Performance evaluation and comparison of four network packet rate estimators

Performance evaluation and comparison of four network packet rate estimators

¨ ) 64 (2010) 1015–1023 Int. J. Electron. Commun. (AEU Contents lists available at ScienceDirect ¨) Int. J. Electron. Commun. (AEU journal homepage:...

911KB Sizes 2 Downloads 52 Views

¨ ) 64 (2010) 1015–1023 Int. J. Electron. Commun. (AEU

Contents lists available at ScienceDirect

¨) Int. J. Electron. Commun. (AEU journal homepage: www.elsevier.de/aeue

Performance evaluation and comparison of four network packet rate estimators K. Salah , F. Haidari Department of Information and Computer Science, King Fahd University of Petroleum and Minerals, PO Box 5066, Dhahran 31261, Saudi Arabia

a r t i c l e in fo

abstract

Article history: Received 1 April 2009 Accepted 26 August 2009

This paper presents and compares the performance of three popular packet rate estimators used in predicting the rate of incoming traffic to a network host. The paper proposes a fourth and novel packet rate estimator. Unlike other estimators, the proposed estimator is cost effective as its computation is simple and is not performed upon the arrival of every incoming packet. We evaluate and compare the quality and performance of all estimators in terms of accuracy, agility, stability, and cost. The performance evaluation is primarily conducted by using discrete-event simulation. Our simulation accounts for constant traffic as well as synthesized bursty traffic with empirical packet sizes. We also implement and measure the actual computational cost of two time-window based estimators. The cost is measured in terms of consumed CPU cycles for packet and bit rate estimations. In addition, we investigate how to optimize the performance of our proposed estimator by examining the impact of tuning its key configurable estimation parameters. & 2009 Elsevier GmbH. All rights reserved.

Keywords: Traffic rate estimation Packet rate estimators Time sliding window Exponential averaging Bursty traffic

1. Introduction In data networks, several network services and components (such as network traffic management, monitoring and calladmission control) require estimation of the incoming traffic rate. In call admission control (CAC), the rate of the flows are monitored at the access points of the network in order to make decisions on admitting new flows [1]. For providing QoS-enabled Internet, the rates of current flows are also monitored for traffic policing to ensure senders comply with their SLAs (service level agreements). SLA defines the traffic characteristics (especially the traffic rate) expected from the sender. Other than call admission control and policing, rate estimation is also an integral part of link-sharing [2] and fair scheduling algorithms [3] which are utilized in DiffServ (differentiated services) and RSVP (reservation protocol) [4]. All prior estimators proposed in [1–4] were originally designed for estimating bit arrival rate. However, little research has been done on estimating packet arrival rate. Estimators of packet arrival rate can be very useful and attractive in a variety of applications in networking and communications. The computation of packet rate is much simpler than bit rate as it does not depend on accumulation of packet sizes. In addition, a packet rate estimator can be designed to perform estimation at a periodic rate, as is the case for our proposed estimator. Our proposed estimator is simple

 Corresponding author. Tel.: + 966 3 860 4493; fax: +966 3 860 2174.

E-mail address: [email protected] (K. Salah). 1434-8411/$ - see front matter & 2009 Elsevier GmbH. All rights reserved. doi:10.1016/j.aeue.2009.08.005

and does not depend on interarrival time measurements of packets and running estimation at every packet arrival, but utilizes a fixed-time window. This can be an indispensable design option for network elements of sensor networks nodes as well as PC-based routers and servers. Nodes in sensor networks are typically limited in computational power and energy. For PCbased routers and typical workstations and servers, avoiding summing up packet sizes and computation at every incoming packet will result in better overall performance. And more importantly, the NIC (network interface card) of these systems typically does not timestamp the arrival of each packet, and timestamping has to be performed by the kernel during interrupt handling of packet reception. This requires considerable overhead and cannot be done in the default interrupt handling schemes of FreeBSD polling and Linux NAPI (new application programming interface) where interrupts of received packets are disabled. The applications of packet arrival rate estimators have been on the increase recently. In [5], optimal routes through sensor network elements and optimal wakeup rate to minimize energy consumption are determined on the basis of the incoming packet arrival rate to sensor nodes. In [6], an adaptive rate-scheduling based on the estimation and prediction of packet arrival rate has been proposed for minimizing QoS degradations in next generation CDMA wireless mobile systems. In [7], a queue management technique based on packet arrival rate was introduced for routers and switches to provide end-to-end high performance DiffServ QoS. In [8], the packet arrival rate of incoming traffic is utilized in a dynamic weighted fair queueing scheduler of routers. The

