A nonstationary poisson view of internet traffic
IEEE INFOCOM 2004
Since the identification of long-range dependence in network traffic ten years ago, its consistent appearance across numerous measurement studies has largely discredited Poissonbased models. However, since that original data set was collected, both link speeds and the number of Internet-connected hosts have increased by more than three orders of magnitude. Thus, we now revisit the Poisson assumption, by studying a combination of historical traces and new measurements obtained from a major
... ne link belonging to a Tier 1 ISP. We show that unlike the older data sets, current network traffic can be well represented by the Poisson model for sub-second time scales. At multi-second scales, we find a distinctive piecewise-linear non-stationarity, together with evidence of long-range dependence. Combining our observations across both time scales leads to a time-dependent Poisson characterization of network traffic that, when viewed across very long time scales, exhibits the observed long-range dependence. This traffic characterization reconciliates the seemingly contradicting observations of Poisson and long-memory traffic characteristics. It also seems to be in general agreement with recent theoretical models for large-scale traffic aggregation. Aggregated traffic vs. individual flows: We consider the combined packet arrival stream generated by all sources, rather than focusing on the subset of packets generated by a single source. Because of our focus on the highly-multiplexed Internet core, such primary performance metrics as packet delays and buffer occupancies should be insensitive to the details of an individual flow. Idle periods vs. back-to-back packets: It is well known that the packet interarrival time distribution may deviate from the Poisson model for very small values because of multiple-packet deterministic sequences. In our case, the primary cause will be "busy periods" at the upstream router, which transmits back-toback packets until it manages to empty the queue. In other studies, fixed delay transaction-oriented protocols like NFS, and processing time bottlenecks in the hosts have been identified as the causes for particular "spikes" appearing in the interarrival time distribution  . Such short-range artifacts can be 1 The same question also appears in all disciplines where LRD modeling is applied, such as finance  .