1 / 69

UDP-based Streaming Media Traffic Measurement

This report outlines the measurement of UDP-based streaming media traffic over the internet, including its characteristics, distribution, and impact on TCP applications. It also discusses capacity planning and packet classification.

tcolmenero
Download Presentation

UDP-based Streaming Media Traffic Measurement

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Internet Streaming Media UDP-based轉送訊務的量測 中央大學電算中心 楊素秋 Dec, 2002

  2. 報告大綱 • 1.前言 • 2.相關研究 • 3.Prevalent UDP Application • 4.Streaming Media傳訊模式 • 5.Video Game 訊務特徵 • 6. Streaming Traffic統計方法 • 7.熱門應用訊務分布 • 8.結語

  3. 1.前言 • Streaming Media Traffic over Internet • 1970年代的audioconference • 1990年代初期的 Mbone Video Conference • variable delay Internet • Constant Bit Rate (CBR) traffic • 囿於網路頻寬限制致streaming 品質無法為用戶接受 • 隨著Audio/Video壓縮技術,網路頻寬的大量提昇 • Internet用戶使用free 播放程式 • 播放音樂、新聞及影片視音節目.

  4. 大量的Streaming media UDP訊務 • 容易造成網路資源分配不均,影響 TCP 應用延遲,產生traffic congestion • 實做承載訊務的量測 • 找出streaming media 的 transportation features • 統計/分析 streaming media訊務及其成長趨勢 • 分析熱門應用訊務分布 • Capacity planning • Packet Classification

  5. 2.相關研究 • Internet Traffic Measurement • LAN Traffic Measurement • gathered packet-based traffic logs through tcpdump. • Provide traffic measurement over one broadcast segment • Each traffic log recording the transportation information of each packet • TimeStamp • Src_ip.src_port > dst_ip.src_port • bytes • Transportation protocol

  6. 相關研究(cont.) • Barnet B. G. • measured traffic of an Ethernet segment • approximately 79% of the total Ethernet traffic in bytes was NFS traffic. • Kushida Takayaki • gathered traffic logs over FDDI backbone through tcpdump • The measurement result reveals that • about 98.2% of the traffic was TCP traffic.

  7. 相關研究(cont.) • WAN Traffic Measurement • Thompson Kevin et al. • Measured wide-area Internet traffic on anOC3 trunk within MCI ATM backbone using OC3MON • TCP is the dominant protocol on the link; about 95% of the bytes. • UDP is the second most dominant, with roughly 5% of the bytes,DNS dominates the total UDP traffic.

  8. 相關研究(cont.) • Measuring WAN traffic using NetFlow or SFlow transportation traffic log gathered from router • WAN router轉送Internet訊務 • router高效率暫存各介面轉送封包header • 加總各flow轉送訊務紀錄,週期性送往 Collect PC • Collecting PC 執行 flow-tools shareware,接收與儲存區網 netflow logs (per-10-min) • 提供region network 轉送訊務的追蹤與統計

  9. 相關研究(cont.) • Light-Weight Netflow traffic logs recording • flow identifier • source IP address, source port, • destination IP address, destination port • protocol identifier • packet count, byte count, • source及destination interface identifier.

  10. 相關研究(cont.) • Transit Traffic Log providing • 特定flow訊務特性的追蹤 • 統計Top-N user traffic (IP-based) • src_ip, dst_ip • source/ destination interface • protocol identifier • 監測轉送的TCP與 UDP 輸出/輸入訊務 • 分析熱門網路應用訊務分布 • source port, destination port

  11. 相關研究(cont.) • Art Mena et al. • Tcpdump 蒐集 RealAudio servers訊務 headers • 位於Broadcast.com 區域網段的5 部 RealAudio servers的訊務 headers • 統計 RealAudio servers的輸出與輸入media訊務特性 • 統計數據顯示: • 絕大部分的RealAudio Servers訊務為單向的大量傳送, • RealAudio 封包長度明顯大於一般UDP flows 封包.

