evaluation of dial-up behaviour of internet...
TRANSCRIPT
Evaluation of dial-up behaviour of Internet usersDipl.-Ing. Johannes F rber1, Dipl.-Ing. Stefan Bodamer1, Dipl.-Ing. Joachim Charzinski2
1 University of Stuttgart, Institute of Communication Networks and Computer Engineering (IND), Germany2 Siemens AG, Public Communication Networks, Germany
Abstract
In times of Internet access becoming a popular consumer application even for „normal“ residential users, sometelephone exchanges are congested by customers using modem or ISDN dial-up connections to their InternetService Providers. In order to estimate the number of additional lines and switching capacity required in anexchange, the Internet access traffic must be characterised in terms of holding time and call interarrival timedistributions. In this paper, we analyse six months worth of log files tracing the usage of the central modem pooland ISDN access lines at University of Stuttgart. Mathematical distributions are fitted to the measured data andthe fit quality is evaluated with respect to the blocking probability observed in a multiple server loss systemloaded by the described traffic.
1 Introduction
Internet access, especially for WWW based services isbecoming a popular application with residential aswell as business users. While business users are oftenconnected to the Internet via leased lines, mostresidentials use the local telephone network toestablish a dial-up connection to their Internet ServiceProvider (ISP). Apart from seizing a modem in theISP’s modem pool, each dial-up connection occupiesone telephone line in a local exchange. In order toevaluate the additional traffic load imposed on atelephone exchange by Internet access traffic, thetraffic characteristics must be well known.In this paper, we present an analysis of the Internetaccess traffic logged at a modem pool (56 modemsshared by 3620 students) and an ISDN line accesspool (30 B channels shared by 372 users) at theUniversity of Stuttgart computing centre (RUS). Data
were collected during six months from May throughOctober 1997 with a resolution of one minute (modempool) or one second (ISDN access). Section 2describes the mean and distribution of holding timesas well as access call interarrival times and theresulting daily traffic load. In Section 3, differentmathematical distribution functions are fitted to theholding time and call interarrival time distributions. InSection 4, the fit quality is evaluated by comparing theblocking probability observed by loading differentnumbers of servers (i.e. phone lines) with randomtraffic generated according to the fitted distributions.
2 Session Behaviour
The automatic monitoring of user login times at thedial-up access service of the University of Stuttgartallows the evaluation of characteristic measures onsession level. The data allow to distinguish betweenmodem users and ISDN users. Note that there is noway to specify the type of traffic the user has started.While in most cases it can be expected to be a WorldWide Web session, it may also be a telnet session, anftp retrieval, , an email transfer or a mix of thosetraffic types.In the following sections we describe the holding timeof the sessions, the interarrival time between sessionstarts and the mean daily traffic profile for traffic load.These measures allow to characterise the frequencyand duration of a typical user session.
2.1 Holding Time
By the holding time of a session we mean the durationof the seizure of an access line. The mean holdingtime for modems was 21 minutes while ISDN users
5
10
15
20
25
30
35
40
0 4 8 12 16 20 24
mea
n ho
ldin
g tim
e (a
t sta
rt o
f ses
sion
) [m
in]
hour of day
modem workdaysmodem non-workdays
isdn workdaysisdn non-workdays
Fig. 1: Session holding time during course of the day
were online for an average of 11 minutes. The holdingtime shows a high variability, i.e. it varies stronglyand reaches a maximum of as much as 4 days.Also, the average holding time varies during thecourse of the day. Fig. 1 shows the average holdingtimes of sessions of both user groups associated withthe time of the session start for each hour of the day.Although this representation has to be regarded withcaution (the average during the night is calculatedfrom a relatively small number of sessions), it allowsthe conclusion that long sessions start mainly duringthe night and early morning hours. The mean sessionlength at night is significantly larger than during daytime. Sessions on non-workdays are longer in theaverage. Note that sessions of ISDN users seem to bemuch shorter than those of modem users. Anexplanation for this is given in Section 2.2.In [8] Morgan reports a significant peak in holdingtime at 4 a.m. If the holding time is associated with thesession endings, a similar peak is observed in our dataat 4 a.m. This means that among sessions ending inthe early morning have lasted for a long time.The high variability of the holding time is visible inthe complementary cumulative distribution function(ccdf) which is depicted in Fig. 2. The function showsthe probability of the holding time being greater thanthe value on the horizontal axis. While there is a highprobability for short sessions, the logarithmic presen-tation reveals that there is a small but not negligibleprobability for very long sessions of 20 hours andmore. This so called „heavy tail“ is an indication forhigh variability of large values [4]. The coefficient ofvariation (CoV) of the holding time data is around 2.5for modem and 2.2 for ISDN based access.The shift of the average holding time during thecourse of the day shown in Fig. 1 suggests that theinstationarity of mean holding times contributes to thehigh variation of the overall holding time distribution.
