{"title":"Data streaming algorithms for efficient and accurate estimation of flow size distribution","authors":"Abhishek Kumar, Minho Sung, Jun Xu, Jia Wang","doi":"10.1145/1005686.1005709","DOIUrl":"https://doi.org/10.1145/1005686.1005709","url":null,"abstract":"Knowing the distribution of the sizes of traffic flows passing through a network link helps a network operator to characterize network resource usage, infer traffic demands, detect traffic anomalies, and accommodate new traffic demands through better traffic engineering. Previous work on estimating the flow size distribution has been focused on making inferences from sampled network traffic. Its accuracy is limited by the (typically) low sampling rate required to make the sampling operation affordable. In this paper we present a novel data streaming algorithm to provide much more accurate estimates of flow distribution, using a \"lossy data structure\" which consists of an array of counters fitted well into SRAM. For each incoming packet, our algorithm only needs to increment one underlying counter, making the algorithm fast enough even for 40 Gbps (OC-768) links. The data structure is lossy in the sense that sizes of multiple flows may collide into the same counter. Our algorithm uses Bayesian statistical methods such as Expectation Maximization to infer the most likely flow size distribution that results in the observed counter values after collision. Evaluations of this algorithm on large Internet traces obtained from several sources (including a tier-1 ISP) demonstrate that it has very high measurement accuracy (within 2%). Our algorithm not only dramatically improves the accuracy of flow distribution measurement, but also contributes to the field of data streaming by formalizing an existing methodology and applying it to the context of estimating the flow-distribution.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127816713","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Isolating the performance impacts of network interface cards through microbenchmarks","authors":"Vijay S. Pai, S. Rixner, Hyong-youb Kim","doi":"10.1145/1005686.1005752","DOIUrl":"https://doi.org/10.1145/1005686.1005752","url":null,"abstract":"Many factors can prevent a Gigabit Ethernet network interface card (NIC) from achieving line rate in a modern web server. In fact, the various commercially available NICs have different performance characteristics that lead to throughput differences for actual web servers. For example, Figure 1 shows the performance achieved by the thttpd web server for client traces extracted from the Rice University computer science department (CS), a NASA web site (NASA), and the 1998 soccer World Cup tournament (World Cup). The latter two traces are available from the Internet Traffic Archive (http://ita.ee.lbl.gov/). The server system tested includes an AMD Athlon 2600+ XP processor running the FreeBSD 4.7 operating system, 2 GB of DDR SDRAM, a 64-bit/66 MHz PCI bus, and a single 40 GB IDE disk (none of the workloads are disk intensive). The tested systems differ only in their NIC, with the Intel Pro-1000/MT Server and Desktop, Alteon AceNIC with parallelized firmware [2], Netgear GA622T, 3Com 3C996B, and Alteon AceNIC with released firmware arranged from left to right. There are substantial performance differences across the NICs in the web environment, as the fastest NIC consistently achieves 40–60% more throughput than the slowest. A web server interacts with the network in two primary ways: receiving client HTTP requests and sending HTTP responses. Requests are typically quite small, on the order of 200 bytes of ASCII text, while responses vary from empty files to several hundred megabytes. Since web clients and servers communicate using TCP, the server must acknowledge requests, leading to minimum-sized (64-byte) Ethernet frames. Response data must be segmented and encapsulated in Ethernet frames, which allow up to 1460 bytes of TCP content in a maximum-sized (1518-byte) frame. Then, those segments are sent out according to TCP flow control policies based on the receipt of acknowledgments. A high-performance server NIC must thus support data volumes dominated by sends of large","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":" 5","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132075375","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Anukool Lakhina, K. Papagiannaki, M. Crovella, C. Diot, E. Kolaczyk, N. Taft
{"title":"Structural analysis of network traffic flows","authors":"Anukool Lakhina, K. Papagiannaki, M. Crovella, C. Diot, E. Kolaczyk, N. Taft","doi":"10.1145/1005686.1005697","DOIUrl":"https://doi.org/10.1145/1005686.1005697","url":null,"abstract":"Network traffic arises from the superposition of Origin-Destination (OD) flows. Hence, a thorough understanding of OD flows is essential for modeling network traffic, and for addressing a wide variety of problems including traffic engineering, traffic matrix estimation, capacity planning, forecasting and anomaly detection. However, to date, OD flows have not been closely studied, and there is very little known about their properties.We present the first analysis of complete sets of OD flow time-series, taken from two different backbone networks (Abilene and Sprint-Europe). Using Principal Component Analysis (PCA), we find that the set of OD flows has small intrinsic dimension. In fact, even in a network with over a hundred OD flows, these flows can be accurately modeled in time using a small number (10 or less) of independent components or dimensions.We also show how to use PCA to systematically decompose the structure of OD flow timeseries into three main constituents: common periodic trends, short-lived bursts, and noise. We provide insight into how the various constitutents contribute to the overall structure of OD flows and explore the extent to which this decomposition varies over time.