Traffic Measurement Study And Analysis

Traffic measurement is the foundation of network monitoring, management and control. Due to the development of Internet, network behavior becomes more and more complex, and network traffic becomes more and more large, which makes direct measurement very difficult. To solve this problem, sampling and hashing are deployed present. And Bloom filters are compact data structures for probabilistic representation of a set in order to support membership queries (i.e. queries that ask:"Is element X in set Y?"), which have received widespread attention in the networking literature. This compact representation is the payoff for allowing a small rate of false positives in membership queries; that is, queries may incorrectly recognize an element as member of the set.Based on self-similar and heavy-tailed distribution characteristics of network traffic, this paper first proposed self-adaptive systematic double sampling (SSDS), which is variation of systematic sampling. It selects two continuous packets in each sampling interval, while the traditional sampling methods select only one packet. SSDS can capture extremely large flows more faithfully, and can estimate Hurst parameter correctly and preserves the self-similarity property of the original traffic, and also gives more accurate estimate of the link load and packet interarrival times while achieves simplicity, adaptability.Flow sampling based on DCF with controllable resource samples a fixed number of packets in the each sampling interval, and employs DCF hash algorithm to maintain flow records, which effectively controls resources consumption. Results show that it can achieve sampling rate's self-adaptability, simplicity and controllability of resource consumption without sacrificing accuracy. And DCF (i.e. Dynamic Count filters) are variation of Bloom filters, which can handle deletes and inserts on multi-set over time. Each element in the multi-set is a traffic flow and its multiplicity is the number of packets in the flow.For many applications, knowing elephant flows is enough. Elephant flow is flow whose packets number reaches a given threshold, and a small number percentage of flows accounts for a large percentage of the total traffic. Elephant flow detection based on sampling and Bloom filters samples the packets first, then employs Bloom filters hash structure, which maintains certain number of hash functions and as a result decreases hash collision, and employs temporary table and flow information table to identify elephant flows and maintains their records, which meets the high-speed network's demand and controls resources consumption effectively without sacrificing accuracy.Finally, a summary is given and the future research directions are also pointed out.