Effect of TCP on Self-Similarity of Network Traffic

Text-only Preview

Proceedings of 12th IEEE International Conference on Computer Communications and Networks (ICCCN), 2003
Effect of TCP on Self-Similarity of Network Traffic
Nawaporn Wisitpongphan, Jon M. Peha
Carnegie Mellon University
Pittsburgh, PA 15213
E-mail: [email protected], [email protected]

Abstract - It is now well known that Internet traffic exhibits
an individual TCP stream. Interestingly, in some
self-similarity, which cannot be described by traditional circumstances, aggregate traffic through bottleneck tends
Markovian models such as the Poisson process. In this work, we
toward Poisson while individual streams remain self-similar,
simulate a simple network with a full implementation of TCP-
presumably because congestion control mechanisms tend to
Reno. We also assume Poisson arrivals at the application layer
keep the aggregate throughput close to the capacity whenever
specifically to determine whether TCP can cause self-similarity
even when input traffic does not exhibit long-range dependence.

load exceeds the capacity. However, the work was based on the
Our study shows that, at some loads TCP can induce the assumption that load is infinite (heavy load), which is
appearance of self-similarity. In particular, when load is low and
obviously not sustainable in real networks. In some cases, the
loss is rare, traffic looks Poisson. When load is high and the
heavy-load assumption leads to useful approximations of a
network is overloaded, TCP congestion control can smooth out the
congested network, but as this work will show, heavy load
burstiness of the aggregate stream so that traffic at the bottleneck
produces qualitatively different results from load that is just
tends to Poisson. However, when load is intermediate and the below network capacity, so observations based on heavy load
network is prone to occasional bouts of congestion, as is typical of
can be misleading. Finally some researchers [2, 4] considered
many networks, traffic can become self-similar. Moreover, the effect of TCP in networks with a Bernoulli loss model
factors such as round trip time and number of streams passing
through the bottleneck can cause the network to become
which randomly drops packets regardless of whether there is
congested at different loads, and consequently affect the range of
congestion in the system or not. Since losses in wired networks
load over which self-similarity can be observed. The impact of
are typically due to congestion, and therefore not Bernoulli,
one self-similar TCP stream has also been observed. In particular,
this model does not apply to typical wired networks, where
our study show that if one or more streams passing through the
self-similarity has been observed [5].
bottleneck is self-similar and the aggregate flow does not exceed
In this work, we use simulations (OPNET 8.0) to show that
the capacity, traffic observed at the bottleneck will also be self-
TCP can induce self-similarity in network traffic even when
input from the application layer is strictly Markovian. Our

work assumes finite load and uses a full implementation of
TCP Reno from the OPNET library. We consider a simple
Recent studies have shown the presence of long-range topology where a bottleneck link is subject to bouts of
dependence or even self-similarity in Ethernet LAN traffic [5],
congestion and believe that this potential for congestion is
World Wide Web traffic [1], Wide Area Network traffic [11], central to the phenomenon. We also show that the timescales
etc. The issue of self-similarity has also been addressed in over which self-similarity can be observed depend on round-
various studies from many aspects including its impact on trip time (RTT) and the number of simultaneous TCP sessions.
network performance [9], modeling techniques [8, 9], and
This paper is organized as follows. Section II describes the
causes of the appearance of self-similarity [1,10,13].
network model and network configuration. In section III, we
Since the pioneering work on self-similarity of network present and discuss our results. Possible future work and
traffic by Leland et. al., many studies have attempted to concluding remarks are presented in section IV.
determine the cause of this phenomenon. Initial efforts focused

on application factors. For example, Crovella and Bestavros [1]
investigated the cause of self-similarity by focusing on the
We consider a simple network model with N clients and N
variability in the size of the documents transferred and the servers connected by a bottleneck link. Each client is connected
inter-request time. They proposed that the heavy-tailed to a common switch where all the traffic will be multiplexed
distribution of file size and “user think time” might potentially
and travel through two links in series, with capacities of 100
be the cause of self-similarity found in Web traffic.
Mbps and 1.54 Mbps and the MTU of 1500 bytes. The latter
Alternatively, a few studies have considered the possibility link is a potential bottleneck with a finite buffer that can hold
that underlying network protocols such as TCP could cause or up to 10 packets. The total link delay of each client-server pair
exacerbate the phenomenon. In particular, Peha [10] first is set to 5 ms. in all simulations except for the part that
showed that simple ARQ mechanisms could cause the investigate the effect of round trip time. Source queue is
appearance of self-similarity in congestible networks, but he assumed to be infinite, i.e., infinite buffer.
did not examine the ARQ mechanism in TCP. Veres et al. [13]
Fig 1 shows example of a three-client model. Each client
later showed that TCP could sometimes create self-similarity in
generates a packet of size 500 Bytes that is passed to the TCP

layer according to a Poisson process with rate ?. There are a
total of N streams (TCP sessions) traveling the same direction,
This work is supported in part by the National Science Foundation under Grant
NCR 9706491 and by OPNET Technology.


