View
212
Download
1
Category
Preview:
Citation preview
PhD Student: Ana Novak
Supervisors: Prof Peter Taylor & Dr Darryl Veitch
Active Probing
Using Packet-Pair Probing to Estimate Packet Size and Packet Arrival Rate
Department of Mathematics & Statistics
Melbourne University
IntroductionConcept of a Packet
NAME: Billy Bob
EMAIL: billybob@hotmail.com
MESSAGE: How are you today Sarah Jo?
Billy Bob Sarah Jo
NAME: Billy Bob
IntroductionConcept of a Packet
NAME: Billy Bob
EMAIL: billybob@hotmail.com
MESSAGE: How are you today Sarah Jo?
Billy Bob Sarah Jo
NAME: Billy Bob
DEPO
NAME: Billy Bob
IntroductionConcept of a Packet
Billy Bob Sarah Jo
DEPO
EMAIL: billybob@hotmail.com
EMAIL: billybob@..
EMAIL: billybob@hotmail.com
NAME: Billy Bob
EMAIL: billybob@hotmail.com
MESSAGE: How are you today Sarah Jo?
IntroductionConcept of a Packet
Billy Bob Sarah Jo
DEPO
MESSAGEHow are ...
EMAIL: billybob@hotmail.com
NAME: Billy Bob
MESSAGE: How are you today Sarah Jo?
MESSAGE: How are yo today Sara
MESSAGE: How are you today Sarah Jo?
Fundamental Approaches to Measurement
Passive measurement Monitoring Typically at a point Non-invasive Network authority
Active measurement Injecting artificial traffic stream End-to-End Fundamentally invasive Non-privileged users
Active Probing Infrastructure
Time stamp; Packet header; Packet contentRaw information captured:
Timestamps
Sender Monitor timestamps probe arrivals to the network. Receiver Monitor timestamps probe departures from the network.
Sender Receiver
Sender Monitor: Receiver Monitor:
Timestamps
As the clocks on the sender and receiver monitors may not be
synchronized we use inter-arrival and inter-departure times, rather
then the end-to-end delays.
Description of the 1-hop system Service is offered in a FIFO order. The server processes at rate .
Single Hop Model
Probe Traffic & Cross Traffic
Definitions:
Probe Traffic (PT) is an artificial stream of traffic, all of whose properties are known and
can be modified and controlled.
Cross Traffic (CT) is any traffic in the Internet that is not Probe Traffic.
Types of CT Arrivals
Single Channel (M/D/1 output)
Multi Channel (Poisson)
Packet-PairPairs of probes are sent periodically with period
T, intra-pair spacing r and packet service time xp.
Types of Probe Traffic
Lets construct the following experiment: Inject a packet-pair probe stream into the network s.t. probes are
“back-to-back” and , where xc is the CT service time.
Output of the experiment Probes capture 1 or 0 CT packets.
Estimating Cross Traffic Size
Single Channel (M/D/1 output)
Cross Traffic packet size estimate:
where is the i-th inter-departure time, is the probe service time and is the link rate.
Estimating Cross Traffic Size
Single Channel (M/D/1 output)
To Summarize:
Estimating CT SizeExample
Cross Traffic sizes: 100B, 500B, 1000B, 1500B Respective arrival rates: 600pkt/s, 100pkt/s, 300pkt/s, 800pkt/s Other parameters: Link rate: 2MBps; Cross Traffic packet size: 1000B;
Probes packet size: 40B; Probe rate: 10pkt/s; Probe separation: 10ms
Single Channel (M/D/1 output)
Estimating CT SizeExample
Cross Traffic sizes: 100B, 500B, 1000B, 1500B Respective arrival rates: 600pkt/s, 100pkt/s, 300pkt/s, 800pkt/s Other parameters: Link rate: 2MBps; Cross Traffic packet size: 1000B;
Probes packet size: 40B; Probe rate: 10pkt/s; Probe separation: 0.0001s
100 500 1000 1500
Single Channel (M/D/1 output)
Method 1: Back-to-back probes {M/D/1}
Method 2: Back-to-back probes {Poisson}
Method 3: Not back-to-back probes {Poisson}
Estimating CT Arrival Rate(Assumption: Single CT size)
Incentive: Exploit the same probe stream used for estimating Cross Traffic size.
Recap. Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times)
Recap. Outcome: Array of inter-departure times corresponding to catching 1 CT packet (success) or 0 CT packets (failure).
