Final Version - Cagdas Dönmez

8/3/2019 Final Version - Cagdas Dnmez

1/12

1

TCP Revisited: A Fresh Look at TCP in The Wild

Prepared By:

Cagdas Dnmez - 329277

TU BerlinFaculty IV

Network Protocols & Architectures Specialization

SS 2011Internet Measurement Seminar

Abstract:

The profile and the requirements of the applications in Internet have remarkably changed over the last

decade. Despite these changes, TCP still remains on the center of the Internet and is responsible for

the majority of the traffic. The authors in this study focus on examining the up-to-date flow

characteristics; how they evolved and what kind of an impact do these changes pose on the actual TCP

traffic. In this study, they have developed several unique methods for their flow characteristics

analysis. Later on, they check to the credibility of their results; if the proposed methods delivered

reliable and accurate results. Finally they apply their methods on the long-lived flows for a more

efficient analysis, examining how these new applications respond and also if they comply to TCP

standards. Finally they present their results and make important conclusions regarding the deployment

of TCP.


2/12

2

1 Introduction

In the last years, we have witnessed a significant change on the networking technologies on both

hardware & software level. Performance-stringent and bandwidth-emerging applications with higher

capacity requirements, i.e. VoIP, have become widespread in Internet over the last few years. In orderto answer these requirements, there are now an improved internet frastructure with backbone links that

offer more bandwidth capacity and also new network protocols. These developments in hard- &

software level are considered to meet the demands of these new applications. However there is still

one thing that survived despite these enormous changes in Internet; TCP. On Thompson, Miller etc.s

traffic characteristics study, they indicated that TCP accounts for more than 95 percent of the

transmitted bytes, 85-95 percent of the packets and 75-85 percent of the flows. [1] It is on the center of

the Internet traffic.

The main focus point in this work is to examine TCP characteristics in the current Internet. Their

approach consists of two general phases; i) understanding the evolution of Internet, ii) inferring TCPbehavior in todays Internet. Therefore they first compare their results with those of previous flow

characteristics studies and then they examine the TCP characteristics such as congestion window size

and retransmission behavior in todays Internet. They also place a special emphasize on the origin and

distribution of TCP flow clocks.

An important issue they addressed is the heterogenosity/diversity of their dataset. Since the number

and the requirements of applications in todays Internet have increased, their variety and the number of

services offered have also increased. A more heteregenous dataset will simulate the todays Internet in

a more realistic manner. Therefore they adopt passive-measurement techniques but it is also important

to indicate that heterogenosity(=diversity) is not the only motivation beyond it. Passive measurement

techniques have also enabled them to work on a greater amount of data because of its scalability with

no additional complexity. However their measurement techniques is not purely passive, they also

adopt active probing together with passive probing in order to obtain more accurate results.

The following sections are organized as follows. In the next section basic information about flow

characteristics and heavy-hitter flows are given. Section 3 covers the measurement methods. The

measurement approaches in other works and also how they are related to this work is also presented.

Section 4 explains their methodological approach. The basic principles beyond their proposed

algorithms are given. Their validation methods and also their analysis results on long lived flows are

discusses. Section 5 points out to the importance and uniqueness of this study.

2 Flow Characteristics

This section includes basic information about flow characteristics. In this study, the dynamics of

current TCP traffic in Internet is the focus point. For this purpose it is very important to understand

how the flows are characterized. Their characterization forms a basis point on the analysis of Internet

traffic, especially for optimization and planning purposes. Through the analysis, one can get an idea

about potential needs and improvements in Internet.

In this study four basic flow characteristics are analyzed; size, duration, rate and burstiness. [2] The

definitions of these characteristics are simple. Size is the total number of bytes sent in a flow. [2, 3]


3/12

3

Duration is the time elapsed between the first and the last packet of the flow. [2, 3] Rate is the division

of size by duration. [2, 3]

The definition of burstiness may alter from work to work. In this study, burst is referred to as a train of

packets whose inter-arrival time are less than 1 ms. Burstiness is calculated by multiply the average

burst rate by the average inter-burst time. [2] However in Lan & Heidemanns study, they refer to theburstiness as a deviation of burst length. They indicate that burst length is the number of bytes

transmitted in a flow within of T second of interest. [3]

2.1 Heavy - Hitter Flows

Many studies and researches in this field have proven that most of the traffic in Internet is due to a

very small number of flows. These flows are generally referred to as heavy -hitter flows. Actually

being small in numbers, they give the researchers and traffic engineers a significant advantage on

analysis. By considering a small number of flows, one can get a good idea about the big picture in

Internet. Analysis and characterization of these flows can affect the overall flow dynamics in Internet.