Proceedings of 12th IEEE International Conference on Computer Communications and Networks (ICCCN), 2003
Client Server

queues rarely empty out, as shown in Fig. 3c. Traffic in this

phase appears self-similar for a finite range of timescales

(pseudo self-similar [4,7]) between tens of milliseconds to a
few seconds. Slope of a V-T curve is between -1 and 0 for

timescales below some threshold and becomes -1 at greater
Fig. 1: Three-client network model

4. Overloaded phase: Network is always overloaded when
total load is consistently higher than the maximum capacity

that the network can handle. Source queues are always
and no traffic in the opposite direction. Each session lasts for 2
increasing, as shown in Fig. 3d, so the arrival process is
irrelevant. As a result, the system becomes deterministic
A. Signs of Self-Similarity
because the only source of randomness has been removed. This
is the heavy-load case addressed in [13]. It is unlikely to occur
We simulate a network with three streams, as shown in Fig.
over extended periods in real networks, and as our results
1, and vary total arrival rate at the application layer from 0.90 show, behavior of traffic in this phase is significantly different
Mbps to 1.65 Mbps in order to examine the effect of load on from the others. In particular, in the scenarios we simulated,
self-similarity of network traffic. Throughout this paper, we each source takes turns increasing and decreasing its
measure the degree of self-similarity by plotting a sample transmission rate in a deterministic manner so traffic show
variance of average throughput against different averaging periodic patterns. Consequently, the throughput of individual
duration (m) on a log-log scale (Variance-Time plot or V-T stream fluctuates wildly in some periods and stay smooth in
plot). Because variance of self-similar process decays slower other periods and the burstiness remains even when m is large.
than the reciprocal of m, the slope (?) of a V-T curve of a self-
Hence, traffic remains self-similar with slope of less than -1
similar process is flatter than -1; -1 <? < 0. Hurst parameter, even at a timescale of 100 seconds.
which is a measure of degree of self-similarity, is related to ?
TCP can indeed induce self-similarity on individual TCP
as follows: H = 1+?/2. Although variance analysis technique is
stream. However, what is more important is the behavior of
not the most accurate method of estimating H, it is sufficient aggregate traffic since it is what most of the network
when trying to determine whether the time series of interest is components such as switches, or routers see. Fig. 4 shows the
self-similar or not [12].
V-T plot of aggregate traffic under the same network
Fig. 2 shows a sample variance of average throughput from configuration. Interestingly, as load increases, slope of
an individual stream as a function of m, where m ranges from aggregated traffic approaches -1 and traffic exhibits self-
10 milliseconds to 100 seconds. Our first observation is that a similarity for a shorter range of timescale, i.e., only from tens
network undergoes four qualitatively different kinds of of milliseconds to hundreds of milliseconds.
behaviors, which can be seen at four different ranges of load.
More specifically, when network is not overloaded, behavior
The strong qualitative differences between these four phases of aggregate traffic resembles behavior of traffic from a single
can be seen clearly from the V-T curves and graphs of queue source. Since an individual TCP stream in the uncongested
length versus time. We categorize the four different behavoirs phase is Poisson, the aggregation of multiple streams is also
as follows.
Poisson. Hence, the V-T curve has a slope of -1. When traffic
1. Uncongested phase: Total traffic is sufficiently low that is in the sporadically congested phase, the superposition of
queues rarely form at the sources, see Fig. 3a, and congestion multiple streams yields a traffic pattern that is similar to that of
never occurs. When a network is in this phase, TCP will not a single stream. That is, the throughput fluctuates wildly when
affect the traffic flows, so TCP traffic resembles application the network is congested and becomes relatively smooth during
traffic, which is Poisson. Hence, slope of a V-T curve is -1 as
uncongested period. Hence, aggregate traffic also exhibits self-
shown in Fig. 2 when load is 0.90 Mbps.
similarity over all timescales of interest. Finally, an Individual
2. Sporadically congested phase: At greater loads, the stream appears pseudo self-simliar when network is in the
network alternates between congested and uncongested always congested phase, and the aggregation of multiple
periods. When the network is congested, queues can build up at
pseudo self-similar streams gives rise to pseudo self-similar
the sources, as shown in Fig. 3b. Throughput fluctuates wildly
traffic as well.
during congested period and become rather smooth when there
When the network is overloaded, TCP congestion control
is no congestion, so variance of throughput remains high even mechanism limits the sources’ transmission rate. While traffic
when observing over large timescales. As a result, traffic from an individual stream appears bursty, the aggregated rate is
appears self-similar with a slope between 0 and -1 on a V-T kept relatively steady at 1.54 Mbps or the bottleneck capacity.
As a result, the aggregate tends to smooth out very quickly as
3. Always congested phase: At higer loads, it is possible for
m increase and consequently the slope of V-T curves tends
a network to remain congested most of the time, so that TCP is
toward -1. This is consistent with the results described in [13].
almost always limiting the flow of traffic. Throughput at the IP

layer is roughly at the maximum and is limited by the TCP B. Effect of Number of Streams
congestion control mechanism. Throughput at the application Section III-A shows that TCP can cause the appearance of self-
layer equals arrival rate at the application layer, so source similarity when three streams pass though a bottleneck, and