  12. 相關研究(cont.) • Jacobus Merwe et al. • extracted and analyzed 4.5 million application level session-level log entries for two streaming services • over a period of 4 months. • The fields in each log entry include: • requesting IP address, • particulars of requested resource, • Real or Windows Media object • transport protocol • TCP or UDP • total data transmitted • session end-time, total session time, • status/error codes, etc

  13. 相關研究(cont.) • Characterize the workload by looking at a number of different measures of on-demand media servers • Protocol family • MMS 72%, Real 23% • Bandwidth • low 35%, High 65% • Transportation protocol • UDP 34% , TCP 29%, Http 37%

  14. 相關研究(cont.) • Schulzrinne H. et al. • Real Time Transportation Protocol • RTSP streams • Real Time Streaming Protocol(RTSP) • Session control • Remote control streaming options • play, fast forward, rewind, pause, restart • RTP/RTCP streams • Real-Time Transportation Protocol(RTP) • Accompanying streams • Media / QoS Packets

  15. 相關研究(cont.) • Conlklin G.J. et al. • Scalable and adaptive streaming delivery • Vendor strategies • MMS, Real commercial products • Client-Processing QoS Evaluation • Application-Level Multicasting

  16. 相關研究(cont.) • client 端處理QoS參數 • Accounting QoS • Estimated end-to-end variant delay & packet loss • According to the media packet headers • Feedback RTCP QoS參數 • 調整傳輸品質或速率 • Stop/redirect media streaming

  17. 相關研究(cont.) • Application-level multicasting • Geographically distributed servers • RTSP Agent蒐集members辨識資訊 & 傳訊參數(jitter, loss) • Redirect clients與較接近或負荷低的server建立傳輸連接 • 減輕massive media streaming對沿徑連網品質的影響.

  18. 相關研究(cont.) • Our work • 統計streaming media過境訊務 • 追蹤WAN router 轉送的media 訊務紀錄 • 依據streaming media傳輸特性,歸納傳輸特徵 • QuickTime, RealPlayer, MediaPlayer • 分析streaming media WAN 轉送訊務

  19. 3.Prevalent Application • TCP Application • Mail, Telnet, Ftp, WWW • Streaming Media, P2P file sharing • UDP Application • DNS, Tftp • Streaming Media, Game • VoIP/ SIP

  20. TCP Application • TCP Applications • Mail • SMTP(25 port), POP3(110 port) • Telnet • Telnet (23 port), ssh (22 port) • Ftp • Ftp-data (20 port), ftp (port 21) • Fast Ftp ** • WWW/Proxy • Httpd (80 port), sHttpd (443 port) • Proxy (3128 port, 8080 ports)

  21. Fast FTP traffic Logs ===================================================== 61.13.173.211.1229>140.135.101.74.2090 958575.000 684 1401.425 140.135.101.74.2090>61.13.173.211.1229 31192.000 764 40.827 61.13.173.211.1230>140.135.101.74.2095 1025917.000 733 1399.614 140.135.101.74.2104>61.13.173.211.1232 120.000 3 40.000 140.135.101.74.21>61.13.173.211.1193 917.000 10 91.700 140.135.101.74.2095>61.13.173.211.1230 31380.000 769 40.806 140.135.101.74.2102>61.13.173.211.1231 3124.000 74 42.216 61.13.173.211.1231>140.135.101.74.2102 116249.000 87 1336.195 61.13.173.211.1232>140.135.101.74.2104 144.000 3 48.000 61.13.173.211.1193>140.135.101.74.21 225.000 5 45.000 61.13.173.211.1233>140.135.101.74.2105 866487.000 619 1399.817

  22. TCP Application (cont.) • P2P applications • Napster (6677, 6688 port) • eDonkey (4661, 4662 port) • KaZaA (1214 port) • Streaming Media • MediaPlayer (1755 port) • RealPlayer (7070 port) • QuickTime Player (554 port) • Others

  23. UDP Application • DNS • server accepts client’s gethostbyip() or gethostbyname() calls on fixed 53/UDP service port. • Tftp • server accepts client connection requests for control stream on 69/UDP service port • generatesdata streams to client sites using dynamic UDP port piggybacked from client for transmitting data