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"107 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133773960","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Uncooperative congestion control","authors":"K. Chandrayana, S. Kalyanaraman","doi":"10.1145/1005686.1005718","DOIUrl":"https://doi.org/10.1145/1005686.1005718","url":null,"abstract":"Traditionally uncooperative rate control schemes have implied open loop protocols such as UDP, CBR, etc. In this paper we show that closed loop uncooperative rate control schemes also exist and that the current AQM proposals cannot efficiently control their mis-behavior. Moreover, these proposals require that AQM be installed at all routers in the Internet which is not only expensive but requires significant network upgrade.In this paper we show that management of uncooperative flows need not be coupled with AQM design but can be viewed as edge based policing question. In this paper we propose an analytical model for managing uncooperative flows in the Internet by re-mapping their utility function to a target range of utility functions. This mapping can be achieved by transparently manipulating congestion penalties conveyed to the uncooperative users.The most interesting aspect of this research is that this task can be performed at the edge of the network with little state information about uncooperative flows. The proposed solution is independent of the buffer management algorithm deployed on the network. As such it works with Drop-Tail queues as well as any AQM scheme. We have analyzed the framework and evaluated it on various single and multi-bottleneck topologies with both Drop-Tail and RED. Our results show that the framework is robust and works well even in presence of background traffic and reverse path congestion.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123829004","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Complete or fast reference trace collection for simulating multiprogrammed workloads: choose one","authors":"Scott F. Kaplan","doi":"10.1145/1005686.1005747","DOIUrl":"https://doi.org/10.1145/1005686.1005747","url":null,"abstract":"Trace-driven simulation [8] provides a reproducible, controllable, and verifiable mechanism for evaluating memory management policies used at every level of the memory hierarchy. A reference trace collector gathers the inputs that drive such simulations. Each collector must interfere with normal execution so that it can capture the references—that is, gain control of execution when a reference occurs. Once a reference has been captured, it is then handled—that is, stored, filtered, or otherwise processed. Most existing trace collectors operate only on a single process [5, 6, 7]. The few collectors that operate on multiple processes [1] are not capable of gathering all of the information needed to drive multiprogrammed simulations. Specifically, they do not record critical kernel events required to associate each reference with its thread, associate each thread with its process, account for file system accesses, and identify all uses of shared memory. Most collectors have low capturing overhead. However, it is the handling overhead that dominates the total overhead of any collector that captures every reference [3], slowing executing by factors of at least 400. Thus, to reduce the total overhead, a collector must not capture all references. Significant event tracing [5] is the only existing method of selective capturing. It is a binary rewriting strategy that can identify code segments within which references may be inferred by a post-processor. This method, however, can be applied only to binaries whose symbol table information has not been stripped. It also cannot be applied to dynamically generated code, and it is not applicable to multiprogrammed workloads.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133957865","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Performance aware tasking for environmentally powered sensor networks","authors":"A. Kansal, D. Potter, M. Srivastava","doi":"10.1145/1005686.1005714","DOIUrl":"https://doi.org/10.1145/1005686.1005714","url":null,"abstract":"The use of environmental energy is now emerging as a feasible energy source for embedded and wireless computing systems such as sensor networks where manual recharging or replacement of batteries is not practical. However, energy supply from environmental sources is highly variable with time. Further, for a distributed system, the energy available at its various locations will be different. These variations strongly influence the way in which environmental energy is used. We present a harvesting theory for determining performance in such systems. First we present a model for characterizing environmental sources. Second, we state and prove two harvesting theorems that help determine the sustainable performance level from a particular source. This theory leads to practical techniques for scheduling processes in energy harvesting systems. Third, we present our implementation of a real embedded system that runs on solar energy and uses our harvesting techniques. The system adjusts its performance level in response to available resources. Fourth, we propose a localized algorithm for increasing the performance of a distributed system by adapting the process scheduling to the spatio-temporal characteristics of the environmental energy in the distributed system. While our theoretical intuition is based on certain abstractions, all the scheduling methods we present are motivated solely from the experimental behavior and resource constraints of practical sensor networking systems.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"80 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114335555","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A hybrid direct-indirect estimator of network internal delays","authors":"K. Anagnostakis, M. Greenwald","doi":"10.1145/1005686.1005750","DOIUrl":"https://doi.org/10.1145/1005686.1005750","url":null,"abstract":"The network tomography problem requires a remote source to estimate network-internal statistics on individual links within the network. Several techniques have been proposed to perform network delay tomography. The most accurate prior techniques directly measured delay by using ICMP Timestamp requests to the head and tail of the measured link. However, routing irregularities in the Internet significantly limited the applicability to individual links (the route to the head of the link had to be a proper prefix of the route to the tail of the link). Alternative techniques with broader coverage are all either less accurate, require new functionality in routers, or require the existence of a network-wide measurement infrastructure. This