Documente Academic
Documente Profesional
Documente Cultură
Estimator
K. Salah** F. Haidari
Department of Information and Computer Science
King Fahd University of Petroleum and Minerals
Dhahran 31261, Saudi Arabia
Email: {salah,fahd}@kfupm.edu.sa
Abstract—This paper proposes a simple packet rate estimator and does not need to store much data.
that can be very useful in predicting the rate of network traffic.
The quality and performance of the estimator is evaluated and All of the estimators utilized in [1-4] were designed
compared with three popular rate estimators that were originally originally for estimating bit arrival rate. However, little
designed for estimating bit rate. The proposed estimator is research has been done on estimating packet arrival rate.
highly cost effective as its computation is not carried out upon the Estimators of packet arrival rate can be very useful and
arrival of each incoming packet. In addition, the computation is attractive in a variety of applications in networking and
simple and does not depend on the measurement of interarrival communications. The computation of packet rate is much
times of packets. We evaluate and compare the quality and simpler than bit rate as it does not depend on accumulation of
performance in terms of accuracy, agility, stability, and cost. The packet sizes. In addition, a packet rate estimator can be
performance evaluation is conducted using discrete-event designed to perform estimation at a periodic rate, as the case
simulation that produces synthesized bursty traffic with for our proposed estimator. Our proposed estimator is simple
empirical packet sizes. In addition, we investigate the and does not depend on interarrival time measurements of
performance impact of selecting different parameter values for packets and running estimation at every packet arrival, but
the proposed estimator. utilizes a fixed time window. This can be an indispensable
design option for network elements of sensor networks nods as
KEYWORDS: Traffic Rate Estimation, Time Sliding Window,
well as PC-based routers and servers. Nodes in sensor
Exponential Averaging, Simulation, Bursty Traffic, Performance
Evaluation
networks are typically limited in computational power and
energy. For PC-based routers and typical workstations and
servers, avoiding summing up packet sizes and computation at
I. INTRODUCTION every incoming packet will result in better overall performance.
Estimating the incoming arrival rate of network traffic is an And more importantly, the NIC of these systems typically does
integral component of network traffic management, monitoring not timestamp the arrival of each packet, and timestamping has
and call-admission control. In Call Admission Control (CAC), to be performed by the kernel at interrupt handling of packet
the rate of the flows are monitored at the access points of the reception. This requires considerable overhead and is not
network in order to make decisions on admitting new flows [1]. doable in the default interrupt handling schemes of FreeBSD
For providing QoS-enabled Internet, the rates of current flows polling and Linux NAPI where interrupts of received packets
get also monitored for traffic policing to ensure senders comply are disabled.
to their SLAs (Service Level Agreement). SLA defines the Recently, the use of packet arrival rate estimators has been
traffic characteristics (especially the traffic rate) expected from increasing. In [5], optimal routes through sensor network
the sender. Other than call admission control and policing, rate elements and optimal wakeup rate to minimize energy
estimation is also an integral part of link-sharing [2] and fair consumption are determined based on the incoming packet
scheduling algorithms [3] which are utitlized in DiffServ and arrival rate to sensor nodes. In [6], an adaptive rate-scheduling
RSVP protocols [4]. based on the estimation and prediction of packet arrival rate has
Devising a proper rate estimator is not a trivial task. The been proposed for minimizing QoS degradations in next
quality of any estimator depends on multiple factors that may generation CDMA wireless mobile systems. In [7], a queue
include agility, stability, accuracy, and overhead cost [3]. management technique based on packet arrival rate was
Agility defines the quickness of the estimator in following the introduced for routers and switches to provide end-to-end high
changes in the actual data rate of the traffic. Stability (a.k.a. performance DiffServ QoS. In [8], the packet arrival rate of
smoothing) refers to the ability of the estimator to ignore short- incoming traffic is utilized in a dynamic weighted fair queueing
term changes or peaks of traffic. Accuracy refers to the scheduler of routers. The weight gets adjusted dynamically
difference between the estimated and the actual data rates of based on the estimated packet arrival rate of each flow. In [9],
the traffic. Finally, the cost refers to the complexity of the an enhanced scheduling scheme of time varying fair queueing
algorithm and the required computational time and memory. In (TVFQ) was proposed using dynamic weights that get set
other words, a cost-effective estimator has to be simple, fast, according to estimated packet arrival rate. In [10], estimated
** Corresponding Author: Prof. K. Salah, PO Box 5066, ICS Department,
KFUPM, Dhahran 31261, Saudi Arabia)
1
packet rate is used to identify abnormal activities and attacks. agility and stability of TSW depend on the size of the time
In [11], estimated packet rate is used to reduce power window Win_length. If Win_length is small, the estimator will
consumption of network devices such as LAN switches. An be more agile as the past takes less weight so that it can follow
interface on a switch can go to sleep (and thereby saving the new changes in the traffic rate quickly. On the other hand,
power) if the estimated next arrival time is long enough. In if Win_length is large, the estimator will be more stable as the
[12-14], estimation of packet arrival rate is required for the past takes more weight so that it can forget the short peaks
implementation of a hybrid interrupt handling scheme that can which are very brief and only temporary. now is the time of the
result in high performance of network servers with Gigabit current packet arrival. T_front is the time of the last packet
Ethernet links. The hybrid interrupt handling scheme is a arrival. It is worth noting that computation of TSW estimator
combination of two modes: normal interruption and polling. is performed on each packet arrival and measurements of
The switching between these two modes depends on the interrarrival times are required, and therefore may result in a
estimated packet arrival rate. considerable overhead, especially at high rate. In Ethernet of
It is worth noting that, the packet arrival rate estimators Gigabit link, the rate can go up to 1.4 million pps!
