i.e. array of inter-arrival times).

Outcome: Array of inter-departure times, of which some correspond to capturing m packets in an interval of length r.

Model: It will become apparent later…

Method 3: Not back-to-back probes


Busy and Idle Periods

System passes through alternating cycles of busy and idle periods. Busy period is when queue is never empty. Idle period is when queue is always empty.

Why do we care about busy and idle periods?

If the probes share the same busy period the inter-departure times let us know how many packets arrived in time interval r.

If probes are in different busy periods then the inter-departure times don’t give us any conclusive information.

If two probes within a packet-pair:

Peaks vs. Noise

Share the same busy period then the corresponding inter-departure time will contribute to a formation of a peak .

Don’t share the same busy period then the corresponding inter-departure time will contribute to a formation of noise .

As it stands, it looks like we could model the numerical outcomes from the set B as a Poisson distribution. But, that is not quite true. Why?

Set of all measured inter-departure times

A

Inter-departure times which are a result of probes sharing the same busy period (i.e. peaks)

B

Filtering-out noise

Problem: If then one of the following happened:



First probe saw the busy period and was delayed, as a result we caught an integer number of packets.

We cannot tell from the inter-departure time that 4 consecutive packets have arrived.

Therefore if probes are not back-to-back then the outcome that two probe-packets occur in the same busy period is dependent on how many packets were caught.



If a number of CT packets we caught is greater then k, then the two probe packets must necessarily be in the same busy period.

The converse does not hold.

Conclusion: If an inter-departure time , then we filter it out.



Set of all measured inter-departure times

A

Inter-departure times which are a result of probes sharing the same busy period (i.e. peaks)

BC

Inter-departure times which are a result of probes sharing the same busy period and are greater then r.


Probability of capturing k CT packets in the interval of length r if we exclude the events of capturing {0,1,…,m} CT packets is:


Model: Numerical outcome of the filtered experiment is a r.v. Y with a Truncated-Poisson distribution.


The mean is :

The second moment is:

The variance is:


Mixed Truncated Poisson Distribution

After each filtration, number of valid experiments (i.e. successful probe-pairs) reduces.

Can we preserve the valid data i.e. ? Yes. The answer is the Mixed Truncated Poisson Distribution .

where and is the weight of the i-th factor.


Complete the algorithm for finding an optimal intra-pair separation.

Extend Methods for the traffic that comprises of multiple CT sizes.

Find the exact distribution for the Method 3.

Use Takacs integrodifferential equation to determine if probes are in the same busy period for an M/G/1 queue (continuous case).

Solve the problem for a multiple hop case.

Future Work

phd student: ana novak supervisors: prof peter taylor & dr darryl veitch active probing using...

Documents