1016

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

weight gets adjusted dynamically, on the basis of the estimated packet arrival rate of each flow. In [9], an enhanced scheduling scheme of time-varying fair queueing (TVFQ) was proposed, using dynamic weights that get set according to estimated packet arrival rate. In [10], estimated packet rate is used to identify abnormal activities and attacks. In [11], estimated packet rate is used to reduce power consumption of network devices such as LAN (local area network) switches. An interface on a switch can go to sleep (thereby saving power) if the estimated next arrival time is long enough. In [12–14], estimation of packet arrival rate is required for the implementation of a hybrid interrupt handling scheme that can result in high performance of network servers with Gigabit Ethernet links. The hybrid interrupt handling scheme is a combination of two modes: normal interruption and polling. The switching between these two modes depends on the estimated packet arrival rate. The packet arrival rate estimators reported in [5–9] employ typically an exponentially weighted moving average, described and named later in the paper as the static EWMA as it has a constant weight. In this paper, we describe and study a total of four different packet arrival rate estimators, including the static EWMA. One of these estimators, later called time-windowbased EWMA, is a novel estimator that we propose. The performance and quality of these estimators are evaluated and compared. The performance is studied in terms of important estimation metrics that include agility, stability, accuracy, and cost. Agility defines the quickness of the estimator in following the changes in the actual data rate of the traffic. Stability (or smoothing) refers to the ability of the estimator to ignore shortterm changes or peaks of traffic. Accuracy refers to the difference between the estimated and the actual data rates of the traffic. Finally, the cost refers to the complexity of the algorithm and the required computational time and memory. In other words, a costeffective estimator has to be simple and fast, and it does not need to store much data. In previous work [15], we presented a preliminary and brief performance evaluation of our proposed simple packet estimator. This paper is a major extension and differs from [15] in significant ways. This paper discusses the four major estimators in greater detail. The comparison is far more elaborate, particularly for accuracy, cost, and bit-rate performance. Performance results are given for both packet and bit rate estimations. In addition, this paper presents and compares the actual cost measurements taken from real implementation of two timewindow based estimators. The cost in terms of consumed CPU cycles is measured for both packet rate estimation and bit rate estimation. This paper also addresses the issue of optimizing the performance of our proposed algorithm by tuning some of its key configurable parameters. Specifically, the impact on overall performance of tuning the key parameters of time-window size and weight is studied and analyzed. The impact on performance is studied in terms of agility and stability. Also, a related work is the implementation of our proposed estimator in [16]. In [16], we implemented the estimator to be an integral part of the Linux 2.6.15 kernel, and we evaluated its performance by subjecting a Linux host to a highly fluctuating and bursty traffic produced from publicly available traffic generators. Unlike the work in [16], the work presented in this paper fills in the gap and addresses the critical issue of how our proposed estimator compares to other popular packet rate estimators. Unlike [16], the study presented in this paper is a performance evaluation and comparison by using simulation (and not by using experimentation) of a total of four estimators (and not only one estimator). The rest of the paper is organized as follows. Section 2 describes the algorithms of four packet rate estimators. Three of

these estimators are modified versions of popular bit rate estimators. The fourth estimator is proposed by the authors. Section 3 compares the performance of the four estimators in terms of accuracy, stability, agility, and cost. Section 4 studies optimizing the performance of the proposed estimator by examining the impact of selecting different values for key design estimation parameters. Section 5 concludes the study.

2. Packet rate estimators This section describes the algorithms of four estimators that can potentially be utilized in estimating the average packet arrival rate. Three of these estimators are popular, and were originally used in estimating bit rates, and their algorithms depend on the computation of the received bit count. We modified the algorithms (or engines) of these three estimators to be packet rate estimators so that they depend on the computation of the received packet count instead of bit count. The fourth estimator is a novel packetrate estimator, which we propose in this paper. This estimator is designed and written from the ground up to estimate packet rates, and depends on computing the received packet count. Our proposed algorithm is simple and does not depend on the measurement of the interarrival times or computation upon the arrival of every packet, and yields acceptable performance in terms of accuracy, stability and agility. It is worth noting that all of the three popular estimators, that were originally designed to estimate bit rates, are modified to estimate only packet rates. The modification is made by eliminating all computational steps related to counting the received bits, which are typically determined by reading packet size headers of every incoming packet. Such a modification would provide a uniform estimation engine among all estimators including our proposed one, thereby giving a valid and sound performance comparison. Counting the received bits is costly and computationally expensive, as it consumes considerable CPU cycles. Such counting essentially requires additive operations as well as I/O and memory reads to index and find the packet-size header, and then reading the actual size of each incoming packet. 2.1. TSW TSW (time sliding window) is a time-based estimator that employs a rectangular data weighting function based on a fixed size time window. It essentially estimates the rate upon packet arrival and decays, or forgets, the past history over time. Algorithm 1 shows the modified version of the estimator presented in [17,18] to estimate packet rate. The algorithm in [17,18] was modified to exclude packet size calculations. The agility and stability of TSW depend on the size of the time window Win_length (initialized to a constant value in Line 2). If Win_length is small, the estimator will be more agile as the past takes less weight so that it can follow the new changes in the traffic rate quickly. On the other hand, if Win_length is large, the estimator will be more stable as the past takes more weight so that it can forget the short peaks which are very brief and only temporary. The variable now (shown in Lines 8 and 9) is the time of the current packet arrival. The variable T_front (initialized in Line 4) is the time of the last packet arrival. It is worth noting that computation of TSW estimator is performed on each packet arrival and measurements of interarrival times are required, and therefore may result in a considerable overhead, especially at high rate. In Ethernet of Gigabit link, the rate can go up to 1.4 million pps (packets per second)!