Proceedings of 12th IEEE International Conference on Computer Communications and Networks (ICCCN), 2003

Fig. 2. Effect of load on an individual TCP stream

Fig. 4. Effect of load on an aggregated TCP stream.



Fig.3. Sum of source queues from four different scenario

that there are four different behaviors at different ranges of
load. In this section, we show that the same is true when there
are more than three streams. We repeat the simulation of a

network in Fig. 1, but with N = 5 and 10. Using the same
criteria in section III-A to differentiate the phase of the traffic,
With a large number of sources, the application-layer arrival
our results show that a network with 5 or 10 streams also rate per stream is smaller, so sources do not always have
undergoes the same four distinct phases. However, phase enough queued data to send very large packets. As a result,
transitions occur at different loads. Table I shows a phase overload occurs at a lower load.
transition table for N = 3, 5 and 10. The four phases are labeled
V-T plots with five and ten streams scenario are similar to
as p1 to p4, corresponding to the network in the uncongested the plots with 3 streams (Fig. 2 and Fig. 4); depending on the
phase to the overloaded phase, respectively
phase that a network is in, traffic from individual and aggregate
In particular, we observe that with fewer streams, a network
stream show different kinds of behaviors, as explained earlier.
starts to experience an extended period of congestion at a lower

load in the scenarios we observed. The fact that packets are C. Effect of Round Trip Time
typically lost in bursts is presumably a factor. More
specifically, when there is smaller number of sources and We study the effect of RTT by varying the link delay from 5
therefore larger data rate per source, it is more likely that there
ms to 50 ms. In this case, congestion occurs at a higher load
will be enough lost packets in a given stream to trigger full go
when RTT is greater. Table II shows a phase table of a network
back N. As a result, there are more retransmissions and with delay of 5, 15, 25 and 50 ms, where phases are determined
congestion is more likely to extend over a longer period than using the qualitative criteria described in Section III-A. After a
when there are more sources.
packet is lost due to congestion, the congestion window is
As Table I shows, the range of loads in which the network is
halved and is increased once per RTT if the retransmission is
in the always congested phase is much lower when there are successful. When RTT is small, source transmission rate
more streams. As a result, in this scenario, when there are many
quickly increase to its former level, possibly allowing the
streams, the network is never congested at higher application-
congestion to continue. Hence, phase transition of a network
layer arrival rates, but it is overloaded at lower rates. Recall where everybody has short RTT tends to occur at a lower load.
that IP-layer arrival rate is roughly the same when the network
In other words, traffic exhibits self-similarity at lower load
is in the always congested phase, and a greater application-
when RTT is small.
layer arrival rate can be tolerated without overload by
In a real network, TCP connections are likely to have widely
increasing packet size, and thereby decreasing header overhead.
different RTT. We extend our study by simulating a network


Proceedings of 12th IEEE International Conference on Computer Communications and Networks (ICCCN), 2003
with three streams where each stream has different RTT, i.e., exceeds network capacity. However, when the network is not
stream_n; n = 1,2 and 3 has a delay of 5 ms, 25 ms, and 50 ms,
overloaded, aggregate traffic can appear self-similar if one or
respectively. We refer to this as heterogeneous RTT scenario.
more streams appear self-similar since variance of the
Each stream exhibits the same four behaviors described aggregate roughly equal the sum of the individual variances.
earlier at four different ranges of load. However, at a given
Given that TCP can create self-similarity in network traffic
arrival rate, streams with different RTTs may be in different in a variety of circumstances, it is likely that self-similarity will
phases. In particular, if L is the load that stream n moves from
probably be observed in all networks that use TCP, even if
one phase to the next, L is smaller if the other streams that future applications are Markovian. It may also be possible to
stream n competes with have shorter RTTs. This is consistent develop different algorithms in future generations of TCP that
with the fact that TCP’s congestion control mechanism gives a
do not create or exacerbate long-range dependence. We believe
smaller throughput to a stream that must compete with other that this is an open area for future research.
streams that have smaller RTTs [3]. For example, Fig. 5 shows