reported in [5-9] employ typically an exponentially weighted
moving average, described and named later in the paper as the Algorithm 1: TSW
static EWMA as it has a constant weight. In this paper, we Initialization:
describe and study a total of four different packet arrival rate Win_length = a constant
estimators, including the static EWMA. One of these
Avg_rate = 0
estimators, later called Time-Window-based EWMA, is a novel
estimator that we propose. The performance and quality of T_front =0
these estimators are evaluated and compared. The For each packet arrival do:
performance is studied in terms of important estimation metrics Pkts_in_TSW ← Avg_rate × Win_length
that include agility, stability, accuracy, and cost. The
performance is studied using DES (Discrete Event Simulation). New_pkts ← Pkts_in_TSW + 1
Bursty traffic with empirical packet sizes is used to introduce Avg_rate ← New_pkts (now − T_front + Win_length )
realistic and highly variable network traffic. For the proposed T_front ← now
algorithm, we study the impact of selecting different parameter
values that can be used in tuning the estimator results and return Avg_rate
behavior. End
The rest of the paper is organized as follows. Section 2
describes the algorithms of four packet rate estimators. Three B. Static EWMA
of these estimators are modified versions of popular bit rate The static EWMA (Exponentially Weighted Moving
estimators. The fourth estimator is a proposed one by the Average) is a popular exponentially weighted moving average
authors. Section 3 compares the performance of the four that is utilized in [2,11,15]. It has a constant weight.
estimators in terms of accuracy, stability, agility, and cost. Algorithm 2 estimates the packet arrival rate. However, this
Section 4 studies the impact of the selection different parameter estimator uses interrarrival times and computation at every
values for our proposed estimators. Finally, Section 6 incoming packet, and thus requires more computational power
concludes the study and identifies future work. and measurements, as is the case in TSW.
2
EMWA with constant weight α . In Dynamic EWMA, Algorithm4: Proposed EWMA
temporary and brief traffic changes (peaks) are treated with Initialization:
lower weight; however, persistent and more permanent changes α = a constant weight factor
are treated with higher weight. These trends of changes are Avg_rate = 0
determined using the gradient of the occupied traffic. The
complete Dynamic EWMA is described in Algorithm 3. The Time _ Window = a constant to represent the size of the
algorithm is devised such that it time-window based, meaning jumping window
estimation is performed periodically and does not depend on For each window do:
the interarrival times of packets. α max is typically chosen to N ← number of packets during this window
be twice the value of the initial value of α opt [17]. M _ rate ← N Time _ Window
Avg_rate ← (1 − α ) × Avg _ rate + α × M _ rate
Algorithm 3: Dynamic EWMA
return Avg _ rate
Initialization:
End
α opt = a constant to represent the optimal weight
α max = a constant to represent the maximum weight III. EVALUATION AND COMPARISON
Avg_rate = 0 The performance of the four algorithms is evaluated using a
mnorm = a constant which set to DES simulation developed in C language and followed closely
the guidelines in [18]. In order to introduce realistic and highly
( Link Capcity in pps) (2 × Time _ Window) variable network traffic, bursty traffic with empirical packet
Time _ Window = a constant to represent the size of the sizes is used. To generate a synthesized bursty traffic, we
jumping window implemented the method described in [19]. This method
For each window do: follows fractional Gaussian noise such as the resulting self-
N ← number of packets during this window similar traffic is obtained by aggregating multiple streams (one
stream per source) each consisting of alternating Pareto-
M _ rate ← N Time _ Window distributed ON/OFF periods. In our simulation we used 8
m ← ( M _ rate − Avg _ rate) Time _ window sources, which are enough for producing realistic brusty
α ← α max (1 + m mnorm )
aggregated traffic according to our own experimentation and
findings, which are also in line with the observations in [20].
