Self-Similar Network Traffic Simulation

Diane T. Lark, Martha Evens, and William Lidinsky Illinois Institute of Technology, Chicago, Illinois, USA e-mail: wwlark@att.net

Abstract
It has been shown that much real world computer network traffic exhibits self-similar rather than Poisson behavior. This explains why network devices designed using simulation and analysis tools based upon Poisson models have led to results that differ considerably from those observed in the real world. Investigations including significant studies by Bellcore, the University of California at Berkeley, Boston University and others have conclusively demonstrated that much computer network traffic is self-similar in nature. In order to be useful, future network simulations and analyses must have a self-similar basis. With respect to simulation, a needed component is a generator capable of inserting tailored self-similar traffic into a network. But ideally such a generator should be able to produce different degrees of self-similar traffic and be able to relate other traffic parameters such as file size, packet and segment size and client/server request/response distributions. An experimental system called SURGE (Scalable URL Reference Generator) has the potential for filling this need. The developers produced evidence that it generated a higher degree of self-similarity under heavy loads that other load generators. Questions remained as to whether SURGE produces repeatable and precise results with comparable degrees of self-similarity to that observed in the real world given equivalent workloads. Our efforts have shown that SURGE produced repeatable and precise results that were representative of real world network traffic. This paper reports on the sensitivity of self-similar properties observed in the simulated network traffic when accessing only a percentage of the distinct files during a SURGE simulation. Once this sensitivity is understood, SURGE can be a useful tool for simulating self-similar traffic and can be profitably used by network designers and analysts to predict network behavior.

Keywords
SURGE, Wavelet estimator, Hurst value, parameter estimation

1.

Introduction

Leland et al. [Leland et al., 1995] showed that ethernet traffic exhibited self-similar statistical properties in the sense that self-similarity existed when two subsets of data were identical over multiple time scales. Long-range dependence, or the Joseph effect, was another important property. Here, correlations decay very slowly. A second team, Paxson and Floyd [Paxson and Floyd, 1995], established that the Poisson distribution was inappropriate for network modeling due to the long-range dependence observed in network traffic. Crovella and Bestavros [Crovella and Bestavros, 1997] discovered that HTTP traffic exhibited self-similar properties. Barford and Crovella [Barford and Crovella, 1998 and 1999] introduced SURGE and demonstrated that their workload generator was capable of simulating workloads that generated network traffic with statistical self-similarity properties. Their generator produced higher degrees of self-similarity under heavy loads. They attributed the inability of SPECWeb96 to generate comparable degrees

of self-similarity to the fact that it utilizes a fixed-request generation rate. In effect, as the number of requests increased, the time between requests decreased. Traffic burstiness diminished with increased load. SURGE (Scalable URL Reference Generator) has been shown to produce realistic loads that generate network traffic with self-similar properties. Our efforts have shown that, when used properly and carefully it can be used by those with the primary interest of generating network traffic with self-similar properties. This paper reports on the sensitivities and impacts on the degree of self-similarity when used improperly. It first provides background information concerning the experimental apparatus, SURGE, and prior research results with respect to repeatability, precision and realism. It then describes the methodology employed to collect and analyze the data. Finally, the results are explained.

2.

Background

This section gives a brief description of the experimental equipment and of SURGE itself. It then explains the results of our earlier work on the validation of SURGE. 2.1. Experimental Apparatus and Processes

The experimental apparatus consisted of five systems; one functioned as the Web server and four functioned as workload generators or clients. Three systems were 1GHz Pentium III HP Pavilion 7940 computers and two systems were 66MHz Pentium II ACP computers. The Web server was an HP Pavilion with 384MB RAM. The other two HP Pavilions had 128MB RAM each. The two ACP systems had 64MB RAM each. All systems ran Red Hat Linux. These five systems were connected to an 8-port Linksys switch to form an isolated LAN. Software employed included Apache and SURGE. Apache was modified to increase the number of maximum threads from 150 to 1024. The Web server functioned as the network time server via NTP (Network Time Protocol). Our process for selecting the appropriate separation point between the distribution tail and the body was performed according to the process outlined by [Barford et al., 1999]. Separation of data between body and tail was determined, MLE (Maximum Likelihood Estimators) were applied to ensure that data were representative of the population, and was determined using linear regression. Mathematica was used for these purposes. Tcpdump was used to collect network traces for analysis. Determining the degree of self-similarity was accomplished by using Matlab routines developed by Veitch and Abry [Veitch and Abry, 1999] who used Discrete Wavelet Transforms to analyze self-similar and long-range dependent processes. The advantage these routines offered over other tools (i.e. Variance Time Plot, R/S Analysis, and Periodogram) was the inclusion of Confidence Intervals. Another tool, the Whittle estimator does provide confidence intervals but was complex to use. The Matlab routines analyzed the network traces and produced values representative of self-similarity, namely H (Hurst) and . The following equation shows the relationship between H and :