Therefore, the variability of the holding time mightnot be as high if a shorter period is regarded instead ofthe whole day. In Fig. 3 we present the ccdfs of theholding times of only several specific hours of a day(the most interesting busy hours, see section 2.3). Thecoefficients of variation for those periods are in factsmaller, but not much, i.e. the „heavy tail“ is stillvisible.
2.2 Interarrival Time
In our context, the session interarrival time is the timebetween two consecutive session beginnings of theaggregate traffic as seen by the access provider. Thismeans that blocked calls are not detected and thatsession arrivals are not to be confused with callattempts.The mean session interarrival time was 44 seconds formodem sessions and 110 seconds for ISDN sessions.To allow a comparison, those absolute numbers have
10-5
10-4
10-3
10-2
10-1
100
0 4 8 12 16 20 24
CC
DF
= P
{ h
oldi
ng ti
me
> t
}
time t [hours]
modemisdn
Fig. 2: Session holding time ccdf
10-4
10-3
10-2
10-1
100
0 60 120 180 240 300 360 420 480
CC
DF
= P
{ h
oldi
ng ti
me
> t
}
time t [min]
0:00-24:00 mean=10.60min CoV=2.2110:00-11:00 mean= 6.60min CoV=1.8822:00-23:00 mean=15.50min CoV=1.91
Fig. 3: Session holding time ccdf in different periodsof the day (ISDN only)
0
0.5
1
1.5
2
2.5
3
3.5
0 4 8 12 16 20 24
arriv
al r
ate
per
user
[1/d
ay]
hour of day
modem workdaysmodem non-workdays
isdn workdaysisdn non-workdays
Fig. 4: Session arrival rate during course of the day
to be put into context to the number of users produ-cing the summary traffic. Therefore the values in thefollowing two figures are related to the correspondingnumbers of users.
10-4
10-3
10-2
10-1
100
0 5 10 15 20 25 30 35
CC
DF
= P
{ in
tera
rriv
al ti
me
* nu
mbe
r of
use
rs >
t }
time t [days]
modemisdn
Fig. 5: Scaled ccdf of session interarrival time
10-4
10-3
10-2
10-1
100
0 5 10 15 20 25 30 35 40 45 50
CC
DF
= P
{ in
tera
rriv
al ti
me
> t
}
time t [min]
0:00-24:00 mean=2.24min CoV=1.7610:00-11:00 mean=2.03min CoV=1.1322:00-23:00 mean=1.44min CoV=1.37
Fig. 6: Session interarrival time ccdfs in differentperiods of the day (ISDN only)
Fig. 4 depicts the session arrival rate per user (thereciprocal of the interarrival time) during the course ofthe day. It shows that only a few sessions start in theearly morning hours and that most sessions take placeduring the day and evening hours. The significant stepat 6 p.m. on workdays is due to the cheaper telephonetariff starting at that hour in Germany. There is aremarkably high number of sessions starting in the latenight.It can be seen that ISDN users cause a much highercall rate than modem users. When considering thearrival rates together with mean holding times (Fig.1), it is clear that the overall session lengths per userand per day are roughly identical for modem andISDN users. The fast and easy setup of connections
via ISDN seems to lead to a different user behaviour,i.e. more but shorter sessions are generated.Again we find a high variability for the interarrivaltime ranging from zero to several hours. The scaledccdf in Fig. 5 also shows the typical heavy tail. Fromthe above, it is obvious that modem sessions have ahigher probability for longer interarrival times thanISDN sessions.Note that this presentation is only valid for thedescription of summary traffic of multiple users. Asreported in [6], the ccdfs of the interarrival time ofsessions of an individual user show significantperiodic steps every 24 hours.Similar to the preceding section, we present the ccdfsof interarrival times during several specific hours onlyin Fig. 6. The ccdf for the period between 10 a.m. and11 a.m. is almost an exponential function (a straightline in the logarithmic presentation). The correspon-ding coefficient of variation is much smaller than e.g.between 10 p.m. and 11 p.m. where we still observe ahigh variability.
