Proceedings of ACM SIGCOMM ’91 1Characteristics of Wide-Area TCP/IP ConversationsRamón Cáceres† Peter B. Danzig* Sugih Jamin* Danny J. Mitzel**Computer Science Department, University of Southern California,Los Angeles, California 90089-0782†Computer Science Division, University of California,Berkeley, California [email protected] this paper, we characterize wide-area networkapplications that use the TCP transport protocol. We alsodescribe a new way to model the wide-area trafficgenerated by a stub network. We believe the traffic modelpresented here will be useful in studying congestioncontrol, routing algorithms, and other resource managementschemes for existing and future networks.Our model is based on trace analysis of TCP/IP wide-area internetwork traffic. We collected the TCP/IP packetheaders of USC, UCB, and Bellcore networks at the pointthey connect with their respective regional access networks.We then wrote a handful of programs to analyze the traces.Our model characterizes individual TCP conversations bythe distributions of: number of bytes transferred, duration,number of packets transferred, packet size, and packetinterarrival time.Our trace analysis shows that both interactive and bulktransfer traffic from all sites reflect a large number of shortconversations. Similarly, it shows that a very largepercentage of traffic is bidirectional, even for bulk transfer.We observed that interactive applications send significantlydifferent amounts of data in each direction of aconversation, and that interarrival times for interactiveapplications closely follow a constant plus exponentialmodel. Half of the conversations are directed to a handfulof networks, but the other half are directed to hundreds ofnetworks. Many of these observations contradictcommonly held beliefs regarding wide-area traffic.This research was supported by an equipment grant from theCharles Lee Powell Foundation. Ramón Cáceres was supportedby the NSF and DARPA under Cooperative Agreement NCR-8919038 with CNRI, by AT&T Bell Laboratories, Hitachi, aUniversity of California MICRO grant, and ICSI.1. Introduction“The key issue in the design or selection of acongestion management scheme is the traffic pattern, andtraffic patterns are dependent upon the application[Jain90].” This paper presents conversation level analysisof wide-area TCP traces collected on two campusnetworks—University of Southern California (USC) andUniversity of California, Berkeley (UCB), and oneindustrial research site—Bellcore. Most of the analysis wasdone as part of term projects for graduate courses inperformance evaluation and distributed systems at theUniversity of Southern California. Our goal was to collectinformation that would be useful in evaluating futurenetwork designs. Since TCP packets make up roughly 80%of all wide-area network traffic,1 a model based on TCPtraffic is necessary to study network behavior. We restrictour discussion to TCP in this paper. Table 1 summarizesour most important results.When simulating new congestion, flow control, androuting algorithms one needs to model the overall pattern oftraffic flowing through the network, from distribution ofpacket sizes and interarrival times to characteristics such asdistribution of host reference patterns and direction oftraffic flow. Current practice is to use FTP and TELNETsources, where FTP sources send huge quantities of data inone direction and TELNET sources send a Poisson stream ofsmall packets in one or both directions [Demers89][Rama90]. Current practice ignores the distribution ofnumber of bytes transmitted, the bidirectionality of bulktraffic sources, and the duration of interactive connections.Future broadband wide-area networks will probablytransfer large amounts of data and carry a mix of trafficcurrently not found on the Internet. We believe this doesnot trivialize our present study, for several reasons. First, itwill be several years before the current traffic mix changesappreciably. Second, as it changes, it will not obviate the1For the UCB data, UDP packets make up 16% of all networktraffic, while ICMP packets account for only 1% of all traffic. Ofall UDP packets, 63.63% belongs to DNS, 15.82% to ROUTE, and10.51% to NTP.2existence of traditional traffic. Third, we believe this paperillustrates a general technique for workload measurement ofwide-area internetworks.75-90% of the conversations belonging to bulk transferapplications send less than 10 kilobytes of data. Bulktransfer is request-response in nature.Over 90% of interactive conversations send fewer than1,000 packets and 50% of interactive conversations lastless than a minute and a half. Packets belonging tointeractive applications are mostly smaller than 512bytes.A constant plus exponential distribution best modelsinterarrival times of packets belonging to interactiveapplications.A large portion of bulk transfer applications, which areresponsible for more than 50% of observed networktraffic, show bidirectional traffic flow.Interactive applications can generate 10 times more datain one direction than the other, using packet sizesranging from 1 byte to 512 bytes.Table 1: Selected results.Previous traffic studies of TCP/IP have examined thestatistics of the aggregated packet arrival process on localarea networks [Jain86] [Gusella90] [Leland91], at borderrouters [Cáceres89], and inside a wide-area backbone[Heimlich89]. These studies have shown that packetinterarrival times are not Poisson, but rather follow apacket-train model. The packet-train model has provenvaluable in the design of packet routers [Feldmeier88][Jain89].The study presented in this paper is different from allthe studies mentioned above. Instead of confiningourselves to the network and transport layers, we studiedthe characteristics of several applications. We believe theseapplications are representative of applications currentlyrunning on wide-area networks.The decision to characterize application traffic wassupported by the following observations. Measuredinterarrival times alone are not adequate to characterizeconversations for the purpose of driving flow andcongestion control algorithm simulations, becauseinterarrival times are themselves a function of existing flowcontrol mechanisms—interarrival times do characterizeinteractive traffic, which is unlikely to be constrained byflow control. In contrast, bulk traffic must be characterizedby the amount of data
View Full Document
Unlocking...