Avg_rate ← (1 − α ) × Avg _ rate + α × M _ rate For the ON and OFF periods, we used the commonly-used
return Avg _ rate shape parameters of α ON = 1.3 and α OFF = 1.5 ,
End respectively. During the ON period we generated packets with
sizes that follow an empirical distribution, which are real
D. Proposed EWMA measurements of packet sizes from MCI backbone. The
measurements are reported in [21] and available online at
Our proposed EWMA algorithm is similar to the static http://www.caida.org.
EWMA but with a major difference. The proposed algorithm is
time-window based, which means it does not require For all of simulation runs (unless stated otherwise), we fix
measurements of interarrival times of packets or computation the weight factor α to 0.3 as used in [13], the maximum
on every packet arrival. Considerable overhead can be weight α max of Dynamic EWMA to 0.6 as used in [17], and
encountered if estimation is performed upon the reception of the window length of TWS to 10 ms. For accuracy, stability
each incoming packet, especially at traffic arrival of high rate. and agility, we compare our results to a reference traffic.
In Gigabit Ethernet, a link may carry up to 1.4 million pps, and Reference traffic rate is the instantaneous measure of the
with 10 Gigabit links the problem can be significantly average rate (i.e., the total number of packets received over a
exacerbated. We propose a time-window-based EWMA period of 10 ms). For simulation results of stability and agility,
estimator to alleviate such a constraint. Algorithm 4 describes we record the average reference traffic rate every 10 ms (as
the proposed algorithm of a time-window-based EWMA opposed to say 1 ms) in order to reduce the fluctuation of the
estimator. The purpose of the time window is two fold: First, it instantaneous data and thus plots become more readable. For
mitigates the computation at each incoming packets. Second, it the results of estimators, their output is recorded at the end of
is used to smooth out the burstiness of traffic and short peaks. 10 ms interval (which indicates the predicted or estimated rate
In addition, there is no need for measuring interrarival times of of the next interarrival time).
packets. The window in the proposed EWMA is a jumping
window (as opposed to TSW) where the window gets restarted A. Accuracy
after each window trigger to run the algorithm.
To measure accuracy we offered a constant load of 70%
(corresponding to an average of 150 kpps) for 60 seconds and
we measured the results of the relative estimation error. The
estimators were evaluated in terms of accuracy based on the
relative error between average estimated and average reference
according to this formula
3
reference − estimated offered traffic load, as shown. An average offered rate of
relative _ error = × 100% . bursty traffic of 150 kpps is used for 200 ms and then reduced
reference to 50 kpps, and then increased after 200ms to 150 kpps again.
It is shown that the conventional EWMA overreacts and
Fig. 1 exhibits the average of relative estimation errors. It performs poorly. For the zoom-in version which excludes the
is clear that conventional static EWMA performs poorly in static EWMA, it is obvious that our proposed algorithm TW-
terms of accuracy when compared to other algorithms, even based EWMA reacts slowly to permanent traffic changes,
with different weights. Other algorithms of TSW, dynamic unlike TSW and dynamic EWMA.
EWMA, and proposed EWMA produced comparable results
with little difference. Similar results were produced at different D. Cost
loads of 25% and 50%. Also when we increased the simulation
TSW and static EWMA estimators are packet-based
time to 120 seconds from 60 seconds, it was observed that the
estimators as they require computation upon the arrival of each
Dynamic EWMA was the most accurate, and second to it was
packet arrival. This can result in a significant overhead
the proposed EWMA, outperforming TSW.
especially at high arrival rate of packets, which can go up to 1.4
million pps in Gigabit links. For example if we assume the
average estimation time is 1 µ s, then a possible system
TSW Static EW MA overhead due to estimation processing or computation at
Dynamic EW MA Proposed EW MA incoming rate of 100 kpps (which is a typical moderate rate for
desktop machines with 100M and Gigabit Ethernet links) can
be approximately 10% (as ρ = λ µ ). The Dynamic EWMA
Error (%)
20%
packet arrival, but triggered periodically based on the
Relative Estimation
10%
same numerical example with a time window of 10 ms, an
average estimation time of 1 µ s , and an incoming rate of 100
5% kpps, we encounter an approximate a system overhead of
0% 0.01% (as opposed to 10% for other algorithms). This is a
significant improvement (i.e., 1000 times better). When
Figure 1. Average of Relative Estimation Errors
comparing the least overhead of the Dynamic EWMA and
proposed EWMA, it is clear that our proposed EWMA requires
the least overhead and processing. The Dynamic EWMA
B. Stability algorithm requires far more computational steps which
In this example we reduced the weight α to 0.125 in order involves significant division and floating point operations.
