On the Multi-Scale Behavior of Packet Size
Distribution in Internet Backbone Network
Seongjin Lee† Youjip Won† and Dong-Joon Shin‡
Department of Electronics and Computer Engineering
Hanyang University, Seoul, Korea
Email: {james | yjwon}@ece.hanyang.ac.kr†, and [email protected]‡
Abstract—It is critical to adapt clear and representative real
world traffic properties as groundwork for the contemporary
and emergent future Internet workload generation. Byte count
process and packet count process have been regarded as two
prominent manifestations of the underlying characteristics of
the network traffic. The long-range dependent property of these
processes is already widely known. However, inter-relationship
between the two processes remains to be discovered. The objective
of this work is to investigate packet size aspects of network
traffic that are yet to be discovered. This paper introduces
bandwidth frequency distribution as an approach to analyze
the traffic. It first focuses on Hurst parameter as a means to
assess self-similarity. Then, it introduces bandwidth frequency
histogram and analyzes the distribution. As a result of analyzing
the bandwidth frequency histogram, the observed bandwidth
frequency distribution is decided by aggregation of the bandwidth
behavior of five packet size distributions. It is found that packet
interval distribution is well fitted with Gaussian distribution.
I. I NTRODUCTION
Understanding the behavior of the backbone network is
crucial in discussing bandwidth provisioning, queue modeling,
H/W stress tests and web workload generator. One way to
approach such work is to consider traffic as byte count
process and packet count process, as they are regarded as two
prominent manifestations of the underlying characteristics of
the network traffic. Design models to date have categorized
network traffic either in time series domain, where size and
inter-arrival time are the valuable artifacts, or in multi fractal domain, where self-similarity is the key issue. In fact,
understanding the self-similarity in the Internet traffic have
been an enduring work for many years since Leland et al.
[4] have published detailed analysis on self-similar nature of
ethernet traffic in the aspect of network traffic’s underlying
mathematical and statistical properties.
Packet traces from OC3 link on one of the Exchange Point
(IX) of Korea was captured to analyze and infer the behavior
of Internet backbone network. Hardware similar to OC3MON
[3] was used which was installed on OC3 link within nodes
on the backbone network. It was able to grasp the packet
trace with 0.1 μsec time stamp granularity from Oct. 28th ,
2004 to Nov. 4th , 2004, which was a week’s data with full
header information and payload without sampling. Traffic trace
consists of full 24 hours and 7 days period with few hours on
Oct. 28th and Nov. 4th . The captured packet trace consisted
of ingress and egress traffics from the link which goes in and
out of the country. Bandwidth of the link was 155 M bits/sec,
TABLE I
S TATISTICS ON THE T RACE
Date
29-Oct
30-Oct
31-Oct
1-Nov
2-Nov
3-Nov
Count
868,256,867
854,981,870
911,337,778
832,506,999
798,514,823
827,683,801
Volume(Gbyte)
255
238
217
238
243
236
Avg(byte)
315
298
255
307
327
307
Var(byte)
293329
272029
233845
280765
292777
272760
which used about 30% of its total available bandwidth. Ingress
traffic for a day was 237 Gbytes on average, and the average
of observed packet count was 838 million per day. A detailed
description on the number of packet counts, volume of traffic
per day, average byte size and variance of the byte size are on
Table I.
This work focuses on finding characteristics of empirical
traffic data in the aspect of bandwidth frequency histogram.
Before exposing its clandestine structure, it seems relevant
to be acquainted with the Fig. 1 because it holds the key
to reveal packet size distribution in the traffic. Fig. 1 does
seem complex while it clearly demonstrates non-Gaussian
distribution [1]. This phenomenon served as our motivational
background and this paper seeks to analyze the characteristics
of such behavior. To understand the characteristics of the
traffic, it follows similar approach as Fraleigh et al. [1]. To
compute bandwidth frequency histogram at time scale t, the
traffic trace measurement are divided into non-overlapping
segments of size t. Then, gather the account information of
the sum of all packets within each of these blocks. In other
words, compute the sum of all packet sizes that arrive over
every 0.1 msec, 1 msec, and 10 msec.