report presents a network tomography technique that achieves accuracy comparable with the best prior techniques, can measure one-way delays, depends only on existing infrastructure, and is much more widely applicable than previous techniques with comparable accuracy. Our approach is to use a number of probes to directly measure overlapping multi-link segments in the neighborhood of the target link. The delay distributions on these segments are used as input to an inference algorithm that derives an estimate of the queuing delay distribution on the target link. The coverage of this technique is assessed by inspecting many thousands of Internet paths. The accuracy is evaluated through simulation (where knowledge of the real delay distributions is obtainable, and where such real distributions can be compared to the estimated delay distributions).","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114223583","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dynamics of hot-potato routing in IP networks","authors":"R. Teixeira, A. Shaikh, T. Griffin, J. Rexford","doi":"10.1145/1005686.1005723","DOIUrl":"https://doi.org/10.1145/1005686.1005723","url":null,"abstract":"Despite the architectural separation between intradomain and interdomain routing in the Internet, intradomain protocols do influence the path-selection process in the Border Gateway Protocol (BGP). When choosing between multiple equally-good BGP routes, a router selects the one with the closest egress point, based on the intradomain path cost. Under such hot-potato routing, an intradomain event can trigger BGP routing changes. To characterize the influence of hot-potato routing, we conduct controlled experiments with a commercial router. Then, we propose a technique for associating BGP routing changes with events visible in the intradomain protocol, and apply our algorithm to AT&T's backbone network. We show that (i) hot-potato routing can be a significant source of BGP updates, (ii) BGP updates can lag 60 seconds or more behind the intradomain event, (iii) the number of BGP path changes triggered by hot-potato routing has a nearly uniform distribution across destination prefixes, and (iv) the fraction of BGP messages triggered by intradomain changes varies significantly across time and router locations. We show that hot-potato routing changes lead to longer delays in forwarding-plane convergence, shifts in the flow of traffic to neighboring domains, extra externally-visible BGP update messages, and inaccuracies in Internet performance measurements.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127788410","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A resource-allocation queueing fairness measure","authors":"D. Raz, H. Levy, B. Avi-Itzhak","doi":"10.1145/1005686.1005704","DOIUrl":"https://doi.org/10.1145/1005686.1005704","url":null,"abstract":"Fairness is a major issue in the operation of queues, perhaps it is the reason why queues were formed in the first place. Recent studies show that the fairness of a queueing system is important to customers not less than the actual delay they experience. Despite this observation little research has been conducted to study fairness in queues, and no commonly agreed upon measure of queue fairness exists. Two recent research exceptions are Avi-Itzhak and Levy [1], where a fairness measure is proposed, and Wierman and Harchol-Balter [18] (this conference, 2003), where a criterion is proposed for classifying service policies as fair or unfair; the criterion focuses on customer service requirement and deals with fairness with respect to service times.In this work we recognize that the inherent behavior of a queueing system is governed by two major factors: Job seniority (arrival times) and job service requirement (service time). Thus, it is desired that a queueing fairness measure would account for both. To this end we propose a Resource Allocation Queueing Fairness Measure, (RAQFM), that accounts for both relative job seniority and relative service time. The measure allows accounting for individual job discrimination as well as system unfairness. The system measure forms a full scale that can be used to evaluate the level of unfairness under various queueing disciplines. We present several basic properties of the measure. We derive the individual measure as well as the system measure for an M/M/1 queue under five fundamental service policies: Processor Sharing (PS), First Come First Served (FCFS), Non-Preemptive Last Come First Served (NP-LCFS), Preemptive Last Come First Served (P-LCFS), and Random Order of Service (ROS). The results of RAQFM are then compared to those of Wierman and Harchol-Balter [18], and the quite intriguing observed differences are discussed.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132561760","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The origins of network server latency & the myth of connection scheduling","authors":"Yaoping Ruan, Vivek S. Pai","doi":"10.1145/1005686.1005749","DOIUrl":"https://doi.org/10.1145/1005686.1005749","url":null,"abstract":"We investigate the origins of server-induced latency to understand how to improve latency optimization techniques. Using the Flash Web server [4], we analyze latency behavior under various loads. Despite latency profiles that suggest standard queuing delays, we find that most latency actually originates from negative interactions between the application and the locking and blocking mechanisms in the kernel. Modifying the server and kernel to avoid these problems yields both qualitative and quantitative changes in the latency profiles -- latency drops by more than an order of magnitude, and the effective service discipline also improves.We find our modifications also mitigate service burstiness in the application, reducing the event queue lengths dramatically and eliminating any benefit from application-level connection scheduling. We identify one remaining source of unfairness, related to competition in the networking stack. We show that adjusting the TCP congestion window size addresses this problem, reducing latency by an additional factor of three.","PeriodicalId":172626,"journal":{"name":"SIGMETRICS '04/Performance '04","volume":"201 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114923798","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}