In this study, they refer to heavy-hitter flows as the ones with large size, long duration, high speed

and strong burstiness. [2] To avoid confusion, heavy-hitter flows do not have to have extreme values

on each of these flow characteristics. Also these characteristics may be related to each other as well,

how they are related to each other will be explained in the following chapters.

The heavy-hitter flows are categorized according to their values on each of the flow characteristics. In

our study, the indicated heavy-hitter flow categories are; elephant, tortoise, cheetah and porcupine.

From these metaphorical names, one can infer on which aspect a flow has an extreme value. Elephant

corresponds to the size, tortoise corresponds to the duration, cheetahs to the rate and finally porcupines

to the burstiness.

In Lan & Heidemanns study, they defined these categories in a very understandable manner. For each

flow characteristic, they set a threshold value and categorize them according to these threshold values.

For instance they define elephants as flows with a size greater than 100 KB. Tortoises are defined as

flows with duration longer than 15 minutes. Cheetahs are flows with rates larger than 100 KB/sec and

finally porcupines are those with burstiness greater than 100 KB. [3] It is also important to note down

that these threshold values or any other criterias that helps to categorize the heavy-hitter flows may

change from work to work.

3 Measurement Methods

This section includes information about measurement methods. The methods they used in this study

include both a passive and an active approach. They mostly adopt passive measurement methods in the

implementation phase. For initial congestion window size and the detection of irregular retransmission

behavior, they adopt passive techniques and for the flow clock extraction, their analysis depends on

statistical methods and mathematical tools for signal processing. In the validation phase, they

preferred active probing as a supportive method for their passive measurements. They utilized active

probing for gathering more accurate RTT, loss rate, frequency characteristics. [2]

3.1 Passive Measurement

Passive measurement is a very useful technique for collecting a large amount of data. Throughoutmany studies in this field it has been adopted and there are several examples of especially by those


4/12

4

which study the TCP traffic characteristics. In the work conducted by Jaiswalt, Iannacone, Kurose etc

al., they adopted passive measurement techniques for inferring TCP connection characteristics. [4]

Another study by Jiang and Dovrolis, tries to estimate TCP round-trip times through the passive

estimation methods. [5]

The passive implies that there is no intervention in the data communication process. The toolsproposed in this study or in the mentioned studies neither directly take part in the data communication

nor manipulate traffic and thus enforce one of the communicating sides to react. Only a monitoring

point is installed between the actively communicating end-users on the link. The guesses &

estimations about the events(such as the growth of congestion window size or current state at

sender/receiver) are made.

In the mentioned studies, that focus on TCP characteristics, there are two key parameters; congestion

window size and RTT. These parameters have a very important role in TCP flow characteristics

studies, because they are unique to TCP. Understanding how these parameters change under different

scenarios on the network, the TCP behavior can be inferred. In [4] & [5], they both attempt to estimate

RTT and congestion window sizes through passive measurements. Especially in Jaiswalt, Iannacone

and Kuroses work, this passive measurement scheme can easily be understood.

a) Sample based RTT Estimation b) SYN-ACK (SA) RTT Estimation

Figure 1. Passive RTT Estimation Schemes taken from two different studies

The Figure 1. (a) is taken from Jaiswalt, Iannacone & Kuroses etc. als work [4] and (b) is taken from

Jiang and Dovroliss work [5]. The vertical lines on the middle of both (a) & (b) represent the placed

monitor on the link. The distance between the intersection points of monitor line with packet flights,

give the RTT estimation. The figure 1 illustrates the basic principle of passive RTT estimation

graphically. d1 on Figure 1.(a) represents the time after transmitted data hits the monitoring point

and reaches the destination, where as d2 denotes the time that acknowledgement(s) hits the

monitoring point and reaches the sender/caller. By adding d1 & d2, an approximate estimation of

RTT is calculated. However it is important to indicate that both situations represent an ideal

communication without any losses. Further challenging scenarios with losses, bottleneck links and

retransmitted packets etc. were also discussed in [4] & [5].1

1 Refer to the studies [4][5] for more details about the constraints to passive measurement techniques


5/12

5

It is also important to mention that there is a significant difference between these two schemes. On the

scheme proposed by Jaiswalt, Iannacone & Kurose, RTT is attempted to estimate over the

communication lifetime whereas Jiang and Dovroliss scheme depends only on the connection setup

phase(=handshaking). The congestion window size estimations are based on RTT calculations.