The rest of the work is structured as follows. Section II
provides related works and the background information. Section III describes self similarity and Hurst parameter assessed
with traffic trace. Section IV gives analysis on the bandwidth
frequency distribution and fitting of the given distribution with
Gaussian. Section V summarizes the paper.
II. R ELATED W ORKS
Many works have attempted to provide physical explanation
of self-similarity in the traffic, and the cause of the selfsimilarity [2] [9] [10], which follows the work on Selfsimilarity in Ethernet done by Leland et al. [4]. These works
Packet Size Frequency Distribution at 07:00
R/S statistics on period 09:00
4
10000
3.5
3
Log(R(n)/S(n))
Frequency
8000
6000
4000
2.5
2
1.5
1
H = 0.6620
0.5
2000
0
0
0
0
0.5
1
1.5
2
2.5
Packet Aggregated at 1msec (byte/msec) x 104
Fig. 2.
Fig. 1. Frequency distribution of packet sizes aggregated at 1 msec at 07:00
of ingress traffic.
contradict previous assumptions that traffics follow poisson
distribution. Poisson distribution however, have not met the
real world qualification. Instead, the Internet traffics are
known to follow long-range dependent property, and has longmemory property observed in large time scales. A branch in
this line grows into estimate statistical parameters characterizing self-similarity and long-range dependency [11].
Finding traffic characteristics, self-similarities, and measuring the traffic trace [3] [7] [8] [12] are critical in understanding
the Internet. However, due to the legal issues involved in
capturing and analyzing these data for the studies, traffic
traces are not always available to perform experiments. Traffic
modeling and generation became important [5] [13] and as an
alternative way out network simulators [15] [16] [17] are used
to artificially generate the packet sequences [14].
All of the mentioned areas are closely related in the sense
that they characterize the Internet and find the ways to best
describe its behavior. To the best of our knowledge, many have
not yet delved into traffic data as distribution of aggregated
packet size frequencies.
III. O N H URST PARAMETER AND THE B EHAVIOR OF
BACKBONE T RAFFIC
Figure 2 shows R/S statistics plot for traffic trace starting at
09:00 aggregated at 1 msec. R/S stands for rescaled adjusted
range statistics and it is a method to estimate Hurst parameter
H, which determines self-similarity. Eq. 1 and Eq. 2 show how
Hurst Parameter is computed.
Wk =
n
Xi − kX(n), k = 1, 2, 3, ..., n
M ax(0, W1 ...Wn ) − M in(0, W1 ...Wn )
∼ CnH
E
E[Xi − μ]2
(1)
i=1
(2)
Wk in Eq. 1 means adjusted partial sum of given trace with
sample mean X(n) = E[Xi ]. Eq. 2 defines range in the
numerator and standard deviation of the observed sample
means is on the numerator. Expectation of R(n)/S(n) is
known to satisfy CnH asymptotically as n → ∞, where
R/S Statistics
Linear Fit
1
2
Log(n)
3
4
5
R/S statistics on time period 09:00
C stands for constant greater than zero. H parameter when
the value takes a range of 0.5 < H < 1 is known to
have long-range dependence property. We argue that even
though the Hurst-Parameter indicates backbone traffic’s selfsimilarity, internal behavior may be very different. As an
example distribution of 1 msec at 09:00 Oct. 29t h is given on
Fig. 2. The average byte size is 9584, and variance is over 26
million, and has Hurst Parameter of 0.6620. Although it is not
shown in the paper, traffic at 07:00 on the same day produced
similar value on the assessment, H = 0.6089. But traffic at
07:00 has average of 2796 and variance of 8 million.
Autocorrelation of the given traffic traces show low correlations on both traces. After 10 steps of lag, Autocorrelation
Function (ACF) reads well below 0.1. ACF not only provides
the information on correlation of the data but also allows
to assume its randomness. It means that the traffic trace is
randomly spread. Due to the space limitation, figures are not
shown in the paper. However, empirical distributions indicate
that ACF seems to show randomness through out all periods
in the trace and the Hurst parameters in the periods does not
show much relations either. More specifically similar H in the
traces had different autocorrelation structure and bandwidth
frequency. It is arguable that H-parameter alone should not be
considered representing characteristics in the traffic trace.