Model: Numerical outcome of the experiment is a r.v. Y with a Binomial distribution, B(n,p)
Method 1: Back-to-back probes
Single Channel (M/D/1 output)
Cross Traffic arrival rate estimate in [pkt/s]:
For large values of n, if experimental value of Y is y, the 95.4% confidence interval for arrival rate estimate is:
Method 1: Back-to-back probes
Single Channel (M/D/1 output)
Method 1: Back-to-back probes
Single Channel (M/D/1 output)
xc=0.9
Predicted confidence interval
Example
• xc = 0.9ms
• CT a.r. = 1000 pkt/s
• n = 1000 p-p
• best c.i = +/- 10%
Mathematical Incentive: Rectify the problem of obtaining very low probabilities of packet capture, which result in a large confidence interval for arrival rate estimate (eliminate the upper bound ).
Physical Incentive: CT Traffic can be better approximated with a multi-channel (Poisson) arrivals.
Experiment: Inject a stream of n packet-pairs into the network with back-to-back probes (array of inter-arrival times).
Method 2: Back-to-back probes
Multi Channel (Poisson)
Model: Numerical outcome of the experiment is a r.v. Y with a Poisson distribution, .
Method 2: Back-to-back probes
Multi Channel (Poisson)
Outcome: Array of inter-departure times corresponding to capturing m packets in an interval of length r.
Method 2: Back-to-back probes
The probability of capturing m packets in an interval of length r:
The sample average is the MLE of
where
Multi Channel (Poisson)
Method 2: Back-to-back probes
Respective exact 95% confidence interval is:
where is the inverse of the chi-square cumulative distribution function.
Multi Channel (Poisson)
Method 2: Back-to-back probes
Multi Channel (Poisson)
Predicted confidence interval
Example
• xc = 0.01s
• CT a.r. = 1000 pkt/s
• n = 1000 p-p
• best c.i = +/- 1%
Incentive: Reduce invasiveness. In a multi-hop this is the inevitable effect.
Experiment: Inject a stream of n probe-pairs into the network with intra-pair separation r, such that we can capture at least k=ceil(r/xc) CT packets (i.e. array of inter-arrival times).
Outcome: Array of inter-departure times, of which some correspond to capturing m packets in an interval of length r.
Model: It will become apparent later…
Method 3: Not back-to-back probes
Multi Channel (Poisson)
Busy and Idle Periods
System passes through alternating cycles of busy and idle periods. Busy period is when queue is never empty. Idle period is when queue is always empty.
Why do we care about busy and idle periods?
If the probes share the same busy period the inter-departure times let us know how many packets arrived in time interval r.
If probes are in different busy periods then the inter-departure times don’t give us any conclusive information.
If two probes within a packet-pair:
Peaks vs. Noise
Share the same busy period then the corresponding inter-departure time will contribute to a formation of a peak .
Don’t share the same busy period then the corresponding inter-departure time will contribute to a formation of noise .
As it stands, it looks like we could model the numerical outcomes from the set B as a Poisson distribution. But, that is not quite true. Why?
Set of all measured inter-departure times
A
Inter-departure times which are a result of probes sharing the same busy period (i.e. peaks)
B
Filtering-out noise
Problem: If then one of the following happened:
Method 3: Not back-to-back probes
Multi Channel (Poisson)
First probe saw the busy period and was delayed, as a result we caught an integer number of packets.
We cannot tell from the inter-departure time that 4 consecutive packets have arrived.
Therefore if probes are not back-to-back then the outcome that two probe-packets occur in the same busy period is dependent on how many packets were caught.
Method 3: Not back-to-back probes
Multi Channel (Poisson)
If a number of CT packets we caught is greater then k, then the two probe packets must necessarily be in the same busy period.
The converse does not hold.
Conclusion: If an inter-departure time , then we filter it out.
Method 3: Not back-to-back probes
Multi Channel (Poisson)
Set of all measured inter-departure times
A
Inter-departure times which are a result of probes sharing the same busy period (i.e. peaks)
BC
Inter-departure times which are a result of probes sharing the same busy period and are greater then r.
Method 3: Not back-to-back probes
Probability of capturing k CT packets in the interval of length r if we exclude the events of capturing {0,1,…,m} CT packets is:
Multi Channel (Poisson)
Model: Numerical outcome of the filtered experiment is a r.v. Y with a Truncated-Poisson distribution.
Method 3: Not back-to-back probes
The mean is :
The second moment is:
The variance is:
Multi Channel (Poisson)
Mixed Truncated Poisson Distribution
After each filtration, number of valid experiments (i.e. successful probe-pairs) reduces.
Can we preserve the valid data i.e. ? Yes. The answer is the Mixed Truncated Poisson Distribution .
where and is the weight of the i-th factor.
Multi Channel (Poisson)
Complete the algorithm for finding an optimal intra-pair separation.
Extend Methods for the traffic that comprises of multiple CT sizes.
Find the exact distribution for the Method 3.
Use Takacs integrodifferential equation to determine if probes are in the same busy period for an M/G/1 queue (continuous case).
Solve the problem for a multiple hop case.
Future Work
Recommended