H = (1 + ) / 2 where refers to the Pareto distribution shape parameter. Hurst values between 0.5 and 1.0 indicate self-similarity. As it approaches 1.0, the degree of self-similarity increases. 2.2. SURGE Workload Generator

SURGE was developed by [Barford and Crovella, 1998]. Their efforts showed that it produced high degrees of self-similarity in network traffic under heavy loads. Barford and Crovella [Barford and Crovella, 1998] defined six workload characterization influences based upon efforts by other researchers. These workload characteristics were 1) server file size, 2) request size, 3) relative file popularity, 4) embedded file references, 5) temporal locality of reference, and 6) idle periods of individual users. Distribution models were specified for each and employed by each UE (User-Equivalent). Each UE was a bursty process that exhibited long periods of activity followed by long periods of inactivity. The concept of a UE was developed to capture the behavior of a real Web user [Barford and Crovella, 1998]. Each UE represented a separate ON/OFF process that generated requests and remained idle according to its distributional model. Forerunners of SURGE used a fixed rate source with a constant number of threads and a constant request rate. The OFF time was determined by dividing the target rate by the number of threads. Idle, or OFF, times were not preserved. As the workload intensified, the idle times of threads grew shorter and exhibited lower variability in demand. This method failed to produce the burstiness necessary to generate self-similar traffic. In contrast, the UE used a variable rate source to determine idle time. As the number of threads increased, the idle times were preserved because they followed the distributional model. Default workload characterization distributional models [Barford and Crovella, 1998] and the distribution parameter values appear in Table 1.
Char File Sizes Body File Sizes Tail Popularity Temporal Locality Request Sizes Request Sizes Active Off Times Inactive Off Times Embedded References Model Lognormal Probability Density Function

p ( x )=

1 x 2x

( ln x

)2 / 2 2

Parm =9 .36; =1.32 300 =9 =1.0 =1.5; =0.80 =7.88; =1.34 =3558; =1.177 a=1.46; b=0.382 =1; =1.5 =1; =2.43

Pareto Zipf Lognormal

p(x ) = k x ( + 1) p = kr 1
p ( x )= 1 x 2 x 2 2 1 p ( x )= e (ln x ) / 2 x 2 x e (ln x )
2

/ 2

Lognormal

Pareto Weibull

p(x ) = k x ( + 1)

Pareto Pareto

p(x ) = k x ( + 1) Table 1. SURGE Default Distribution Parameters

bx b 1 ( x / a )b e ab p(x ) = k x ( + 1) p(x ) =

Combining the above distributional models into a single representative workload exhibiting those characteristics introduced two problems [Barford and Crovella, 1998]. The first was how to generate the appropriate number of requests for the desired file sizes. The second was how to generate a request stream that exhibited temporal locality. The first problem was handled by [Barford and Crovella, 1998] through a method designed to match requests to files and to generate a representative output sequence. The matching problem involved the popularity, file size, and request size distributions. No matter how many clients were involved with issuing requests, the distribution models for popularity and file size needed to be generated according to the defined distribution model parameter values. Success was determined by the difference between the desired number of references to a file size and the actual number of references to that file size. Two methods were assessed by [Barford and Crovella, 1998]. Splitting the head of the distribution from the tail of the distribution produced optimal results when matching. Matching the distribution tail resulted in close fits. Large errors were not introduced in the body of the distribution. The second problem was addressed by placing file names in a stack and defining a small window in which each file was assigned a weight with a value proportional to the outstanding requests for that file [Barford and Crovella, 1998]. The file at the top of the stack was based upon the probabilistic weight of the files within the window. The file sequence generation produced the appropriate file distribution, and the stack distance values followed the lognormal distribution. However, distributions would be less accurate when numerous clients were configured since clients could not share a common list without associated synchronization overhead. SURGE managed this situation by generating independent file name sequences and their associated stack distance properties. The lognormal distribution output values were scaled according to the number of clients. This produced the same stack distance distribution as the single client. 2.3. Earlier Research Results