IV. O N C OMPREHENSION OF BANDWIDTH F REQUENCY
H ISTOGRAM AT D IFFERENT T IME S CALES
Fig. 3 shows histogram of byte sizes aggregated in given
unit time scale t, 100 μsec, 1 msec, and 10 msec. When the
average inter arrival time between the packets exceeds its time
grain, it would cause a lot of zero-sized packet. Taking account
of zero-sized packet is important, because it is statistically
reasonable to assign probability to an event where no packets
arrive in a given time scale t. In 0.1 msec there are about
40 % of zero-sized packets, thus histogram on even finer
grain would not give more information than what we have on
0.1 msec. Similarly, if t is larger than 10 msec, it hides much
information. To ensure that behavior in the Fig. 3 is consistent
throughout the different time frames and days, one hour traffic
data was used starting from 3:00, 6:00, 9:00, 12:00, 15:00,
18:00, and 21:00 to measure the frequency distributions. Table
II describes how the frequencies are distributed on average. It
6
3
x 10
Packet Size Frequency Distribution at 09:00
Packet Size Frequency Distribution at 09:00
4000
Packet Size Frequency Distribution at 09:00
400
3500
2.5
350
3000
1.5
1
2000
1500
1000
0.5
0
300
2500
Frequency
Frequency
Frequency
2
0
500 1000 1500 2000 2500 3000 3500
Packet Aggregated at 0.1msec (byte/msec)
0
0.5
1
1.5
2
2.5
Packet Aggregated at 1msec (byte/msec) x 104
3
44
12
4
52
10
0
5
10
15
20
Packet Aggregated at 10msec (byte/msec) x 104
5
48
7
(c) 10 msec distribution
Frequency distribution of packet sizes at 09:00 of ingress traffic.
TABLE II
T OP 9 PACKET S IZE D ISTRIBUTION
2
1500
13
0
(b) 1 msec distribution
Fig. 3.
1
40
31
150
50
(a) 0.1 msec distribution
Ranks
Packet
Percentile
200
100
500
0
250
6
43
4
7
126
2
8
60
1
9
576
1
indicates that top five ranks are produced by 40, 1500, 44, 52
and 48 bytes packets.
Let Ri denote the packet of ith rank and i a set of rank
numbers from 1 to k, where k is the maximum number of
ranks. Probability of arrival of R1 , on a t, non-overlapping
time segment, is greater than Ri>1 . Let’s consider the probability of an event where R1 and Ri>1 both occurred at tx ,
where x denotes segment of time in the time series. Then, the
aggregated sum will be R1 + Ri when R1 and Ri>1 arrived
at tx . Since frequency of R1 is greater than frequency of Ri ,
frequency distribution will follow the distribution of R1 .
Next, three conditions can be considered. (1) Ri is among
the top ten ranks: Ri≤10 . (2) Packet size of Ri is much greater
than Rj : |Ri | |Rj |. (3) Probability of packets in Rj is
greater than packets in Ri : P (Ri ) < P (Rj ), where j is also
a member of rank numbers from 1 to k and i = j. But, (3)
is rather a weak constraint in the condition, and it does not
have to be always true. When these conditions are met, the
frequency distribution has the similar distribution as the Ri .
Fig. 4 shows bandwidth frequency of top five distributions at
09:00. Comparing Fig. 4a in contrast to Fig. 4b shows clearly
that the gap between the peaks are filled with frequency of 44
and 52 bytes packet sizes. As different frequency distributions
are added to distribution of R1 , tail of the distribution gets
longer. It is because combination of R1 . . . Ri gives diverse
byte sizes.
Note that Fig. 4c decides the shape of the distribution at
1 msec. Making of the lobes shown in 1 msec frequency
distribution can be illustrated by adding different packet size
frequencies. Figure 4d shows that lobes are created in every
1500 bytes. This can be explained as separation of packets due
to difference in arrival time. Lobes become wider as we add the
next top rank in the histogram. Even though 1500 bytes packet
rank the second in the top five list, it is intentionally added
to the histogram at the end because it shows how they are
combined, and the gap between the peaks are filled by other
ranks. When the frequency of 1500 bytes packet is added to
the frequency distribution as in the order of the rank, it clearly
shows lower ranks fills up the peaks in between the frequency
of 1500 bytes. As different packet sizes added to the frequency
distribution, the height of the frequency distribution is reduced
and distributed. The reason that 1500 bytes packet became the
key factor is because it was largest packet sizes of all in the
top five rank and top ten rank.