3.2 Active Measurement

In this subsection, information about active approaches and a related work that adopts active probing

are presented.

3.2.1 TBIT

TBIT stands for TCP Behavior Inference Tool. It helps to characterize the TCP behavior of a remote

web server. [6] The importance of TBIT from the view of this work lies in inferring the initial

congestion window size. In the validation phase, the authors in this work compared the results of their

algorithm with the results delivered by TBIT.

TBIT uses an active measurement approach. It basically manipulates the remote TCP server in order to

see how it reacts to these manipulations. Artificial losses are created by TBIT and the corresponding

response of remote servers to these artificial losses are examined. This way the remote server is forced

to reveal more information about itself. [2]

TBIT process fabricates TCP packets and uses raw IP sockets to send them to a remote host. [6] Then

it deploys a different packet dropping policy strategy on different occasions. For instance in initial

congestion window size estimation, after handshaking process it stops responding on purpose. On

another occasion for the conformance of congestion control algorithms to TCP standards, TBIT drops

13th & 16th packet on purpose and etc. [6]2

4 Flow Analysis

They first make a usual flow characteristics analysis and compare to their findings with those of

previous studies. Then they propose the algorithms developed by them. This section gives information

about the principles of their methods, then their obtained results will be presented. It also includes

validation results which point out to the sucess of their methods. Another important issue is that they

focused on the long lived flows because these flows are more likely to trigger TCP mechanisms such

as congestion window size etc. Therefore the behavior of TCP is much more visible.

They stated their motivations on the analysis long lived flows as follows; i) They contribute toconsiderable traffic volume, as for each dataset, the long-lived flows accounts for at most 0.16% of all

flows, but contributes at least 55% of traffic volume, ii) Long lived flows provide enough information

as required by statistical approaches, iii) The reduction of the number of flows significantly saves

analysis time without losing the global view on the datasets. [2]

4.1 Flow Characteristics

They first make a flow characteristics analysis. They handle their flow characteristics analysis over the

previously mentioned four basic characteristics; size, duration, rate and burstiness. They compare their

2Refer to the study of Padhye & Floyd; On Inferring TCP behavior for more details about TBIT


6/12

6

results with previous studies to specify the changes in these characteristics. This is important towards

understanding the evolution in Internet.

The work conducted by Zhang, Breslau etc. al, the flow rates were examined. They also investigate

how flow-rate is related to other flow characteristics such as size and duration. [7] Therefore they

compared their results with those in [7] to see the change in the flow rates. In that work, their findingsindicate that flows with a rate higher than 100 kbps lie are around 4% - 10% however in this study this

percentage increases to at least 17 %. [2, 7] It is easy to relate this increase on flow rates with

improved internet infrastructure. Compared to those with the beginning of the last decade, users now

enjoy more bandwidth and faster connection speed.

Lan & Heidemanns study is also important for this study. They examined the heavy-hitter flows and

proved that there are strong correlations between these flow characteristics. [3] In this study they also

compared their flow analysis results with Lan & Heidemanns study to see how actual flow

characteristics are related to each other.

a) Correlation Between Different Categories b) Taxonomy Domain Traffic

Table 1

Correlation Characteristics 3

Table 1 is taken from [3]. It explains the correlation of the flow characteristics pairwise. They

indicated in [3] that there is a significant positive correlation between rate, burstiness and size. These

correlations can be interpretated as fast heavy hitter flows are also bursty with a huge probability. On

Table b) in Taxonomy it can be seen that cheetahs are not only fast but also bursty. Another example

to this strong correlation between rate, burstiness and size is Porcupine heavy-hitter flows. Again on

b) it can be inferred that they are large-sized, fast and bursty. Their flow characteristics analysis

generally overlap with the results of [3], only the indicated correlation strengths differ.