Based on the analyses performed during our earlier research, we concluded that SURGE generated repeatable results with respect to total data transferred, number of connections, distinct files accessed, and long-range dependence. It also proved to be precise with respect to reproduction of the tail for the file size and request size distribution provided the distributions were stable. Stable Pareto distributions have 0 < < 2 [Evans et al., 1993]. Results indicated that the simulation distribution for request size was more difficult to reproduce due to the combinatorial methods employed by the authors of the tool and the sensitivity to the number of distinct files accessed. Accessing the available files repeatedly produced distributions that differed from that input as well as produced self-similarity results not representative of the intended workload. During set up of the Web server, the tester selects the number of distinct files. Accessing all distinct files must be achievable within a reasonable time frame. This earlier work suggested the importance of determining the appropriate job duration in order to simulate the expected workload. Our data also showed that for duplicating real-world workloads, SURGE produced representative burstiness in traffic provided the distributions were stable. In addition, we discovered that it was unlikely to match the real-world values for both total bytes transferred and total files transferred. This can be attributed to the fact that the original file set was represented by a distribution that was used to generate a different file set used in the

simulation. Overall, we concluded that SURGE was a reasonable tool for simulating repeatable, precise, and real-world workloads.

3.

Testing and Analysis Cycle

A number of simulation and analysis cycles were necessary in order to better understand the relationship between the self-similarity in simulated network traffic and the number of distinct files accessed during the simulation. Our first goal was to illustrate the resulting file and request size distributions and to demonstrate that the intended workload is reproduced when 99-100% of the distinct files were accessed. The second goal was to evaluate the behavior of network traffic self-similarity during a simulation when the desired workload was achieved and when it was not achieved. We collected and analyzed data that showed the variation in the expected workload versus the resultant workload. Next we assessed the Hurst parameter for several series where the load and job duration were held constant, where the job duration was held constant but the load was increased, and, last where the load was held constant but the job duration was increased. In all three scenarios, the number of distinct files accessed was noted.

4.

Hurst Value Sensitivity Results

Determining the job duration of the simulation was crucial in producing the desired simulated workload. Since the base workload was characterized by the distributions of those parameters defined in Table 1, the resulting simulation values should match the input values as close as possible. Data collected during prior research efforts suggested that the point at which the resulting distributions most closely match the input value was when all distinct files were accessed. To demonstrate this, eight tests were executed for one hour each with the load ranging from 300 UEs to 1350 UEs. The file size distribution input value for was 1.0 and the request size distribution input value for was 1.177. Input values for file and request size are represented using dashed lines. 75% of the available 2,000 distinct files were accessed during the 300 UE test and 99% were accessed in the 1350 UE test. Figure 1 illustrates the results of these tests.
Comparison of Distributions Input vs Simulated Output
1.6 1.5 1.4 1.3

Alpha

1.2 1.1 1 0.9 0.8 0.7 300 450 600 750 900 1050 1200 1350

File Size

Request Size

UEs

Figure 1. Comparison of Input vs. Simulated Output Distributions

In Figure 1, the upper tails of the file size distributions for the tests are 10% and 4% higher than the input values for the 300 and 1350 UE tests, respectively. The upper tails of the request size distributions are 22% and 20% higher than the input values for the 300 and 1350 UE tests, respectively. The simulation generated distributions that approached the input values as more of the distinct files were accessed. Assessing the distributions for file and request size at the point where all the available files were accessed required additional tests. Two series, of five tests each, were conducted. The load was held constant at 1200 UEs for each test and the job duration was increased from one hour to five hours. The first series of five tests had 600 UEs and the second series had 900 UEs. There were 2000 distinct files available. The 600UE test accessed 1907 of them during the one hour test and all 2000 files during the five hour test. The 900 UE test accessed 1976 distinct files during the one hour test and all 2000 files during the four hour test.
Comparison of Distribution 95-100% Distinct Files Accessed
1.6 1.5 1.4 1.3
600 UEs - File Size 600 UEs - Request Size 900 UEs - File Size 900 UEs - Request Size