2.3 Traffic Load
To cope with the originated traffic, a telephone net-work must offer sufficient resources in terms of band-width (i.e. telephone lines) and connection setup capa-city (i.e. processing power). Therefore we distinguishbetween traffic load related to user traffic (the seizureof the modem lines and ISDN channels) and signallingload, corresponding to the call arrival rate, to describethe actual load of the access network.
0
0.2
0.4
0.6
0.8
1
0 2 4 6 8 10 12 14 16 18 20 22
Erla
ng p
er li
ne
hour of day
modem workdaysmodem non-workdays
isdn workdaysisdn non-workdays
Fig. 7: Mean daily traffic profile
While the average signalling load can be seen in Fig.4, the user traffic load is shown in Fig. 7. By depictingthe traffic load per line, the utilisation of both servicescan be compared. While the 30 channels of the ISDNservice are sufficient for 370 users, 56 modems areobviously not enough for the 3600 students. The flat
shape of the modem traffic load around midnightindicates that all modem lines were busy on most daysand it can be assumed that many calls have beenblocked.The general shape of the profiles is almost comple-mentary to the typical telephone traffic profile, whichhas its busy hour from 10 a.m. to 11 a.m. and only asmall traffic load in the evening and during the night.The most striking characteristics of the traffic profileare the two steps at 6 p.m. and 9 p.m. on workdays. Asmentioned above, these times mark the beginning ofcheaper telephone tariffs during the observed period.The boundaries of the tariff periods are drawn asvertical lines. A small peak is also visible right before9 a.m., when the expensive day tariff starts. Onweekends and holidays this day tariff between 9 a.m.and 6 p.m. is does not exist and only a sharp increasein traffic load at 9 p.m. can be observed. The userbehaviour follows the telephone tariffing schemeamazingly accurately.The time consistent busy hour for user traffic load isfound at 10 p.m. but for the arrival rate it is foundearlier at 6 p.m. In [3] Bolotin points out that thesetwo busy hours are significantly shifted against eachother for Internet traffic compared to telephone traffic.The phenomenon is caused by much longer holdingtimes of around 20 minutes compared to 3 minutes forclassical telephone calls.
3 Modelling Session Behaviour
For performance evaluation of communicationsystems by performance analysis or simulation, sourcetraffic has to be modelled to assess the system beha-viour. Complex traffic is best described with the helpof empirical data. Either a logged traffic trace isreplayed into the system model, or a mathematicaldescription can be found to generate stochastic trafficof similar characteristics.To describe traffic load on session level, it isimportant to know about the holding time and thesession interarrival time. The complementary cumu-lative distribution functions of these measures capturetheir most important characteristics. If mathematicalfunctions can be found that describe the ccdfs, theycan be used for performance evaluation.While the classical telephone traffic is appropriatelydescribed with negative-exponentially distributedholding times and call interarrival times, this is nolonger true for Internet access session traffic anymore. The high variability of the measures describedabove is not captured by this distribution. For a moreaccurate description of the new traffic other distri-butions have been proposed like Pareto, hyper-exponential, Weibull or lognormal, e.g. in [1], [2], [5],[7].
In a previous attempt to describe the ccdfs, we used aleast square fitting algorithm to fit some of thedistributions mentioned above to the empirical ccdfs[6]. Although the results looked quite good, they wereby far inferior to the exponential distribution if usedfor the simulation of a loss system.