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

Algorithm 1. TSW 1: Initialization: 2: Win_length= a constant 3: Avg_rate= 0 4: T_front=0 5: For each packet arrival do { 6: Pkts_in_TSW=Avg_rate  Win_length 7: New_pkts = Pkts_in_TSW+ 1 8: Avg_rate= New_pkts/(now T_front + Win_length) 9: T_front=now 10: } 11: return Avg_rate

2.2. Static EWMA The static EWMA (exponentially weighted moving average) is a popular exponentially weighted moving average that is utilized in [2,11,17]. It has the typical constant weight a which is a tunable parameter that is used for forecasting or estimation, and it takes a value between 0 and 1. Each new estimated value depends on the current observation and the past observations (history). If a is equal to 1 then the previous observations are ignored entirely; if it is equal to 0, then the current observation is ignored entirely, and the estimated value consists entirely of the previous estimated value, which in turn is computed from the smoothed observation before it, and so on. Algorithm 2 illustrates the packet arrival rate estimator by using static EWMA. It is to be noted that this estimator depends on the measurement of interarrival times and computation at every incoming packet (as shown in Lines 5 and 6), and thus requires more computational power and measurements, as is the case in TSW. As in Algorithm 1, Line 5 shows that estimation is performed upon the arrival of every incoming packet. Algorithm 2. Static EWMA 1: Initialization: 2: a = a constant weight factor 3: Avg_rate= 0 4: T_front=0 5: For each packet arrival do { 6: interarrival=now T_front 7: Avg_rate= (1  a)  Avg_rate+ a  (1/interarrival) 8: T_front=now 9: } 10: return Avg_rate

2.3. Dynamic EWMA

Algorithm 3. Dynamic EWMA 1: Initialization: 2: aopt =a constant to represent the optimal weight 3: amax = a constant to represent the maximum weight 4: Avg_rate = 0 5: mean_gradient =a constant which set to ðLink Capcity in ppsÞ=ð2  Time_WindowÞ 6: Time_Window= a constant to represent the size of the jumping window 7: For each window do { 8: N=number of packets during this window 9: pkt_rate= N/Time_Window 10: m =(pke_rate–Avg_rate)/Time_window 11: a = amax/(1+ |m|/mean_gradient) 12: Avg_rate =(1–a)  Avg_rate+ a  pkt_rate 13: } 14: return Avg_rate

Dynamic EWMA is an EWMA estimator with dynamic weight that gets adjusted on the basis of the temporary or persistent changes

1017

in the traffic over time [19]. Dynamic EWMA typically gives better performance than the conventional static EMWA with constant weight a. In dynamic EWMA, temporary and brief traffic changes (peaks) are treated with lower weight, but persistent and more permanent changes are treated with higher weight. These trends of changes are determined using the gradient of the occupied traffic. The complete dynamic EWMA is described in Algorithm 3. The algorithm is devised such that it is time-window based, i.e. estimation is performed periodically and does not depend on the interarrival times of packets, as shown in Line 7. Considerable overhead can be encountered if estimation is performed upon the reception of each incoming packet, especially at a high rate of traffic arrival. In Gigabit Ethernet, a link may carry up to 1.4 million pps, and with 10 Gigabit links the problem can be significantly exacerbated. amax is typically chosen to be twice the value of the initial value of aopt [19]. More computational steps are involved in Algorithm 3 than in Algorithms 1 and 2. The computational steps are those shown in Lines 8–12, which involve multiplication, divisions, and floating point operations. However, it is expected that the overall cost in terms of CPU cycles that required by Algorithm 3 would be less than Algorithms 1 and 2 with the condition that the selected value of the Time_Window(initialized in Line 6) is greater than the average interarrival rate of incoming packets. Under moderate and heavy incoming traffic rates, the dynamic EWMA estimator would on average consume far fewer CPU cycles. 2.4. Proposed EWMA Our proposed EWMA algorithm is a time-window-based EWMA estimator. The current packet rate is calculated on the basis of the number of packets received within a fixed time window T. Then we use the exponential averaging to estimate the actual rate, as illustrated in Algorithm 4, Line 8. In the algorithm, pkt_rate denotes the measured current packet rate l. Unlike Algorithms 1 and 2, our proposed algorithm is time-window based (as shown in Line 5), which means it does not require measurements of interarrival times of packets or computation on the arrival of every incoming packet. Also, unlike Algorithm 3, the estimation of our proposed algorithm is much less complex as it takes far fewer computational steps (as shown in Lines 6–8). These steps are simple when compared to the computational steps of Lines 8–12 shown for Algorithm 3. We design our proposed estimation to be simple as it removes the estimation complexity that is based on the gradient method (as used in Algorithm 3). We expect that our proposed algorithm will lose some of its quality to Algorithm 3 when it comes to rapid changes and peaks (i.e., agility), but on the other hand our proposed estimator will be superior in terms of cost. The estimation steps of our proposed algorithm are similar to the static EWMA of Algorithm 2 in smoothing out the burstiness of traffic and short peaks. The estimation does not depend on measuring the interarrival times of packets. The window in our proposed EWMA is a jumping window (as opposed to TSW where the window is sliding). Algorithm 4. Proposed EWMA 1: Initialization: 2: a = a constant weight factor 3: Avg_rate =0 4: Time_Window=a constant to represent the size of the jumping window 5: For each window do { 6: N =number of packets during this window 7: pkt_rate=N/Time_Window 8: Avg_rate= (1–a)  Avg_rate+ a  pkt_rate 9: } 10: return Avg_rate