a V-T plot of three streams with heterogeneous RTTs when
arrival rate ranges from 1.08 Mbps. to 1.50 Mbps. According to
Figure 14a, stream 1, whose delay is 5ms, experiences no
congestion (slope of -1), while the other two streams
experience occasional bouts of congestion and appear long-
range dependent with slope between 0 and -1. Figure 5b shows
that traffic from stream 3 exhibits pseudo self-similarity while

the other two streams are self-similar. At greater loads (Figure
5c-d), all streams appear pseudo self-similar.
The variance of the aggregate traffic, on the other hand, is a
function of the variance of all the individual streams and is
dominated by the stream with the highest variance. In
particular, when total load is less than the network capacity, the
slope of an aggregate traffic resembles the one with the largest

variance and can possibly exhibits self-similarity if one of the

streams is self-similar. Note that if one stream is self-similar, it
Figure 5. V-T plot of a 3-stream with heterogeneous RTT scenario
will inevitably have the greatest variance for larger timescales.

However, if load exceeds the capacity, aggregate throughput is
limited by TCP congestion control mechanism. Consequently, [1] M.E. Crovella and A. Bestavros, “Self-similarity in World Wide Web traffic:
the slope of a V-T curve of the aggregate stream approaches -1
Evidence and possible cause,” IEEE/ACM Trans. on Networking, vol.6, pp.
as load exceeds the capacity. See Fig. 5d.
835-846, Dec. 1977.

[2] D. R. Figueiredo, et. al., “On the autocorrelation structure of TCP traffic,”
Comp. Networks Journal, Special Issue on Advances in Modeling and Eng.

of Long-Range Dependent Traffic, vol. 40, no. 3, pp. 339-361, Oct. 2002.
[3] S. Floyd and V. Jacobson, “Connection with multiple congested gateways in
We showed that TCP could indeed cause the appearance of
packet-switched networks, Part1: One-way Traffic,” ACM Comp. Comm.
self-similarity in network traffic even with Markovian input at
Review, vol. 21 No.5, pp. 30-47, Aug 1991.
the application layer. In particular, we observed four different [4] L. Guo, M. Crovella, I. Malta, “How does TCP generate pseudo-self-
kinds of traffic behavior at four different ranges of load in a
similarity?” in Proc. of MASCOTS '01, Cincinnati, Ohio, Aug. 2001.
[5] W.E. Leland, M.S. Taqqu, W. Willinger and D.V. Wilson, “On the self-
network where all streams have identical RTT. This is true
similarity nature of Ethernet traffic,” in Proc. ACM SIGCOMM, pp. 183-
regardless of the RTT and the number of TCP streams,
193, Sept. 1993.
although the phase transition may occur at different loads with [6] T. Le-Ngoc, S.N. Subramanian, “A Pareto-modulated Poisson Process model
different RTTs and different numbers of streams.
for Long-Range dependence traffic,” Computer Communication, vol.23, pp.
123-132, January 2000.
Traffic is Poisson when load is low such that congestion [7] S. Manthorpe, et. al, “The Second-Order Characteristics of TCP,” in Proc. Of
never occurs. At greater loads, the network alternates between
Performance ’96, Lausanne, Oct 1996
congested and uncongested periods, and TCP can induce the [8] A. Ost and R.H. Boudewijn, “Modeling and Evaluation of pseudo self-
appearance of self-similarity over a wide range of timescales.
similar traffic with Infinite-State Stochastic Petri Nets,” in Proc. of the
workshop on formal method and telecom.,
pp. 120-136, Sept 1999.
When the network is always congested, TCP traffic appears [9] K. Park, G. Kim, and M. Crovella, “On the effect of self-similarity on
pseudo self-similar. Finally, when load exceeds the capacity so
network performance,” in Proc. of the SPIE International Conf. on
the network is overloaded, TCP congestion control holds
Performance and Control of Network System, pp 296-310, Nov 1997.
aggregate throughput steady at the network capacity so [10] J. M. Peha, “Protocols can make traffic appear self-similar,” in Proc. of the
1997 IEEE/ACM/SCS Comm. Networks and Distributed System. Modeling
aggregate traffic exhibits short-range dependence, while each
and Simulation Conf., pp. 47-52, Jan 1997.
individual stream remains self-similar.
[11] V. Paxson and S. Floyd, “Wide-Area Traffic: The failure of Poisson
When RTT of each stream is not identical, the level of
modeling. IEEE/ACM Trans. on Networking, vol. 3, no. 3, pp. 226-44, June
congestion each stream experiences can be very different,
[12] V. Paxon, “Fast Approximation of Self-Similar Network Traffic,”
though they go through the same bottleneck. Aggregate traffic
Technical Report LBL36750, U. of California, Berkeley, Apr 1995
of heterogeneous RTT streams tends to smooth out as load [13] A. Veres and M. Boda, “The chaotic nature of TCP congestion control,” in
Proc. IEEE INFOCOM 2000, Tel Aviv, Israel, pp. 1715-1723, Apr 2000.