Another important extraction from this study is that most of the long-lived flows are actually

multimedia-streaming and online gaming applications.[2] Previously it was thought that long-lived

flows are actually caused by the user interaction.

They finally conclude that there is an increase in rate and sizes of the heavy-hitter flows. The rate of

elephant flows increased by a factor of 10 whereas the sizes of elephant, cheetah & tortoise flows

increased by an order of magnitude. [2]

3 Los Nettos and NLANR are the local servers from where they gathered their data. YYES, N - NO


7/12

7

4.2 Initial Congestion Window Size

Congestion control mechanism of TCP is essential for the stability of the networks. In case of a

congestion at the routers in internet, the resources will be wasted and losses will occur due to it.

However on the other side, it may either cause under utilization of the links and burstiness. The under

utilization of the links and the limits posed by congestion window to the flow rate is throughly studiedin [7].

Another problem that arises with congestion control mechanisms is the burstiness. In slow start phase,

the window size is doubled after each successful acknowledgement of the transmitted data. In other

words flows will send more aggressively with time. The flows will become more bursty with the time.

The value of ICW is defined in this work as the number of bytes a TCP sender can send immediately

after the establishment of a connection, before receiving any ACKs from the receiver. [2] There is an

upper bound to the size of the initial congestion window. This upper bound is defined as min (4*MSS,

max (2*MSS, 4380 bytes)). [8] As long as it does not exceed this upper bound, the sender can transmitwith any desired window size. Regarding to this, there may be cases, when the initial congestion

window size is already too big. This analysis is helpful towards the detection of the bursty heavy-hitter

flows and also for the planning & optimization in networks. Thus proper precautions to handle these

potential bursty flows can be taken at the beginning of the data communication.

The basic principle of their ICW estimation algorithm is very easy to understand. It depends on the

inter-arrival times of packets and the count of packets received. They set an upper bound to the initial

congestion window size and also a maximum gap time between the arrival times of this packets. If the

time gap between the packets is greater than this defined gap time value, then the number of packets

arrived until the latest packet arrival time will be considered as the ICW size. It is also important to

note down that since they did not manipulate or intervene the data communication process, this

approach is a passive measurement technique.4

Their ICW algorithm delivered very accurate results. They compared it with the results generated by

TBIT tool. The following table is taken from the original work [2]. For different MSS values, the

overlapping percentages of the results have been given in the table.

Table 2 The Validation Results of ICW Algorithm over TBIT results.

They applied their ICW algorithm on long lived heavy-hitter flows. They note down several cases

where the ICW size violates the upper bound on [8]. However most of the flows still comply to the

RFC standards. This can be seen on Table 3, that shows the distributions of ICW. [2]

4 For more details about the ICW algorithm refer to the sections 4.1 in the original work


8/12

8

Table 3 Distributions of ICW

When looking at the table, it can be inferred that more than 95 % of the flows have ICW size of 1-2

and 3. ICW values greater than 3 violate the specified upper bound by [8].

4.3 Detection of Irregular Transmissions via RTG

In case of a loss, the transmission rate and the window size is re-adjusted. Retransmissions indicate

packet loss[2], since the previously transmitted data were not acknowledged. Slowing down the

transmission rate in case of a loss simply reduces the congestion probability and increases the chance

of successful transmission of packets. This approach is standardized by RFC. However there may

flows exist that do not comply to this RFC standard.

The main motivation beyond this phase of the original work is to see, if the flows still behave

according to TCP standards. A flow that does not slow down its sending rate during retransmission is

defined as a flow with irregular retransmission. [2]

The motivation beyond their approach is very simple. As previously mentioned, retransmissions

indicate losses also paralel to that sender also sets the congestion window to a smaller value. It can be

inferred that, in case of a retransmission there is actually less amount of data at the receiver than

transmitted by the sender. Therefore the amount of time to transmit the whole data successfully gets

bigger with the retransmissions. It means that there is a positive correlation between the retransmission

rate and the time required to successfully transfer a fixed size of data. [2]

