Active Probing Using PacketPair Probing to Estimate Packet
Active Probing Using Packet-Pair Probing to Estimate Packet Size and Packet Arrival Rate Ph. D Student: Ana Novak Supervisors: Prof Peter Taylor & Dr Darryl Veitch Department of Mathematics & Statistics Melbourne University
Introduction Concept of a Packet NAME: Billy Bob EMAIL: billybob@hotmail. com MESSAGE: How are you today Sarah Jo? Billy Bob Sarah Jo
Introduction Concept of a Packet NAME: Billy Bob EMAIL: billybob@hotmail. com MESSAGE: How are you today Sarah Jo? DEPO NAME: Billy Bob Sarah Jo NAME: Billy Bob
Introduction Concept of a Packet EMAIL: billybob@hotmail. com MESSAGE: How are you today Sarah Jo? DEPO EMAIL: billybob@h otmail. com Billy Bob EMAIL: billybob@. . Sarah Jo NAME: Billy Bob EMAIL: billybob@hotmail. com
Introduction Concept of a Packet MESSAGE: How are you today Sarah Jo? DEPO MESSAGE: How are yo today Sara Billy Bob MESSAGE How are. . . Sarah Jo NAME: Billy Bob EMAIL: billybob@hotmail. com MESSAGE: How are you today Sarah Jo?
Fundamental Approaches to Measurement Passive measurement w Monitoring w Typically at a point w Non-invasive w Network authority Active measurement w Injecting artificial traffic stream w End-to-End w Fundamentally invasive w Non-privileged users
Active Probing Infrastructure Raw information captured: Time stamp; Packet header; Packet content
Timestamps w Sender Monitor timestamps probe arrivals to the network. w Receiver Monitor timestamps probe departures from the network. Sender Monitor: Receiver Monitor:
Timestamps w As the clocks on the sender and receiver monitors may not be synchronized we use inter-arrival and inter-departure times, rather then the end-to-end delays.
Single Hop Model Description of the 1 -hop system w Service is offered in a FIFO order. w The server processes at rate.
Probe Traffic & Cross Traffic Definitions: Probe Traffic (PT) is an artificial stream of traffic, all of whose properties are known and can be modified and controlled. Cross Traffic (CT) is any traffic in the Internet that is not Probe Traffic.
Types of CT Arrivals w Single Channel (M/D/1 output) w Multi Channel (Poisson)
Types of Probe Traffic Packet-Pairs of probes are sent periodically with period T, intra-pair spacing r and packet service time xp.
Single Channel (M/D/1 output) Estimating Cross Traffic Size w Lets construct the following experiment: w Inject a packet-pair probe stream into the network s. t. probes are “back-to-back” and , where xc is the CT service time. w Output of the experiment w Probes capture 1 or 0 CT packets.
Single Channel (M/D/1 output) Estimating Cross Traffic Size To Summarize: w Cross Traffic packet size estimate: where is the i-th inter-departure time, is the probe service time and is the link rate.
Single Channel (M/D/1 output) Estimating CT Size Example w Cross Traffic sizes: 100 B, 500 B, 1000 B, 1500 B w Respective arrival rates: 600 pkt/s, 100 pkt/s, 300 pkt/s, 800 pkt/s w Other parameters: Link rate: 2 MBps; Cross Traffic packet size: 1000 B; Probes packet size: 40 B; Probe rate: 10 pkt/s; Probe separation: 10 ms
Single Channel (M/D/1 output) Estimating CT Size Example 100 500 1000 1500 w Cross Traffic sizes: 100 B, 500 B, 1000 B, 1500 B w Respective arrival rates: 600 pkt/s, 100 pkt/s, 300 pkt/s, 800 pkt/s w Other parameters: Link rate: 2 MBps; Cross Traffic packet size: 1000 B; Probes packet size: 40 B; Probe rate: 10 pkt/s; Probe separation: 0. 0001 s
Estimating CT Arrival Rate (Assumption: Single CT size) Method 1: Back-to-back probes {M/D/1} Method 2: Back-to-back probes {Poisson} Method 3: Not back-to-back probes {Poisson}
Single Channel (M/D/1 output) Method 1: Back-to-back probes Incentive: Exploit the same probe stream used for estimating Cross Traffic size. Recap. Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times) Recap. Outcome: Array of inter-departure times corresponding to catching 1 CT packet (success) or 0 CT packets (failure). Model: Numerical outcome of the experiment is a r. v. Y with a Binomial distribution, B(n, p)
Single Channel (M/D/1 output) Method 1: Back-to-back probes w Cross Traffic arrival rate estimate in [pkt/s]: w For large values of n, if experimental value of Y is y, the 95. 4% confidence interval for arrival rate estimate is:
Single Channel (M/D/1 output) Method 1: Back-to-back probes Predicted confidence interval Example • xc = 0. 9 ms • CT a. r. = 1000 pkt/s • n = 1000 p-p • best c. i = +/- 10% xc=0. 9
Multi Channel (Poisson) Method 2: Back-to-back probes Mathematical Incentive: Rectify the problem of obtaining very low probabilities of packet capture, which result in a large confidence interval for arrival rate estimate (eliminate the upper bound ). Physical Incentive: CT Traffic can be better approximated with a multi-channel (Poisson) arrivals. Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times).