Alpha

1.2 1.1 1 0.9 0.8 0.7 60 120 180 240 300

Minutes

Figure 2. Distribution results when all distinct files were accessed The tail of the file size distribution for the 600 and 900 UE, one hour, tests were 7% and 5% higher, respectively, than the input value. 95% and 99% of the distinct files were accessed for these 600 and 900 UE tests, respectively. Both series were within 2% of the input distribution for the file size when all 2000 files were accessed. The tail of the request size distribution for the 600 and 900 UE, 60-minute tests were 27% and 21% higher, respectively, than the input value. During the 300-minute test, the 600 UE test accessed all distinct files and the resultant distribution was 14% higher than the input value. The 900 UE test accessed all 2000 distinct files during the 240-minute test and the resultant distribution was only 9% higher. The evidence shown in both Figures 1 and 2 suggest the importance of selecting a job duration that ensures all distinct files are accessed. This raised questions concerning the impact on network traffic self-similarity using SURGE. One question was whether the degree of self-similarity was consistent given the same load and the same job duration. Another question was how does the job duration affect the burstiness in traffic. And finally, was this network traffic property sensitive to simulation executions that were too long, or not long enough. The next sections specifically address these questions. Our data indicated that SURGE produced consistent results for the degree of self-similarity in simulated network traffic. This was demonstrated by executing three series of six tests each.

The series job durations were selected according to the percentage of available distinct files accessed. The percentage accessed ranged between 97% and 100%. The Base series used the SURGE default distributions. Two series used distributions from real world examples, the first was extracted from [Crovella and Bestavros, 1997], and the second was developed from the Illinois Institute of Technology at Rice Campus Web site. Table 2 lists the defining characteristics for the Base series and both real world examples.
Series Name User Load (UEs) 1200 1100 1200 Job Duration (minutes) 40 5 210 # Distinct Files Mean Standard % (Hurst) Deviation Distinct (Hurst) Files Accessed 2000 97% 0.74 0.014 344 100% 0.798 0.006 4683 99% 0.818 0.01

Base IIT* BC*

Table 2. Series Characteristics *Real-world Examples Based upon the results of the above, the degree of self-similarity is relatively constant for the same load and the same job duration. Next, we investigated the relationship between the percent of distinct files accessed and the degree of self-similarity. To accomplish this we executed three separate series of tests. The first of these three series examined the Hurst value given the same load over an increased time frame. This would, in effect, increase the number of distinct files accessed. Eight tests were executed with a 60-minute job duration and a simulated user load ranging from 300 UEs to 1350 UEs. The number of distinct files accessed ranged between 87% and 99%. Figure 3 illustrates the increase of the Hurst value as both the load is increased and the number of distinct files accessed hits 99%.
Increased Load with Time Constant
1 0.9

Hurst Value

0.8 0.7 0.6 0.5 300 450 600 750 900 1050 1200 1350

# of User Equivalents

Figure 3. Increased Load with Time Constant The other two series produced similar results from a different perspective. For both series, the load was held constant and the duration of the job increased. As the time increased, so would the number of files accessed. Each series consisted of five tests. The first series had a 600 UE load and the second had a 900 UE load. The test job durations ranged from 60 to 300 minutes. The 60-minute, 600 UE load test accessed 95% of the distinct files and the 900 UE load test accessed 99% of the distinct files. With the 600 UE load, all files were accessed during the 300-

minute test. The 900 UE load accessed all files during the 240 minute test. Figure 4 depicts the impact on the degree of self-similarity.
Constant Load with Increased Time
0.9