They propose RTG. RTG stands for Rate Tracking Graph. It is an iterative and statistic based

algorithm. It examines this positive correlation between the retransmission rate and the time. RTG

samples all pairs of (t, r) by sliding a tracking window W along the flow to test whether t and r exhibitany strong positive correlation. [2]

There are several constraints to this approach.5

The inter-arrival times(=gaps) between the packets

may not be evenly distributed. Some of these gaps can be inappropriately large and can lead to

inaccurate to results. Therefore they propose an Entropy based algorithm to remove large gaps. Pi

denotes the ith packet and d is the flow duration. [2]

5For more details about the constraints refer to the sections 4.2 & 5.2 in the original work


9/12

9

Formula 1Entropy based IAT Normalization

Figure 2Normal & Abnormal Rate Tracking Graphs

Figure 2 (a) represents a flow with a normal RTG with a very high correlation coefficient (=0,88) and

Figure 2 (b) represent another RTG with a very small coefficient. Looking at these graphs, it can be

easily inferred that with a very high correlation coefficient as the number of retransmitted bytes

increase, the time required to completely transmit all of packets increase too. Figure 2 (a) illustrates is

a successful representation of their approach.

They actually not only determined the irregular flows but also went deeper to investigate the causes of

these irregular flows. Therefore they categorized these irregular flows into five different categories; i)

Non-Conformant, ii) Rate limited by sender, iii) Partial Overlap of Sequence Numbers, iv) Gaps orRate Change, v) Unknown cases. [2]

6

Table 4 - Distribution of different types of irregular retransmission

Their findings indicate that actually only roughly 3 % of flows with high retransmission rates show

irregular retransmission behaviors. Out of 1622 flows only 50 of them were observed to be irregular. It

is clearly seen on Table 4.

6 Refer to the section 6.2 in the original work for more information about Irregular Flow Categories


10/12

10

As an overall it can be inferred that, most of the flows still comply to TCP standards and apply the

congestion control mechanisms as usual.

4.4 Flow Clock Extraction

They defined flow clock to correspond to the regular spacing between flights of packets. This work isthe first in this field trying to bring an explanation to the origins of the flow clocks. The authors have

actually applied to obtain the papent of this work.

Their motivation here is to investigate the interaction between different layers and to find out the

origins of the TCP flow clocks. TCP employs a self-clocking scheme that times the sending of

packets. In that, the data packets are sent in a burst when the returning acknowledgement packets are

received and it also stated that the flow clocking is also a key factor related to the burstiness. [9]

Previously it was thought that RTT actually determines the flow clocks however their findings

indicate that non-RTT factors also effect flow clocks.

Their methodology is dependent on the signal processing and there is an extensive usage of the

mathematical tools provided by signal processing. They consider the packets as a signal in time

domain and apply these tools for their analysis. They converted the signal into frequency domain. In

their methodology, they are only interested in peaks. Peak refers to a frequency with highest

amplitude. To understand if a frequency is a fundamental frequency, it must lie in a certain interval.7

The refined flow clock is calculated as the average time difference between the beginning of

consecutive flights after removing the values that are far away from the mean value. [2]

They compared their results with flows whose flow clock origins are known. They state that by

measuring RTT and through the examination of the frequency spectrum and packet sequence diagram,

it is easy to determine the dominating flow clock and its origin. [2]

Table 5 Validation of flow clock algorithm

This algorithm also delivered very accurate results. From the error ratios it can be inferred very easily.

However they also state that many flows do not possess distinguishable flow clocks. Their validation

criteria depends on the human observation. If there is a difference less than 10% between the human

judgment and the algorithm output on choosing the local maxima, they accepted this result as valid.

[2]

They state the results of their analysis after applying this algorithm on the long lived flows as follows;

(i) more than half of our flows do not have distinguishable flow clocks(as it can be clearly seen on

Table 6) ; (ii) a significant number of flows have non-RTT based flow clock around 100ms; (iii) flows

7 Refer to 4.3 for more details about their flow clock extraction algorithm


11/12

11

with large non-RTT based flow clock tend to have more consistent flight size; (iv) flows with non-

RTT based clocks are more likely to transfer data with an inappropriately large congestion window

[2].

Table 6Existence of flow clocks

When examining flows with distinguishable flow clocks, they came up with another interesting fact.

