Erdfs Cx

A Nonstationary Poisson View of Internet Traffic
Thomas Karagiannis, Mart Molle. Michalis Faloutsos
Department of Computer Science & Engineering University of California, Riverside {tkarag,mart,michalis} @cs.ucr.edu

Andre Broido
CAIDA, SDSC University of California, San Diego hroido@caida.org

Abstract-Since the identification of long-range dependence in network traffic ten years ago, itsconsistent appearance across numerous measurement studies has largely discredited Poissnnhased models. However, since that original data set was collected, both link speeds and the number of Internet-connected hosts have increased by more than three orders of magnitude. Tbns, we now revisit the Poisson assumption, hy studying a combination of h i s torical traces and new measurements obtainedfrom a major hackhone link belonging to a Tier 1 ISP. We show that unlike the older data sets, current network traffic can he well represented hy the Poisson model for suh-second time scales. At multi-second scales, we find a distinctive piecewise-linear non-stationarity, together with evidence of long-range dependence. Combining our ohservations across both time scales leads to a time-dependentPoisson Characterization of network traffic that, when viewed acrms very long time scales, exhibits the observed long-range dependence. This traffic characterization reconciliates the seemingly contradicting ohservations of Poisson and long-memory traffic characteristics. I t also seems to he in general agreement with recent theoretical models for large-scale traffic aggregation.

I. INTRODUCTIONDoes the observed long-range dependence make Poissonbased models obsolete? This is a key question for our work. During the last decade? there has been ample evidence of long-range dependence, scaling phenomena and heavy tailed distributions in various aspects of network behavior. Specifically, it has been observed that packet interarrival times are described by marginal distributions with heaviertail than that of the exponential. Furthermore, networking series such as the aggregate number of packets and bytes in time, have been shown to exhibit correlations over large time scales (i.e., long-range dependence) and self-similar scaling properties. These findings resulted in invalidating the traditionally used assumptions in modeling and simulations, namely that packet arrivals are Poisson andpacket sizes and interarrival times are mutually independent. The first empirical evidence of self-similar characteristics in local area network traffic were presented in the pioneering work in [ZS]. The authors performed a rigorous statistical analysis of Ethernet traffic measurements and were able
Tlus work was supported by the NSF CAREER grant ANlR 9985195. and

DARF’A award XMSN66ooo1-00-1-8936. PiSF grant 11s-0208950 TCS and Inc..andDIMIm~ehioefundDIM00-10071. andDARPAawardFTNF3060201-2-0535

to establish its self-similar nature. Similar observations were presented for wide area Internet traffic in [36], where it was also shown that interarrival times are described by heavy tailed distributions. The origins of self-similarity in Internet traffic have been mainly attributed toheavy tail distributions of transfer sizes [lo] [441 [341. Apart from long-range dependence, it has been observed that Internet traffic presents complex scaling and multifractal characteristics that were usually associated with Round-Trip Time (RlT) delay [I61 [41] [471 [371 [191. In addition, studies have argued whether or not TCP congestion control contributes to the observed scaling [421 [431[291. We believe it is time to reexamine the Poisson traffic assumption in relation to the traffic carried within the Internet core. Long before the identification of self-similar characteristics in Internet traffic, Poisson packet arrivals and the independence assumption were widely used as the basis for network modeling and analysis [241. Despite the tendency of the community to discard Poisson...