Thus, behavior of 1 msec distribution can be summarized as
follows: lobes in the distribution are a mixture of distribution
of the different sized packets; shape of the distribution is
decided by M AX(packet size of Ri<10 ); the rest of the
frequency fills the gap between the peaks.
In order to find a model, in which the distribution fits in, we
used the following steps: (1) Extract frequency of all packet
sizes in the distribution, which follows a similar approach
to build up the bandwidth frequency distribution, shown in
Fig. 1. (2) Select significant contributors to the distribution,
which in this case were 40, 1500, 44, 52, and 58 bytes. These
five packets are top 5 packet sizes, and account about 70%
of the distribution. (3) Extract the frequency distribution of
Ri≤5 , from the traffic trace and build bandwidth frequency
distribution for each of the packet sizes. (4) Extract frequency
distribution of R1,...,5 in the order of the rank; Design a
model for distribution of R1,2 , then for R1,...,3 , until all 5
ranks are combined. Due to space limitation, figures that
show frequency distribution of each top five rank fitted with
Gaussian distribution have been omitted. Although some of
the work in the field have modeled the interval distribution
using Pareto distribution [5], M/G/∞ [6], it shows that each
distribution follows Gaussian distribution.
The distributions was well fitted with G(x) on the distribution of 40 bytes with parameters μ = 129.9 and σ 2 = 3969,
where G(x) is the Gaussian function given as
G(x) =
−(x−μ)2
1
√ e 2σ2
σ 2π
(3)
MSE for the fit is 0.004794, and confidence bound is 95%. The
rest of the ranks from the step three also follows the Gaussian
4
3
2.5
2.5
2
2
1.5
1
Frequency Distribution of
40, 44, and 52 bytes Packet
5
5
x 10
Frequency Distribution of
1500 bytes Packet
3
1.5
2
3
2
400
600
bytes/msec
800
(a) 40 bytes packets
1000
0
1.5
1
1
0.5
0.5
200
Frequency Distribution of
4
x 10 40, 44, 52, 60 and 1500 bytes Packet
2.5
4
1
0.5
0
0
x 10
Frequency
Frequency Distribution of
40 bytes Packet
Frequency
Frequency
x 10
Frequency
5
3
0
200
400
600
bytes/msec
800
1000
(b) 40, 44 and 52 bytes packets
Fig. 4.
0
0
0.5
V. C ONCLUSION
There are numerous different ways to analyze the traffic
data. Much of the work in the field have aimed to resolve
the problems in characterizing the traffic data with time-series
process. It is a well- known fact that the Internet traffic,
although seemingly uncorrelated, has a self-similar property
and have a long range dependency property. In this work, we
argued that even though time-series does show self-similar
property, it may have very different internal characteristics.
The traffic trace was self-similar but their characteristics were
very different. Bandwidth histogram was main method to find
its difference in internal characteristics. Next, it focused on the
behavior of bandwidth frequency behavior at 1 msec and what
it is composed of. Complex-looking behavior demonstrated a
rather simple structure. This paper pointed out that the shape of
the histogram is governed by frequency distribution of major
packet in the traffic trace. Only two of the major packets
already distinguished the shape of the distribution. With more
top ranks added to the distribution, it becomes similar to the
distribution with all the bandwidth. And each individual of the
frequency of the packet sizes can be modeled with Gaussian
distribution, which is made up of two simple parameters μ and
σ. Having to deal with only five distribution in the given traffic
trace give much benefit. Computation power and time spend to
gather information on all packet sizes can be greatly reduced.
As a future work it leaves interesting and rather important
issue; designing a framework to generate the distribution with
less information.
ACKNOWLEDGMENTS
Supported by KOSEF through the Statistical Research Center for Complex Systems at Seoul National University. The
authors would like to thank skilled technical support from
Soohan Ahn (Univ. of Seoul, Seoul, Korea).