Most of the RTT based and non RTT based flow clocks belong to flows from multimedia streamingservers. [2] They also relate the non-RTT based flow clock to the link layer, because if the flow

limiting rate is the bottleneck link, then there will be an equal space between packets. [2]

The last result is very important for the flow characteristics analysis. Because since flows with non

RTT based clocks have unacceptable large congestion window size, they are more likely to cause

burstiness. However in contrary to flows mentioned in [7], whose flow rates do not increase its

sending rate and under utilize the link, flows with non-RTT based clocks seem to have a better

utilization of the link. Another important issue about flows with non-RTT based clocks is that

they keep the sending rate constant and avoid slow start. In other words they do not gradually send the

packets but send them together as many as possible with one transmission flight.

5 Conclusion

The study is a re-examination of TCP characteristics and behavior on the actual Internet. Despite the

enormous changes in Internet and in the user habits, this study fills an important gap by asking the

question if it is swerved from the basic TCP principles. Because unusual behavior of flows might

require different handling of problems and a different insight into networking problems. However they

see that only a very small percentage of flows show irregular and non-conformant behavior. They also

tried to bring an explanation to the probable causes of these non-routines. It can be inferred that it

provides a conformance check.

In this study, the correlations of flow characteristics, the congestion window size and transmission rate

of flows have been extensively studied. Their results & findings overlap with those of [3], [7].

However this study is unique in the sense that it is the one the first studies that addressed the origins of

the flow clocks. From this point of view, it departs itself from many flow characteristics studies in this

field.

This work explains the correlation of non-RTT based flow clocks with the actual user habits. They

indicate that multimedia-streaming and gaming applications have flows with non-RTT based clocks.

[2] They point out the interaction of other layers with transport layer.


12/12

12

Finally it can be said that this study enables us to see the big picture in todays Internet . From this

point of view it can be considered as a milestone towards optimizing todays and planning futures

Internet.

References

[1] K. Thompson, G. J. Miller, and R. Wilder. Wide-area Internet Traffic Patterns and Characteristics.

In IEEE Network Magazine, 1997

[2] F. Qian, A. Gerber, Z. M. Mao, S. Sen, O. Spatscheck, W. Willinger. TCP revisited: a fresh look at

TCP in the wild. In Proc. of ACM SIGCOMM, 2009.

[3] K. chan Lan and J. Heidemann. Measurement Study of Correlations of Internet Flow

Characteristics. Computer Networks, 50, 2006.

[4] S. Jaiswal, G. Iannaccone, C. Diot, J. Kurose, and D. Towsley. Inferring TCP Connection

Characteristics through Passive Measurements. In Proc. of IEEE INFOCOM, 2004.

[5] H. Jiang and C. Dovrolis. Passive Estimation of TCP RoundTrip Times. In ACM Computer

Communication Review, 2002.

[6] J. Padhye and S. Floyd. Identifying the TCP Behavior of Web Servers. In Proc. of ACM

SIGCOMM, 2001.

[7] Y. Zhang, L. Breslau, V. Paxson, and S. Shenker. On the Characteristics and Origins of Internet

Flow Rates. In Proc. of ACM SIGCOMM, 2002.

[8] M. Allman, S. Floyd, and C. Partridge. Increasing TCPs Initial Window. RFC 3390, 2002.

[9] K.Chen, P. Huang, C.Y Huang, C.L. Lei. The Impact of Network Variabilities on TCP Clocking

Schemes. In IEEE INFOCOM 2005.
http://portal.acm.org/citation.cfm?id=1644893.1644903&coll=DL&dl=GUIDE&CFID=28900474&CFTOKEN=14404564http://portal.acm.org/citation.cfm?id=1644893.1644903&coll=DL&dl=GUIDE&CFID=28900474&CFTOKEN=14404564http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?punumber=9990http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?punumber=9990http://portal.acm.org/citation.cfm?id=1644893.1644903&coll=DL&dl=GUIDE&CFID=28900474&CFTOKEN=14404564http://portal.acm.org/citation.cfm?id=1644893.1644903&coll=DL&dl=GUIDE&CFID=28900474&CFTOKEN=14404564

Final Version - Cagdas Dönmez

Documents

Transcript of Final Version - Cagdas Dönmez