1018

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

3. Evaluation and comparison

according to this formula:

We evaluated the performance of the four algorithms by using DES simulation developed in C language. It is worth noting that empirical study and experimentation would also be an attractive option for assessment and comparative study of the four estimators. However, this option requires a customized hardware for network cards to timestamp incoming packets upon arrival. All of today’s network cards do not have such an option, and special network cards have to be built to include such a feature. Therefore, we found it more practical to use DES. Our simulation followed closely and carefully the guidelines in [20]. We used the PMMLCG as our random number generator [20]. The simulation was automated to produce independent replications with different initial seeds that were one million apart. The initial seeds for the simulation model random variables within each replication were chosen to be 500,000 apart. During the simulation run, we checked for overlapping streams, to ascertain that such a condition did not exist. The simulation was terminated when it achieved a precision of no more than 10% of the mean with a confidence of 90%. We employed and implemented dynamically the replication/deletion approach for means, as discussed in [20]. We computed the length of the initial transient period by using the MCR (marginal confidence rule) heuristic developed by White [21]. Each replication run lasted for five times the length of the initial transient period. In order to introduce realistic and highly variable network traffic, bursty traffic with empirical packet sizes was used. To generate a synthesized bursty traffic, we implemented the method described in [22]. This method followed fractional Gaussian noise such that the resulting self-similar traffic was obtained by aggregating multiple streams (one stream per source) each consisting of alternating Pareto-distributed ON/OFF periods. In our simulation we used eight sources, which are enough for producing realistic bursty aggregated traffic according to our own experimentation and findings, which are also in line with the observations in [23]. For the ON and OFF periods, we used the commonly used shape parameters of aON ¼ 1:3 and aOFF ¼ 1:5, respectively. During the ON period we generated packets with sizes that follow an empirical distribution, which are real measurements of packet sizes from the MCI backbone. The measurements were reported in [24] and are available online at http://www.caida.org. For all simulation runs (unless stated otherwise), we fixed the weight factor a to 0.3 as used in [13], the optimal weight aopt of the dynamic EWMA to 0.3 with the maximum weight amax twice aopt as used in [19], and the window length of TWS to 10 ms. For accuracy, stability and agility, we compared our results to a reference traffic. Reference traffic rate is the instantaneous measure of the average rate (i.e., the total number of packets received over a period of 10 ms). For simulation results of stability and agility, we recorded the average reference traffic rate every 10 ms (as opposed to say 1 ms) in order to reduce the fluctuation of the instantaneous data so that the plots become more readable. For the results of estimators, their output was recorded at the end of the 10 ms interval (which indicates the predicted or estimated rate of the next interarrival time).

relative_error ¼

To measure accuracy, we used a constant traffic load of 70% (corresponding to an average rate of 150 Kpps) for 60 s and we measured the results of the relative estimation error. The estimators were evaluated in terms of accuracy based on the relative error between average estimated and average reference

Fig. 1 exhibits the average of relative estimation errors. It is clear that conventional static EWMA performs poorly in terms of accuracy when compared to other algorithms, even with different weights. Other algorithms of TSW, dynamic EWMA, and proposed EWMA produced comparable results with little difference. Similar results were produced at different loads of 25% and 50%. Also, when we increased the simulation time to 120 s from 60 s, it was observed that the dynamic EWMA was the most accurate, and second to it was the proposed EWMA, outperforming TSW. 3.2. Stability Fig. 2 compares the stability results of the four estimators when subjected to an average aggregated bursty traffic of 150 Kpps. Fig. 2 shows that the conventional static EWMA performs poorly again, as shown in the left graph of Fig. 2. A zoom-in version of the figure is also shown on the right. The zoom-in version excludes the results of the conventional static EWMA. It is clear that for the most part our proposed estimator is more stable (not reacting much to short peaks) than the other three estimators. For example, around the time of 1150–1200 ms of the zoom-in version of Fig. 2, our proposed estimator reacts slowly to the offered traffic short peaks. TSW estimator is less stable than the dynamic EWMA and our proposed TW EWMA estimator. When the stability curves of the TSW estimator were compared with our proposed estimator by using a 0.3 value for a and aopt , the stability curves of these two estimators were close and almost in line. In order to investigate sensitivity to smaller weight values, and to examine clearly the stability differences exhibited by these two estimators, we reduced the weight a to 0.125. Small weights would allow the stability of these two estimators to become more sensitive (as more weight is given to measured history or past observations), thereby exhibiting stability curves with clear differences. Fig. 2 (right) depicts the stability curves of these two estimators with the 0.125 value for a and aopt . The figure shows that the dynamic EWMA estimator exhibits less stability than our proposed TW EWMA estimator. It is worth mentioning that the stability curve for the static EWMA is plotted in Fig. 2 with the 0.3 value for a. Reducing this value to 0.125 improved stability to some degree, but not considerably when compared to the other three estimators. TSW Dynamic EW MA Static EW MA Proposed EW MA

Relative Estimation Error (%)

3.1. Accuracy

jreference  estimatedj  100% reference

25% 20% 15% 10% 5% 0% Fig. 1. Average of relative estimation errors.

