Internet Measurement Conference 2003

Source-Level IP Packet Bursts: Causes and Effects

Hao Jiang Constantinos Dovrolis

(hjiang, dovrolis@cc.gatech.edu)

College of ComputingGeorgia Institute of Technology

Main questions

Source-level burst: several IP packets sent back-to-back from the source of an individual flow Strongly correlated packet interarrivals within a flow

Which are the causes of source-level bursts? Identify several protocol/application causes

Can source-level bursts create scaling in short timescales? Yes, in timescales that correspond to duration of bursts

What is the impact of source-level bursts on queueing performance? Increased maximum backlog and queue-size tail

distribution

Causes of source-level bursts

UDP message segmentation Unused congestion window increases Packet reordering Idle restart timer bug Bursty applications Cumulative or lost ACKs Slow start Loss recovery with Fast Retransmit ACK compression

UDP message segmentation in multiple IP packets/fragments

• Normally, if sender stays idle for more than certain timer, TCP should restart in slow start

• Otherwise, entire window can be sent back-to-back

Multi-Resolution Analysis of traffic process

Time series of traffic process at scale Tj=2jT0 :

Amount of traffic in

Energy at scale Tj:

Compute energy plots using wavelet-based MRA tool (Darryl Veitch)

,...1,0},,{ jZkX jkjX

])1(,[ jjjk TkkTt

)](2[

][112

12

2/

jk

jk

j

jkj

XXVar

dVarΕVariance of Haar wavelet coefficients at scale Tj

Scaling behavior and energy plots

Short-time scaling vs long-time scaling Short-time scaling corresponds to sub-RTT timescales

Packet-train model of source-level bursts

Parameters: L, C, N, Toff

Correlated packet interarrivals within burst All bursts have same characteristics Ignore all other correlations

Source-level bursts cause short-time scaling

Energy plot Scaling from L/C to

NL/Cwith slope 2.0

Autocorrelation function Linearly decreasing

correlations up to NL/C

Burst detection in packet traces

Detect burst as sequence of packets from a single flow that arrives at trace point with burst rate ≈ pre-trace capacity

NOTE: we may detect more than source-level bursts

How to estimate pre-trace capacity? Estimate minimum-capacity on the path

between source host and trace-point Use packet pair dispersion technique

Apply only to equal-sized packets

TCP sends many packet pairs due to delayed-ACK algorithm

Example of pre-trace capacity distribution

Observe modes at 1.5Mbps, 10Mbps, 45Mbps, and 100Mbps

What if there were no bursts?

Modify trace by “spreading” detected burst: Uniform respacing of packets within burst Not possible in practice

Effect of bursts on short-time scaling

Decreases scaling exponent to almost zero in sub-RTT timescales

But not entirely..

Effect of bursts on queueing performance

Significant reduction of maximum backlog in moderate utilization (infinite-buffer model)

Effect of bursts on queueing performance

Faster decrease of queue-size tail probability

Conclusions

Various protocol/applications mechanisms create source-level bursts

Source-level bursts can cause short-time scaling in Internet traffic But they are not the only reason

Removal of bursts would decrease scaling in sub-RTT timescales and would improve queueing performance

More recent work: Effect of self-clocking on short-time scaling Effect of TCP pacing and TB-shaping on short-time scaling

Unused congestion window increase

ACK reordering

Cumulative or lossed ACKs

Loss recovery with fast retransmission

ACK compression

Bursty application

• Slow start can cause bursts when W < CT

C: capacity of source & path, T: Round-Trip Time