Multi Channel (Poisson) Method 2: Back-to-back probes Outcome: Array of inter-departure times corresponding to capturing m packets in an interval of length r. Model: Numerical outcome of the experiment is a r. v. Y with a Poisson distribution, .
Multi Channel (Poisson) Method 2: Back-to-back probes w The probability of capturing m packets in an interval of length r: w The sample average is the MLE of where
Multi Channel (Poisson) Method 2: Back-to-back probes w Respective exact 95% confidence interval is: where is the inverse of the chi-square cumulative distribution function.
Multi Channel (Poisson) Method 2: Back-to-back probes Predicted confidence interval Example • xc = 0. 01 s • CT a. r. = 1000 pkt/s • n = 1000 p-p • best c. i = +/- 1%
Multi Channel (Poisson) Method 3: Not back-to-back probes Incentive: Reduce invasiveness. In a multi-hop this is the inevitable effect. Experiment: Inject a stream of n probe-pairs into the network with intra-pair separation r, such that we can capture at least k=ceil(r/xc) CT packets (i. e. array of inter-arrival times). Outcome: Array of inter-departure times, of which some correspond to capturing m packets in an interval of length r. Model: It will become apparent later…
Busy and Idle Periods System passes through alternating cycles of busy and idle periods. w Busy period is when queue is never empty. w Idle period is when queue is always empty.
Why do we care about busy and idle periods? w If the probes share the same busy period the inter-departure times let us know how many packets arrived in time interval r. w If probes are in different busy periods then the inter-departure times don’t give us any conclusive information.
Peaks vs. Noise If two probes within a packet-pair: Share the same busy period then the corresponding interdeparture time will contribute to a formation of a peak. w Don’t share the same busy period then the corresponding interdeparture time will contribute to a formation of noise. w
Filtering-out noise Set of all measured inter -departure times A B Inter-departure times which are a result of probes sharing the same busy period (i. e. peaks) w As it stands, it looks like we could model the numerical outcomes from the set B as a Poisson distribution. But, that is not quite true. Why?
Multi Channel (Poisson) Method 3: Not back-to-back probes Problem: If then one of the following happened: w First probe saw the busy period and was delayed, as a result we caught an integer number of packets. w We cannot tell from the interdeparture time that 4 consecutive packets have arrived.
Multi Channel (Poisson) Method 3: Not back-to-back probes Therefore if probes are not back-to-back then the outcome that two probe-packets occur in the same busy period is dependent on how many packets were caught. w If a number of CT packets we caught is greater then k, then the two probe packets must necessarily be in the same busy period. w The converse does not hold.
Multi Channel (Poisson) Method 3: Not back-to-back probes Conclusion: If an inter-departure time , then we filter it out. Set of all measured inter-departure times A C B Inter-departure times which are a result of probes sharing the same busy period (i. e. peaks) Inter-departure times which are a result of probes sharing the same busy period and are greater then r.
Multi Channel (Poisson) Method 3: Not back-to-back probes Model: Numerical outcome of the filtered experiment is a r. v. Y with a Truncated-Poisson distribution. w Probability of capturing k CT packets in the interval of length r if we exclude the events of capturing {0, 1, …, m} CT packets is:
Multi Channel (Poisson) Method 3: Not back-to-back probes w The mean is : w The second moment is: w The variance is:
Multi Channel (Poisson) Mixed Truncated Poisson Distribution w After each filtration, number of valid experiments (i. e. successful probe-pairs) reduces. w Can we preserve the valid data i. e. ? w Yes. The answer is the Mixed Truncated Poisson Distribution. w where and is the weight of the i-th factor.
Future Work w Complete the algorithm for finding an optimal intra-pair separation. w Extend Methods for the traffic that comprises of multiple CT sizes. w Find the exact distribution for the Method 3. w Use Takacs integrodifferential equation to determine if probes are in the same busy period for an M/G/1 queue (continuous case). w Solve the problem for a multiple hop case.
- Slides: 38