  24. TFPT Traffic Logs … ======================================================= 140.138.143.42 . 1068 > 140.130.120.14.69 135 .000 3 43.000 140.138.143.42.1052>140.130.120.14.4902 423232.000 13226 32.000 140.130.120.14.4902>140.138.143.42.1052 6837536.000 12569 544.000 140.138.143.42.1053>140.130.120.14.1978 432160.000 13505 32.000 140.130.120.14.1978>140.138.143.42.1053 7098656.000 13049 544.000 … 140.138.143.42.1064>140.130.120.14.3613 428128.000 13379 32.000 140.130.120.14.3613>140.138.143.42.1064 7235744.000 13301 544.000 140.138.143.42.1065>140.130.120.14.4692 431168.000 13474 32.000 140.130.120.14.4692>140.138.143.42.1065 7148160.000 13140 544.000 140.138.143.42.1066>140.130.120.14.1833 445024.000 13907 32.000

  25. UDP Application (cont.) • VoIP (NeetMeeting) • server accepts request using fixed UDP service ports that ranges from 49601 to 49609. • SIP (Service Initiation Protocol) • IP multicast traffic • using class D IP addresses ranging from 224.1.0.0 through 239.255.255.255

  26. UDP Application (cont.) • Virus (Linux Slapper Worm) • adopts the same UDP service and client ports • UDP ports adopted by Slapper Worm including • 2002, 2001, 1978, 4156, 1812, 6257 • depends on the different virus versions.

  27. UDP Application (cont.) • Video Games • short lifetime synchronous flows. • Counter_Strike • uses 27015 UDP service ports • Quake_3 • uses the fixed 27960, 27961,27962 UDP service ports. • StarCraft • uses the fixed 6112 service port.

  28. UDP Application (cont.) • Streaming Media Traffic • Microsoft’s Media Player • 採用1024 ~65535 range的可用UDP service port傳送RTP 視音訊封包 • 大量視音訊流的同時存取 • 避開 firewall對承載media stream的過濾 • media過境訊務統計 • 無法依據fixed service port 辨識轉送訊務log • 加總media訊務量

  29. 4.Streaming Media傳訊模式 • Streaming Media轉送訊務的追蹤 • 追蹤streaming media flow • 歸納視音訊務傳輸特徵 • 統計WAN streaming media轉送訊務

  30. 實測網路 • TANet網路採階層的連線架構 • 桃園區域網路router界接 • TANet其他區網中心 • ISP 網路業者 • 區域連線學校 • 15個大學,30個高中職,數百個國中小學 • Gigabit Ethernet • T1/E1 (1.544 Mbps/ 2.048 Mbps)

  31. 骨幹Router及階層式連網架構

  32. Streaming轉送訊務的追蹤 • Step 1: 依據streaming media大packet size傳輸特性,擷取 packet size大於500 bytes/packetUDP flowlogs. • Step 2: 依據flowidentifiers (source IP/ source port, destination IP /destination port), 追蹤包含各 client IP 的轉送flows紀錄.

  33. Step 3: 歸納的 media傳訊特性 • RTSP stream • RealVideo選用7070/TCP service port • Quick Time 則選用554/TCP RTSP service port • MediaServer採用1755/TCP的RTSP service port • RTP/RTCP stream • RealVideo 與Quick Time • 採用 6970-7170 UDP client ports 建立RTP連接 • Send RTCP feedback in reverse direction • MediaServer • 採用1755/UDP RTCP service port • 選用 動態UDP ports RTP建立連接,1024-65535 ports

  34. 歸納MediaPlayerRTP 與RTCP傳輸streaming的規律性. • MS Media Server • RTSP agent以1755/TCP port 等待MediaPlayer (client) 連接 • server依據回應的client RTP/RTCP port pairs • 分別建立RTP傳輸與RTCP控制streams, • 遞送 real-time audio/video content,session control訊息

  35. 5. Video Game 訊務特性 • 絕大半的UDP flow 轉送紀錄承載DNS 及 Video Game synchronization 連接 • Short-life • Carrying small traffic amount • 相當高比率的 Video Gaming 訊務為承載小訊務量flows

  36. Game 訊務特性 (cont.) • 依據 src_port, dst_port為key 統計轉送flow count分布 • Top-10高連結頻次的UDP應用包括: • 使用 53 service port 的DNS, • 使用 27015, 27020 service port 的Counter_Strike • 使用 4665 port 的eDonkey_Msg, • Windows Netbios-ns 的137 service port

  37. 依據transportation port為key 統計video game flow 封包數分布 • 98% 的Counter_Strike flows傳輸的封包數目小於 10 packets, • 90% 的 Quake_3 flows • 73% 的StarCraft flows. • 傳送封包數大於 50 packets的大訊務量game flows 為特殊 port的 Game flows (Table 3) • 93.4 % 的27015 – 27005 CS flows, • 100% 的27960—27960 Quake 3 flows, • 95% 的6112-6112 StarCraft flows.