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

4.5

x 105

4

3 2.5 2 1.5

x 105 Reference TSW Dynamic EWMA Proposed EWMA

2 Arrival Rate (pps)

3.5 Arrival Rate (pps)

2.2

Reference TSW Static EWMA Dynamic EWMA Proposed EWMA

1019

1.8 1.6 1.4

1 1.2 0.5 0 1000

1200

1400 1600 Time [ms]

1800

1 1000 1050 1100 1150 1200 1250 1300 1350 1400 Time [ms]

2000

Fig. 2. Stability comparison (left) with zoom-in (right).

5

x 105 Reference TSW Static EWMA Dynamic EWMA Proposed EWMA

4.5 4

1.8

3.5 3 2.5 2 1.5

1.4 1.2 1 0.8

0.5

0.6

0 100

200

300

400

500

600

Reference TSW Dynamic EWMA Proposed EWMA

1.6

1

0

x 105

2

Arrival Rate (pps)

Arrival Rate (pps)

2.2

0.4 100

200

Time [ms]

300

400

500

600

Time [ms]

Fig. 3. Agility comparison (left) with zoom-in (right).

3.3. Agility To study agility, we configured our simulation to introduce considerable fluctuation in the offered traffic load, as shown in Fig. 3. The reference curve is the average aggregated bursty traffic of different rates. An average offered rate of bursty traffic of 150 Kpps was used for 200 ms and then reduced to 50 Kpps, and then increased after 200 ms to 150 Kpps again. Fig. 3 exhibits and compares the agility results of the four estimators. It is shown that the conventional EWMA overreacts and performs poorly. For the zoom-in version which excludes the static EWMA, it is obvious that our estimator TW-based EWMA reacts slowly to permanent traffic changes. However, both TSW and dynamic EWMA are more agile than our estimator, as they are more reactive to changes in the offered traffic. TSW estimator exhibits the best agility, as it reacts a bit more than the dynamic EWMA.

3.4. Cost As discussed in Section 2, clearly more computational cost is required by TSW and static EWMA estimators than by dynamic EWMA and our proposed EWMA estimators. The estimation in

TSW and static EWMA is performed upon the arrival of every incoming packet. With the advent of high-speed and Gigabit networks, the computational cost can be substantial, as most traffic estimation will be for incoming rates that are high. In practice an incoming traffic rate can go up to 1.4 million pps in Gigabit links. If we assume, for example, that the average estimation time is 1 ms, then a possible system overhead due to estimation processing or computation at an incoming traffic rate of 100 Kpps (which is a typical moderate rate for desktop machines with 100 M and Gigabit Ethernet links) can be approximately 10% of the overall CPU processing power. The dynamic EWMA and our proposed EWMA estimators are window-based estimators, whereby computation is not performed on each packet arrival, but triggered periodically on the basis of the configured time window size. To illustrate this by using the same example with a time window of 10 ms, an average estimation time of 1 ms, and an incoming rate of 100 Kpps, we encounter an approximate a system overhead of 0.01% (as opposed to 10% for TSW and static EWMA). This is a substantial improvement and a reduction in the processing overhead of approximately 1000 times. Intuitively, our proposed EWMA algorithm requires less overhead than the dynamic EWMA. This is obvious by examining the steps involved in both algorithms. The dynamic EWMA algorithm

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

1020

Dynamic EWMA Proposed EWMA

10

x 105 Reference TSW Dynamic EWMA Proposed EWMA

8

0.020 0.018 0.016 0.014 0.012 0.010 0.008 0.006 0.004 0.002 0.000

Arrival Rate (kbps)

CPU Usage (%)

9

7 6 5 4 3 2 100

Fig. 4. Comparison of CPU cycles consumed.

200

300

400

500

600

Time [ms]

3.5. Bit-rate performance One issue related to the evaluation of our proposed estimator is to examine how it compares with the original three bit-rate estimators when used to estimate the bit rate. As verification, it is to be expected that the performance and quality of our proposed estimator when used for estimating the bit rate would sustain the same behavior and performance. We used the original algorithms without the conversion to packet rate, and we also modified our proposed TW-based EWMA algorithm to account for the number of bits (and not packets) in each time window. To address this issue, we plotted the performance in terms of the bit rate for the best three estimators: TSW, dynamic EWMA, and our proposed TW-EWMA. Fig. 5 shows results similar to those of the zoom-in version of Fig. 3. It is clear that our proposed EWMA scheme outperforms the others in terms of stability. Also it is clear that, around the areas of severe fluctuations, the proposed EWMA reacts slowly to traffic changes, and therefore somewhat less agile. As the case of the packet rate, the estimator of static EWMA gave

Fig. 5. Performance in terms of bit rate.