0.8

Hurst value

0.7

0.6

0.5 60 120 180 240 300

Minutes
600 UEs 900 UEs

Figure 4. Constant Load with Increased Time The Mean Hurst value for the 600 UE series was 0.7006 with a Standard Deviation of 0.034. The Mean Hurst value for the 900 UE series was 0.7174 with a Standard Deviation of 0.02. The 600 UE series appears relatively stable beginning at 180 minutes with a Mean Hurst value of 0.721 and a Standard Deviation of 0.005. The 900 UE series appears stable at 120 minutes with a Mean Hurst value of 0.726 and a Standard Deviation of 0.01. 99.85% of the distinct files were accessed at exactly this point for both series. Based upon the results of the three series reflected in Figures 3 and 4, the job duration did in fact play a role in the degree of self-similarity and was dependent on all distinct files being accessed. It was clear from the above that it was important to select a job duration that would be long enough for all distinct files to be accessed. Therefore, the job duration could be too short to provide accurate Hurst value results. One question remained and that was whether the job duration could be too long. One last series was executed to investigate this. Empirical data indicated that 100% of the 344 distinct files for the IIT series were accessed in five minutes. Six tests comprised this series. The simulated user load was held constant at 1100 UEs and the job duration was increased from four minutes to 60 minutes. We chose to start the tests at the point prior to all distinct files being accessed and then to monitor the behavior of the Hurst parameter beyond that point. Figure 5 shows the results.
100% Distinct Files Accessed Over Time
0.82 0.8 0.78

Hurst value

0.76 0.74 0.72 0.7 0.68 0.66 4 5 15 30 45 60

Minutes

Figure 5. 100% Distinct Files Accessed Over Time

Figure 5 suggests that executing a simulation longer than necessary impacts the results of the Hurst value. We offer as an explanation that once SURGE proceeds through the entire list of distinct files and then begins to repeat the list, the resultant workload would be different than specified by the input. Therefore, we recommend that the total number of distinct files selected be accessible within a reasonable time period, and second, that the tester execute preliminary tests in order to converge on the appropriate job duration for the succeeding tests.

5.

Conclusion

We have spent considerable effort understanding and validating SURGE. We believe that this tool offers a reasonable approach for those who wish to simulate realistic Web server workloads as well as those network designers who are searching for a tool that could be applied for general purposes such as simply generating network traffic with self-similar properties. Our work has shown that this tool produces repeatable, precise and realistic results. However, proper use is important. Care must be taken in selecting the appropriate job duration for the simulations. All the distinct files must be accessed during the simulation. Convergence on the simulation time frame should be done prior to the actual simulations. If this is not done, the Hurst value result will be skewed and will not reflect the burstiness associated with the intended workload. Our efforts will continue by further researching the sensitivity between the degree of selfsimilarity and workload parameter distributions.

6.

References

Barford, P. and Crovella, M. (1998), "Generating Representative Web Workloads for Network and Server Performance Evaluation", 1998 ACM Sigmetrics Conference Performance Review Proceedings, pp. 151-160. Barford, P. and Crovella, M. (1999), "Measuring Web Performance in the Wide Area", Boston University, BU-CS99-0004. Barford, P., Bestavros, A., Bradley, A., and Crovella, M. (1999), Changes in Web Client Access Patterns Characteristics and Caching Implications, World Wide Web, Special Issue on Characterization and Performance Evaluation, Vol. 2, pp. 15-28. Crovella, M.E. and Bestavros, A. (1997), Self-similarity in World Wide Web Traffic: Evidence and Possible Causes, IEEE/ACM Transactions on Networking, Vol. 5, No. 6, pp. 835-846. Evans, M., Hastings, N., and Peacock, B. (1993), Statistical Distributions, 2nd Edition, John Wiley & Sons, New York, NY. Leland, W. E., Taqqu, M. S., Willinger, W., and Wilson, D. V. (1995), On the Self-Similar Nature of Ethernet Traffic (extended version), IEEE/ACM Transactions on Networking, Vol. 2, No. 1, pp. 1-15. Paxson, V., and Floyd, S. (1995), "Wide Area Traffic: The Failure of Poisson Modeling", IEEE/ACM Transactions on Networking, Vol. 3, No. 3, pp. 226-244. Veitch, D., and Abry, P. (1999), A Wavelet Based Joint Estimator of the Parameters of Long-Range Dependence, IEEE Trans. Info. Th., special issue on Multiscale Statistical Signal Analysis and its Applications, Vol. 45, No. 3, pp. 878-897.