to obtain clear graphs for stability. Fig. 2 compares the As was demonstrated in this section, our proposed
stability results of the four algorithms when subjected to an algorithm TW-based EWMA outperforms the other three
average aggregated bursty traffic of 150 kpps. It is shown that algorithms in terms of cost and stability and compares well in
the conventional static EWMA performs poorly again, as terms of accuracy and agility. For accuracy, the proposed
shown in the left of Fig. 2. A zoom-in version of the figure is algorithm is comparable to TSW and Dynamic EWMA.
also shown on right. The zoom-in version excludes the results However, for agility, the algorithms of TSW and dynamic
of the conventional static EWMA. It is clear that for the most EWMA give relatively better performance.
part our proposed algorithm is more stable (not reacting much
to short peaks) than all others.
C. Agility
Fig. 3 compares the agility results of the four algorithms
when subjected to an average aggregated bursty traffic of
different rates. To study agility, we introduce fluctuation in the
4
5 5
x 10 x 10
4.5 2.2
Reference Reference
4 TSW TSW
Static EWMA Dynamic EWMA
2
Dynamic EWMA Proposed EWMA
3.5 Proposed EWMA
3 1.8
2.5
1.6
2
1.5 1.4
1
1.2
0.5
0 1
1000 1050 1100 1150 1200 1250 1300 1350 1400
1000 1200 1400 1600 1800 2000
Time [ms]
Time [ms]
5 5
x 10 x 10
5 2.2
Reference Reference
4.5 TSW 2 TSW
Static EWMA Dynamic EWMA
4 Dynamic EWMA Proposed EWMA
1.8
Proposed EWMA
3.5
1.6
3
1.4
2.5
1.2
2
1
1.5
0.8
1
0.6
0.5
0 0.4
0 100 200 300 400 500 600 100 200 300 400 500 600
Time [ms] Time [ms]
one shift and two add instructions which are costless operations
IV. SELECTION OF PARAMETERS FOR PROPOSED TW-BASED [22]. The second reason is that these values are close to the
EWMA values used in practice and literature [13,17,22]. As shown, a
A question related to the performance of the proposed TW- smaller weight yields more stability (more obvious on left of
based EWMA is the proper value selection for its parameters of the figure) and less agility (more obvious in the right of the
time window size and weight. In this section we examine the figure).
5
effect of choosing different parameter values on the 2
x 10
yield to more overhead, but are more agile and less stable.
Fig. 5 shows the impact of different weight values on the
performance in terms of stability and agility. We consider
0.5
three realistic weight values of 0.125, 0.25, and 0.5 for two 100 150 200 250 300 350 400 450 500
Time [ms]
reasons: First these values can be represented as a negative
power of 2 and then the estimated rate can be computed with
Figure 4. Impact of different time-window sizes
5
5 5
x 10 x 10
2.5 2.5
Reference Reference
weight = 0.5 weight = 0.5
weight = 0.25 weight = 0.25
2 weight = 0.125 2 weight = 0.125
1.5 1.5
1 1
0.5 0.5
0 0
0 100 200 300 400 500 600 0 100 200 300 400 500 600
Time [ms] Time [ms]
6
[17] [17] L. Burgstahler and M. Neubauer, “New Modifications of the [20] [20] P. M. Wells, “Simulation of Self-Similar Network Traffic Using
Exponential Moving Average Algorithm for Bandwidth Estimation”, High Variance ON/OFF Sources, M.S. Thesis in Computer Science,
Proceedings of the 15th ITC Specialist Seminar, July 2002. May 2002.
[18] [18] A. Law and W. Kelton, Simulation Modeling and Analysis, [21] [21] K. C. Claffy, G. Miller, and K. Thompson, “The Nature of the
McGraw-Hill, 2nd Edition, 1991. Beast: Recent Traffic Measurements from an Internet Backbone,” In the
[19] [19] M. S. Taqqu, W. Willinger, and R. Sherman, “Proof of a Proceedings of INET 1998, Geneva, Switzerland, July 1998.
Fundamental Result in Self-Similar Traffic Modeling” [22] [22] V. Jacobson, “Congestion Avoidance and Control”, Proceedings of
ACM/SIGCOMM Computer Communication Review, vol. 24, no. 2, ACM SIGCOMM, 1988, Stanford, CA, pp. 314-320.
1997, pp. 5-23.