Dynamic EWMA 0.025 Error CPU Usage (%)

requires far more computational steps, which involves significant division and floating point operations. To validate this further, we experimentally implemented both of these algorithms on Fedora Core 5 Linux 2.6.15 running on a machine which has an Intel Pentium 4 processor running at 3.2 GHz with 512 MB of RAM. We were unable to implement static EWMA as its estimation depends on accurate measurement of interarrival times of packets [2]. Under today’s architecture of the Linux kernel and network device driver, this is not feasible without the support of a special custommade NIC that timestamps packets as they arrive into the NIC. This feature is not provided by today’s general-purpose NIC cards. Details on implementation and experimental setup are presented in [16]. We measured the overhead cost in terms of the percentage of consumed CPU cycles. We instrumented the Linux code and device driver with rdtscl macro. This macro basically implements the assembly instruction rdtsc (read time stamp counter) which returns the number of CPU cycles since system bootup. Fig. 4 shows the average CPU percentage consumed by the different estimators when subjecting the Linux machine to a constant estimating a low traffic rate of 5 Kpps. Measurements were taken for a period of 30 seconds for a total of five trials. We used D-ITG to send a constant traffic of 64-bit packet sizes [26]. Our experimental results and measurements confirm that our proposed EWMA estimator exhibits relatively less overhead than the dynamic EWMA.

Proposed EWMA

0.020 0.015 0.010 0.005 0.000 Fig. 6. Comparison of CPU cycles consumed for estimating bit rate.

the worst performance in terms of stability and agility. As was demonstrated and clear from Fig. 5, our proposed estimator exhibits the same comparable performance results when used for both bit and packet rate estimations. This is expected and in line with intuition, and we can conclude that the algorithm of our proposed estimator verifies well. Fig. 6 shows the overall average cost of estimating the bit rate in terms of the percentage of consumed CPU cycles over 30 s and with an incoming traffic rate of 5 Kpps. We performed measurements for our proposed EWMA and dynamic EWMA estimators, as in Fig. 4. Fig. 6 resembles Fig. 4 but with a small increase in the cost in terms of CPU consumption. The small increase is expected and is due to the additional computational steps for converting the incoming packets into bits. It is to be observed the increase was for both of the proposed EWMA and dynamic EWMA estimators, with both maintaining the same CPU usage difference. In short, and as expected, our proposed solution exhibits the same behavior and performance results for both bit and packet rate estimations. In summary, our algorithm TW-based EWMA outperforms the other three algorithms in terms of cost and stability, and it compares well in terms of accuracy and agility. For accuracy, the proposed algorithm is comparable to TSW and dynamic EWMA. However, for agility, the algorithms of TSW and dynamic EWMA give relatively better performance.

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

4. Selection of parameters for proposed TW-based EWMA The performance of the proposed TW-based EWMA can be affected by the selected value for its parameters of time-window size and weight. In this section, we investigate how to further optimize the performance of our proposed estimator by examining the effect of choosing different parameter values on the performance of the scheme in terms of agility and stability. Fig. 7 shows the impact of choosing three different values for the timewindow size. We fixed the weight at 0.25. We evaluated the performance in terms of three window sizes: 32, 16, and 8 ms. It is worth mentioning that these values were chosen in powers of 2 so that they can be simply implemented by using bit-shift operations [16]. It is shown that a bigger window size yields relatively more stability, but less agility. Certainly there exists a trade-off among stability, agility, and overhead. Smaller window sizes yield more overhead, but are more agile and less stable. One related issue of interest is to examine the impact of selecting different time-window sizes on the performance of TSW and dynamic EWMA estimators. We used the same time-window

x 105

1021

sizes as in Fig. 7 (32, 18, and 8 ms). Fig. 8 exhibits the performance curves of such an impact. It is clear from Fig. 8 that unlike our proposed TW-based EWMA estimator, bigger window sizes do not consistently result in more stability for both TSW and dynamic EWMA estimators. This is particularly obvious around the time of 180–250 ms. With smaller window sizes, both TSW and dynamic EWMA estimators are more agile, but less accurate as they do not follow the traffic changes closely. Therefore, we can conclude that our proposed EWMA estimator is more accurate with smaller window sizes, and exhibits more stability with larger window sizes. Lastly we study the impact of selecting different weight values on the performance of the proposed estimator, particularly in terms of stability and agility. Fig. 9 exhibits such an impact. We fixed the time-window size at 8 ms. We considered three realistic weight values of 0.125, 0.25, and 0.5 for two reasons. First, these values can be represented as a negative power of 2 and then the estimated rate can be computed with one shift and two add instructions, which are costless operations [25]. Second, these values are close to the values used in practice and in the literature [13,19,25]. As shown, a smaller weight yields more stability (more obvious on the left of the figure) and less agility (more obvious on the right).

2

Arrival Rate (pps)

Reference Time−Window 32ms Time−Window 16ms Time−Window 8ms

5. Concluding remarks

1.5

1

0.5 100

150

200

250

300

350

400

450

500

Time [ms] Fig. 7. Impact of different time-window sizes on performance of proposed estimator.