R EFERENCES
[1] C. Fraleigh, F. Tobagi, and C. Diot, Provisioning IP Backbone Networks
to Support Latency Sensitive Traffic, In Proc. of IEEE INFOCOM’03,
San Francisco, CA, USA vol. 1, pp. 375–385 Mar. 2003.
1.5
(c) 1500 bytes packets
Top five packet sizes on Oct.
distribution. Normal distribution with μ = 227 and σ = 293
covers the distribution of top 4 distributions on Fig 4b.
1
bytes/msec
29th
2
4
x 10
0
0
0.5
1
bytes/msec
1.5
2
4
x 10
(d) 40, 44, 52, 60 and 1500 bytes packets
at 9:00.
[2] M. Gospodinov and E. Gospodinova, The graphical methods for estimating Hurst parameter of self-similar network traffic,
In Proc. of
International Conference on Computer Systems and Technologies, pp.
III-B-19, Jun. 2005.
[3] K. Thompson, G. J. Miller, and R. Wilder, Wide-area Internet Traffic
Pattern and Characteristics, IEEE Network, vol. 11, no. 6, pp. 10–23,
Nov. 1997.
[4] W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson, On the SelfSimilar Nature of Ethernet Traffic, Proc. SIGCOM93, San Francisco,
California, vol. 2, pp. 183–193. Feb. 1994.
[5] J. Sommers, H. Kim, and P. Barford, Harpoon: A Flow-Level Traffic
Generator for Router and Network Tests, White Paper, Spirent Communications, http://www.spirentcom.com/, Wisconsin Advanced Internet
Lab. 2004
[6] T. D. Neame, M. Zukerman, and R. G. Addie, Application of the M/Pareto
Process to Modeling Broadband Traffic Streams,
IEEE ICON99, pp.
53–58, Sept. 1999.
[7] K. Cho, K. Fukuda, H. Esaki, and A. Kato, The Impact and Implication
of the Growth in Residential User-to-User Traffic,
SIGCOMM ’06:
Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications, pp. 207–218, Pisa,
Italy Sept. 2006.
[8] C. Fraleigh,S. Moon, B. Lyles, C. Cotton, M. Khan, D. Moll, R. Rockwell,
T. Seely, and C. Diot, Packet-level traffic measurements from the Sprint
IP backbone, Network, IEEE , vol.17, no.6, pp. 6–16, Nov.-Dec. 2003
[9] W. Willinger, M. Taqqu, R. Sherman, and D. Wilson, Self-similarity
through high variability: statistical analysis of Ethernet LAN traffic at
the source level, In ACM Sigcomm ’95, pp. 100–113, 1995.
[10] M. E. Crovella and A. Bestavros, Self-similarity in world wide web
traffic evidence and possible causes,
In Proceedings of the ACM
SIGMETRICS 96, pages 160–169, Philadelphia, PA, May 1996.
[11] S. Bregni, and L. Jmoda,Improved Estimation of the Hurst Parameter of
Long-Range Dependent Traffic Using the Modified Hadamard Variance,
Communications, 2006. ICC ’06. IEEE International Conference on ,
vol.2, pp.566–572, June 2006.
[12] S. Jaiswal, G. Iannaccone, C. Diot, J. Kurose, D. Towsley, Inferring TCP
connection characteristics through passive measurements, INFOCOM
2004. Twenty-third AnnualJoint Conference of the IEEE Computer and
Communications Societies, vol.3, no., pp. 1582–1592 vol.3, March 2004.
[13] P. Barford, and M. Crovella, Generating representative Web workloads
for network and server performance evaluation,
SIGMETRICS
’98/PERFORMANCE ’98: Proceedings of the 1998 ACM SIGMETRICS
joint international conference on Measurement and modeling of computer
systems. pp. 151–160,Madison, Wisconsin, United States, 1998.
[14] Michele C. Weigle, Prashanth Adurthi, Felix Hernandez-Campos Kevin
Jeffay, F. Donelson Smith, Tmix: A Tool for Generating Realistic TCP
Application Workloads in ns-2, SIGCOMM Computer Communication
Reveview, pp. 65–76, 2006.
[15] NetSim http://www.tetcos.com/software.html, Tetcos
[16] Netwiser http://bitwiserlabs.com, Bitwiser Labs
[17] N2NSoft http://www.n2nsoft.com/, N2NSoft