Exp. f tm
t
m( ) exp=
1
Hyperexp.(order k)
( )f t p ti i ii
k
( ) exp== 1
Log-normal
( )f t
t
t( ) exp
ln=
1
2 2
2
2
Weibull f t tt
( ) exp= 1
Tab. 1: Probability density functions for exponential,hyperexponential, lognormal and Weibull
In this paper we fit the above mentioned distributionsby calculating their parameters from the mean and thecoefficient of variation given by the empirical ccdfsinstead. Tab. 1 shows the mathematical formulae forprobability density functions of the most promisingdistributions, which can easily be determined by meanand CoV. Also, we evaluate the ccdfs for the mostcritical periods of the day, i.e. the busy hours. Tab. 2shows the mean and CoV of the ccdfs for these cases,which are also depicted in Fig. 3 and in Fig. 6.For simplicity and because of a much better granu-larity of the raw data, the following sections deal onlywith the modelling of ISDN sessions.
mean [min] CoVinterarrival time:
0 a.m. - 12 p.m.10 a.m. - 11 a.m.10 p.m. - 11 p.m.
2.242.031.44
1.761.131.37
holding time:0 a.m. - 12 p.m.
10 a.m. - 11 a.m.10 p.m. - 11 p.m.
10.606.60
15.50
2.211.881.91
Tab. 2: Mean and coefficient of variation forinterarrival time and holding time (ISDN)
Fig. 8 and Fig. 9 shows the resulting ccdfs for theholding time and the interarrival time, respectively,between 10 p.m. and 11 p.m. in comparison to theempirical distribution. All functions have the samemean and variability (except the exponential distri-bution with a CoV of 1). The corresponding figures
for the whole day and for 10 a.m. - 11 a.m. are not de-picted but look very similar.
10-4
10-3
10-2
10-1
100
0 60 120 180 240 300 360 420 480
CC
DF
= P
{ h
oldi
ng ti
me
> t
}
time t [min]
Trace (mean=15.50min, CoV=1.91)NegExp
HyperExp 2Lognormal
Weibull
Fig. 8: Fitted functions to ccdf of the session holdingtime between 10 p.m. and 11 p.m.
10-4
10-3
10-2
10-1
100
0 5 10 15 20 25 30 35 40 45 50
CC
DF
= P
{ in
tera
rriv
al ti
me
> t
}
time t [min]
Trace (mean=1.44min, CoV=1.37)NegExp
HyperExp 2Lognormal
Weibull
Fig. 9: Fitted functions to ccdf of the sessioninterarrival time between 10 p.m. and 11 p.m.
All fitted ccdfs in both diagrams are quite close to theemprical ccdf in the range of small values for holdingand interarrival time, respectively. The distributiontails, however, can only be approximated reasonablywell by the lognormal distribution, while the otherfitted ccdfs do not capture the „heavy tail“ effect.
4 Performance Evaluation
The fitting results are validated for the case of asimple G/G/n loss system as it is often used to modelcommunication systems. In this model, n representsthe number of servers which could be, e.g., modems,ISDN cards, or access lines.
In the case of an M/M/n system where interarrival andholding times are both assumed to be exponentiallydistributed, the loss probability B can be obtainedanalytically using the well-known Erlang loss formula:
B
An
n
Ai
i
n
i
=
=
!
!0
where A denotes the offered load defined as the ratioof mean holding time and mean interarrival time.If interarrival and holding times are described bydistributions different from the exponential dis-tribution, simulations are used to obtain the lossprobabilities. This is the case for the empirical distri-butions obtained from the trace evaluation (seeSection 2) as well as for the approximating distri-butions of hyperexponential, lognormal and Weibulltype found in Section 3.