2

In this paper, we used DES simulation to study and evaluate three algorithms that can be potentially used for estimating packet rate: TSW, conventional static EWMA, and dynamic EWMA. We also proposed a novel fourth algorithm. The proposed estimation algorithm is a time-window-based EWMA and requires the least computational overhead. We used simulation with empirical packet sizes to study the performance of the estimators. The quality and performance of these estimators were studied and compared in terms of accuracy, stability, agility, and cost. We measured the actual computational cost in terms of the percentage of consumed CPU cycles for both dynamic EWMA and our proposed estimator when implemented in Linux 2.6.15 kernel. Performance evaluation and actual cost measurements were also conducted for bit rate estimations. As was demonstrated, our proposed TW-based EWMA estimator showed adequate performance in terms of accuracy and agility. However, in terms of stability and overhead cost, our proposed estimator is superior.

x 105

2

x 105 Reference Time−Window 32ms Time−Window 16ms Time−Window 8ms

Arrival Rate (pps)

Arrival Rate (pps)

Reference Time−Window 32ms Time−Window 16ms Time−Window 8ms

1.5

1

0.5 100

150

200

250

300

350

Time [ms]

400

450

500

1.5

1

0.5 100

150

200

250

300

350

Time [ms]

Fig. 8. Impact of different time-windows sizes on TSW and Dynamic EWMA (right).

400

450

500

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

1022

2.5

x 105

2.5 Reference weight = 0.5 weight = 0.25 weight = 0.125

Reference weight = 0.5 weight = 0.25 weight = 0.125

2 Arrival Rate (pps)

Arrival Rate (pps)

2

x 105

1.5

1

1.5

1

0.5

0.5

0

0 0

100

200

300

400

500

600

Time [ms]

0

100

200

300

400

500

600

Time [ms]

Fig. 9. Impact of different weights on stability (left) and agility (right) of proposed estimator.

The paper presented simulation results that showed little or no difference in the performance exhibited for stability and agility when using time-window estimators to perform bit rate estimation, as opposed to packet rate estimation. However, a relatively greater computational cost was exhibited in bit rate estimation. In this paper, we also investigated optimizing the performance of our proposed algorithm, and we examined the effect of tuning the key estimation and smoothing parameters, namely weight and time-window size. Our results show that small weight values yield more stability and less agility. Also small window sizes give more agility, at the expense of more computational cost and less stability. Therefore, in order to optimize the performance of the proposed estimator, so that it can achieve adequate stability with reasonable agility and less computational cost, its weight parameter must be selected to be relatively small with a somewhat large window size. It is worth mentioning that our approach for optimizing the performance was carried out by tuning (or selecting different values for) key estimation parameters, and then examining the performance quality. Such an approach involves trial-and-error and is obviously a limitation of all popular network traffic estimation techniques (including our proposed estimator). In a future study, there is a need to investigate other adaptive estimation techniques that do not require parameter tunings. Such estimators may include employing adaptive Holt’s exponential smoothing [27,28] or using neural networks [29]. The computational cost of these adaptive techniques has also to be investigated. Such adaptive estimations require considerable computation, and they can be at a major disadvantage when compared to our proposed estimator.

Acknowledgments We acknowledge the support of King Fahd University of Petroleum and Minerals in completion of this work. This work has been funded under Project #ICS/Linux/383. We also thank the anonymous reviewers for their valuable comments in improving considerably the quality of this paper. References [1] Grossglauser M, Tse D. A framework for robust measurement based admission control. IEEE/ACM Transactions on Networking 1999;7(3):293–309. [2] Floyd S, Jacobson V. Link-sharing and resource management models for packet networks. IEEE/ACM Transactions on Networking 1995;3:365–86.