  38. UDP Port Flow_cnt 1 DNS (53) 1817451 2 CS_game (27015) 248018 3 EdonkeyMsg (4665) 20780 4 NTP (123) 14827 5 CS_game (27020) 14540 6 Netbios-ns (137) 10496 7 Snmp (161) 6711 8 Mplayer RTSP (1755) 6036 9 MSNmessenger (6257) 1792 10 Tftp (69) 1764 TYC連網的UDP訊務 flow count 分布

  39. pkts/flow CS flows Quake flows StarCraft flows 1 54672 (22.032 %) 492 (57.143 %) 6293 (43.091 %) 2 ~ 10 189312 (76.291%) 252 (29.268 %) 3834 (26.253 %) 11 ~ 20 81 (0.033 %) 30 (3.484 %) 647 (4.430 %) 21 ~ 30 13 (0.005 %) 11 (1.278 %) 317 (2.171 %) 31 ~ 40 154 (0.062 %) 1 (0.116 %) 255 (1.746 %) 41 ~ 50 65 (0.026 %) 1 (0.116 %) 167 (1.144 %) > 50 3846 (1.55%) 27005 -27015 93.4 % 74 (8.59%) 27960- 27960 100% 3091 (21.16%) 6112- 6112 94.6 % others 6.6 % others 0.0 % others 5.4 % TYC連網的Video Game flows分布

  40. 6.MediaPlayer Traffic統計演算法 • Step 1: Extract the transportation addresses of the high-bandwidth streams. • Parse the per-10-min UDP traffic logs • determine the likely RTP flow logs by checking mean packet size feature • extracting the likely transportation address of RTP client sites • destination IP addresses • destination UDP client ports

  41. Step 2: Estimate the transportation addresses of the likely RTCP streams • Estimated the client transportation addresses of likely RTCP streams • destination IP addresses • destination UDP client ports satisfy • RTCP_client_port = RTP_client_port - 1.

  42. Step 3: Extract parallel RTCP/RTP flow logs • Extract parallel RTP/RTCP streaming logs from the likely streaming log-files • determine the RTP/RTCP flow logs • checking the transportation address of RTSP streams • IP addresses obtained from step 1 and 2 • if there exist the relative RTSP session streams using 1755/TCP service ports..

  43. Step 4: Filter and accumulate media player traffic volume • Filter out the prevalent video game flow logs from the extracted RTCP and RTP flow logs, such as Counter_Strike and Quake. • Accumulate media player traffic for each time interval

  44. ** Streaming Media Flow logs 210.155.134.232.1755>140.135.155.99.1777 I 592.000 10 59.200 //RTSP 140.135.155.99.1778>210.155.134.232.1755 3604.000 80 45.050 //RTCP 210.155.134.232.3836>140.135.155.99.1779 484543.000 336 1442.092 //RTP ** Fast Streaming Media Flow logs 211.72.248.106.1755>140.138.243.167.1098 1192.000 13 91.692 // RTSP 140.138.243.167.1110>211.72.248.106.1755 1524.000 34 44.824 //RTCP 211.72.248.106.4344>140.138.243.167.1111 943500.000 629 1500.000 //RTP 211.72.248.106.2857>140.138.243.167.1121 357802.000 239 1497.079 //RTP 211.72.248.106.4498>140.138.243.167.1131 58705.000 59 995.000 //RTP 211.72.248.106.3773>140.138.243.167.1211 38246.000 26 1471.000 //RTP 211.72.248.106.2963>140.138.243.167.1140 671246.000 448 1498.317 //RTP

  45. TANet桃園區網MediaPlayer訊務分布

  46. MediaPlayer traffic volume in byte • our measurement network ( Nov in 2002) • streaming media訊務低峰 • 清晨時段(4:00–8:00). • streaming media訊務高峰 • 午休 ~ 凌晨時段

More Related