4 6 8 10 12 14 16 18 20number of servers
10-6
10-5
10-4
10-3
10-2
10-1
100
loss
pro
babi
lity
MeasurementNegExpHyperExp2LognormalWeibull
Fig. 10: Loss probability for 0 a.m. -12 p.m. traffic
2 4 6 8 10 12 14 16number of servers
10-6
10-5
10-4
10-3
10-2
10-1
100
loss
pro
babi
lity
MeasurementNegExpHyperExp2LognormalWeibull
Fig. 11: Loss probability for 10 a.m. -11 a.m. traffic
12 14 16 18 20 22 24 26 28 30number of servers
10-6
10-5
10-4
10-3
10-2
10-1
100
loss
pro
babi
lity
MeasurementNegExpHyperExp2LognormalWeibull
Fig. 12: Loss probability for 10 p.m. -11 p.m. traffic
The results of the performance analysis and simulationfor the empirical and the fitted distributions for theperiods of the day presented in Section 3 are depictedin Fig. 10, Fig. 11, and Fig. 12. The correspondingdistribution type indicated for each curve in thediagrams is related to both interarrival and holdingtimes.For all investigated periods of the day it becomesobvious that the M/M/n approximation using negative-exponential distributions underestimates the actualloss probability. An underestimation of the lossprobability means that a dimensioning based on theM/M/n loss system would give a value for thenecessary number of servers which is too small. Theeffect is most significant in the case referring to thewhole day traffic, but also for the period from 10 p.m.to 11 p.m.The Weibull approximation evolves to give the mostexact results in all three cases. The hyperexponentialdistribution yields a conservative approximation, i. e.the loss probability curve is quite close to thatassociated to the empirical distribution but always alittle bit above. The results obtained for the lognormaldistribution on the other hand are also quite exact, buttoo optimistic.
5 Conclusion
We have presented the dial-up behaviour of modemand ISDN users at the University of Stuttgart. Majorresults of the data evaluation are:• the same long holding times as reported by other
researchers have been observed,• ISDN users generate more but shorter sessions
(likely due to fast setup),• the dial-up usage follows the telephone tariffing
scheme with high accuracy (the Internet accessitself was provided for free) and
• the session interarrival time and the sessionholding time show very high variability (heavytailed distributions)
The presented results are based on empirical data of aspecial user group, i.e. the students and members ofstaff of the University of Stuttgart. Although thisgroup might not represent the general Internet user, itdoes represent a large group of users going onlineafter work hours.The empirical ccdfs of interarrival time and holdingtime during the busy hours were approximated byfitting several distributions. The fit was based on themean and the coefficient of variation instead ofapplying a least square fit as it was done in an earlierwork.The quality of the fitted distributions has been provenby the performance evaluation of a simple loss system.The models with Weibull and the hyperexponentiallydistributed interarrival and holding times gave the bestapproximations of the loss probability compared tothe empirical distributions.
6 References
[1] Bolotin, V.A.: Telephone Circuit Holding TimeDistributions, Proceedings of the ITC 14, pp.125-134, Antibes, France, 1994.
[2] Bolotin, V.A.: Modelling Call Holding TimeDistributions for CCS Network Design andPerformance Analysis, IEEE Journal on SelectedAreas in Communications, pp. 433-438, April1994.
[3] Bolotin, V.A.: New Subscriber Traffic VariabilityPatterns for Network Traffic Engineering, Pro-ceedings of the 15th International TeletrafficCongress ITC 15, Vol. 2, pp. 867-878, Washing-ton, 1997.
[4] Crovella, M., Bestavros, A.: PerformanceCharacteristics of World Wide Web InformationSystems, Tutorial at the SIGMETRICS‘97, 1997.
[5] Crovella, M., Bestavros, A.: Self-Similarity inWorld Wide Web Traffic: Evidence and PossibleCauses“, Proceedings of the ACM SIGME-TRICS`96, pp. 160-169, 1996.
[6] F rber, J., Bodamer, S., Charzinski, J.: Measure-ment and Modelling of Internet Traffic at AccessNetworks, EUNICE’98, Munich , 1998.
[7] Feldmann, A., Whitt, W.: Fitting mixtures ofexponentials to long-tailed distributions toanalyze network performance models, Perfor-mance Evaluation 31, pp. 245-179, 1998.
[8] Morgan, S.: The Internet and the Local Tele-phone Network: Conflicts and Opportunities,IEEE Communications Magazine, pp. 42-48,January 1998.