Characterization of Traffic at a Backbone POP

1. Nina Taft Supratik Bhattacharyya Jorjeta Jetcheva Christophe Diot Characterization of Traffic at a Backbone POP

2. Questions : • Where does the traffic come from? • Between any two POPs : • What is the volume of traffic? • What are the traffic patterns?

3. Applications • Traffic Engineering • Verify BGP peering • Intra-domain routing • Writing SLAs

4. Sprint IP Monitoring Project • Insert optical splitters in multiple POPs and on numerous links within each POP. • Currently monitoring OC3 access links • Collect and timestamp all IP headers • Collect routing information (IS-IS, BGP) • Transfer data to lab for off-line analysis

5. City A City B City C City A City B City C Traffic Matrix • For each ingress POP : • identify traffic to each egress POP • further analyze this traffic Measure traffic over different timescales Divide traffic per destination prefix, protocol, etc.

6. Access Access Access Access POP architecture public peer private peer Core Core Core web hosting

7. Data 4 traces collected on Wednesday August 9, 2000

8. The Mapping Problem • What is the egress POP for a packet entering a given ingress POP? • Method : • Map each BGP next hop to a POP • Extract destination address from each packet • Use longest prefix match with (BGP destination, POP) table

9. (Dst,Next-Hop) Find best Next-Hop BGP table (Next-Hop, POP map) Map Dst to POP Get Unique Next-Hops Unique Next-Hops Map to POP (BGP Dst,POP) Traceroute to each Next-Hop (Next-Hop, Last Sprint Hop) Trace back to last Sprint hop Mapping BGP destinations to POPs

10. POP-to-POP Traffic Matrix

11. POP-to-POP Traffic Matrix:fan-out plots per access link

12. Traffic Matrix: fan-out plots per access link

13. Observations and Comparison of Access Links • top 3 different for each access link • bottom 3 same for each access link • 3 of 4 have one egress POP that is much bigger than rest: twice as big as next largest • 1/3 of egress POPs carry very little traffic • consistent heaviest hitter: to east coast POP that connects to cross-oceanic links

14. Fluctuation of Traffic Matrix

15. Time of Day Behavior: 5 POPs, 1 access link

16. Time of Day Behavior: 4 access links, 1 POP

17. Elephants and Mice Behavior • 1st granularity level: prefix mask of 8 bits • split heaviest POP-to-POP stream into substreams • equivalent to aggregating all packets with same 8-bit prefix into one stream • top 10% make up 82% of traffic • 2nd granularity level: prefix mask of 16 bits within mask-8 substreams • subdivide an elephant of mask-8 streams • top 10% make up 97% of traffic

18. Elephants and Mice Behavior

19. Frequency of rank changes • 70% of streams in the top 10%, stay in the top 10%. • 70% of those in the bottom half, stay in the bottom half. • Definition: • Ri(n) = the rank of flow i at time slot n • Di= | Ri(n) - Ri(n+k) | • each time slot corresponds to 30 minutes • computed for 26 values of n (13 hours)

20. Frequency of Rank Changes

21. Conclusions • POP-to-POP traffic matrices are non-uniform • Different access links are ?? • Overall, traffic is reduced by a factor of 2 at night • The elephants & mice phenomenon exists within streams categorized by destination prefix • The elephants & mice phenomenon appears to be recursive • The distribution of changes in rank is the same for multiple time intervals.