[3] Agharebparast F, Leung V. A new traffic rate estimation and monitoring algorithm for the QoS-enabled internet. In: Proceedings of IEEE GLOBECOM’03, vol. 45, San Francisco, 2003. p. 3883–887. [4] Shenker S, Danzig P, Jamin S. Comparison of measurement-based admission control algorithms for controlled-load service. In: Proceedings of IEEE INFOCOM ‘97, Kobe, Japan, April 1997. p. 973–80. [5] Shah RC, Petrovic D, Rabaey J. Energy aware routing and data funneling in sensor networks, in: Handbook of sensor networks: compact wired and wireless sensing systems, Boca Raton: CRC Press; 2004. [6] Oliver Y, Saric E, Li A. Adaptive rate-scheduling with reactive delay control for next generation cdma wireless mobile systems. EURASIP Journal on Wireless Communications and Networking 2006;06:1–15. [7] Wydrowoski B, Zukerman M. High performance DiffServ mechanism for routers and switches: packet arrival rate based queue management for class based scheduling. In: Proceeding of the second international IFIP-TC6 networking conference on networking technologies, services and protocols, Springer: Berlin; 2002. p. 62–73. [8] Li C-C, Tsao S-L, Chen MC, Sun Y, Huang Y-M. Proportional delay differentiation service based on weighted fair queueing. In: Proceedings of the ninth IEEE ICCCN’00, Las Vegas, October 2000. p. 418–23. [9] Stamoulis A, Sidiropoulos ND, Giannakis GB. Time-varying fair queueing scheduling for multicode CDMA based on dynamic programming. IEEE Transactions on Wireless Communications 2004;3(2):512–23. [10] Zimmerman J, Clarck A, Mohay G. The use of packet interarrival times for investigating unsolicited internet traffic. In: Proceedings of the first international workshop systematic approaches to forensic engineering, November 2005. p. 89–104. [11] Gupta M, Glover S, Singh S. A feasibility study for power management in lan switches. In: Proceedings of the 12th IEEE international conference on network protocols, October 2004. p. 361–71. [12] Mogul J, Ramakrishnan K. Eliminating receive livelock in an interrupt-driven kernel. ACM Transactions on Computer Systems 1997;15(3):217–52. [13] Dovrolis C, Thayer B, Ramanathan P. HIP: hybrid interrupt-polling for the network interface. ACM Operating Systems Reviews 2001;35:50–60. [14] Salah K, El-Badawi K. Analysis and simulation of interrupt overhead impact on OS throughput in high-Speed networks. International Journal of Communication Systems 2005;18(5):501–26. [15] Salah K, Haidari F. On the performance of a simple packet rate estimator. In: Proceedings of the sixth ACS/IEEE international conference, Doha, Qatar, March 2008. p. 392–95. [16] Salah K, Haidari F, Bahjat A, Manaa A. Implementation and experimental evaluation of a simple packet rate estimator. International Journal of Electronics and Communications – AEUE, Elsevier Science, in press, doi:10.1016/j.aeue.2008.07.012. [17] Clark D, Fang W. Explicit allocation of best-effort packet delivery service. IEEE/ ACM Transactions on Networking 1998;6(4):362–73. [18] Fang W, Seddigh N, Nandy B. A time sliding window three colour marker (TSWTCM), RFC 2859, June 2000. [19] Burgstahler L, Neubauer M. New modifications of the exponential moving average algorithm for bandwidth estimation. In: Proceedings of the 15th ITC specialist seminar, July 2002. [20] Law A, Kelton W. Simulation modeling and analysis, 2nd ed. New York: McGraw-Hill; 1991. [21] White J. An effective truncation heuristic for bias reduction in simulation output. Simulation Journal 1997;69(6):323–34. [22] Taqqu MS, Willinger W, Sherman R. Proof of a fundamental result in selfsimilar traffic modeling. ACM/SIGCOMM Computer Communication Review 1997;24(2):5–23.

¨ ) 64 (2010) 1015–1023 K. Salah, F. Haidari / Int. J. Electron. Commun. (AEU

[23] Wells PM. Simulation of self-similar network traffic using high variance ON/ OFF sources. MS thesis in computer science, Clemson University, May 2002. [24] Claffy KC, Miller G, Thompson K. The nature of the beast: recent traffic measurements from an internet backbone. In: Proceedings of INET 1998, Geneva, Switzerland, July 1998. [25] Jacobson V. Congestion avoidance and control. In: Proceedings of ACM SIGCOMM, Stanford, CA, 1988. p. 314–20. [26] Emma D, Pescape A, Ventre G. D-ITG, Distributed internet traffic generator, Available from /http://www.grid.unina.it/software/ITGS. [27] Pantazopoulos S, Pappis C. A new adaptive method for extrapolative forecasting algorithms. European Journal of Operation Research 1996;94(1):106–11. [28] Tikunov D, Nishimura T. Traffic prediction for mobile network using HoltWinter’s exponential smoothing. In: Proceedings of the 15th IEEE SoftCOM 2007, Split, Croatia, September 27–29, 2007. p. 1–5. [29] Cortez P, Rio M, Rocha M, Sousa P. Internet traffic forecasting using neural networks. In: Proceedings of the 2006 international joint conference on neural networks, Vancouver, Canada, July 16–21, 2006. p. 2635–42.

Khaled Salah is an associate professor of Computer Science. He received the B.S. degree in computer engineering with a minor in computer science from Iowa State University, USA, in 1990, the M.S. degree in computer systems engineering from Illinois Institute of Technology, USA, in 1994, and the Ph.D. degree in computer science from the same institution in 2000. He has over 10 years of industrial experience in embedded systems and software and firmware development of network protocol stacks and device drivers for ATM and Ethernet. He joined King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia, in September 2000. Dr. Salah is currently with the

1023

Department of Information and Computer Science, teaching graduate and undergraduate courses in the areas of high-speed networks, performance evaluation, simulation, operating systems, and computer and network security. His research interests are in the performance analysis and design of computer systems and networks using queueing theory and simulation. He was the recipient of KFUPM University Excellence in Research Award of 2008/09, and also the recipient of the departmental awards for Distinguished Research and Teaching in prior years.

Fahd Haidari is currently a Ph.D. candidate with the Department of Information and Computer Science at King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia. He received his M.S. degree in computer science from the same department in May 2006. His research interests include algorithms and simulation, in addition to performance evaluation of computer networks. Mr. Haidari received his B.S. degree in computer science from University of Mousel, Iraq, in 1999.