**6. Simulation results**

366 Telecommunications Networks – Current Status and Future Trends

network traffic Z*d*[*n*] is needed (section 2.6) [45]. There are many possibilities to make a transformation from Z*p*[*n*] to Z*d*[*n*], which allows estimation of parameters of data source

The main differences between them are complexity and the needed execution time. The first algorithm mimics a complete decapsulation process, and defragmentation in higher layers of the communication model. Any sniffers are able to extract this data from the IP header. Knowing them, it is then simple to calculate a length of IP PDU (Protocol Data Unit) which also contains a header of higher layer protocols. Through the use of an in-depth header analysis, it is possible, in the similar way as the IP header, to calculate the lengths of all these headers. Each packed IP header has four the so-called fragmentation fields that contain

network traffic processes. We investigated two algorithms [28]: 1. algorithm with an in-depth analysis of all packet headers, 2. algorithm with a coarse inspection of IP header only.

information about data fragmentation, which is shown on Figure 9.

Fig. 9. IP header. Shadowed fields are used in the defragmentation process. Legend: V: protocol version; IHL: Internet Header Length; ToS: Type of Service; TL: Total Length;

Extensive research and investigation about traffic sources in contemporary networks show that this approach requires an in-depth analysis of packets (where need specialized, very powerful and consequently, expensive instruments), which in case of encrypted packets and non-standard application protocols, is not completely possible. In such cases, it is also necessary to capture the entire packets, which can be problematic in the high-speed networks. For these reasons, a simple algorithm has been developed, where only

The second algorithm skips decapsulation by considering the average lengths of packet headers and then uses only packet lengths and inter-arrival times. In the second case, the algorithm offers the estimation of data source network traffic, not the exact reconstructed data source traffic. The second algorithm represents the main part of method by mimic defragmentation process, which is described in detail in [45]. The main idea of mimic defragmentation process method is to compose data from the captured packet traffic, which is previously fragmented at the transmitter. The data source traffic estimation is

ID: Identification Data; F: Flags; FO: Fragment Offset; TTL: Time to Live.

information of packets sizes, packet time stamps and IP addresses are needed.

In real networks, we have captured packets of different network traffic through a Wireshark sniffer. The two different types of measured traffic are used for analysis, modeling and simulation purposes. These two test traffics are shown in Figure 10.

Fig. 10. Measured test traffic 1 and 2 captured by Wireshark sniffer.


Table 1. The main properties of captured traffics. On the right side of the table the Hurst parameter is estimated using different methods for both test traffics.

For each of test traffics, the Hurst parameter has been estimated through different methods. The Hurst parameters for both cases are bigger than 0.5, so we can classify these test traffics

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 369

Fig. 11. Modeling measured test traffic 1 in OPNET simulation tool with six different estimated parameters from Table 2 (scenario 1 and 2 with RPG station, scenario 3, 4, 5, 6

with IP station).

as a self-similar network traffic. Table 1 contains the estimated parameters *H* for both traffics, which are estimated by variance, R/S and periodogram methods. We also conducted tests about short and long-range dependence. In the case of the first test traffic, the autocorrelation function decayed hyperbolically, which means, that this traffic can have the property of a long-range dependence. For the second test traffic autocorrelation, function decayed exponentially towards 0. For this case, the sum of autocorrelations has finite results and, therefore, the test traffic 2 has the property of short-range dependence.

For both test traffics (test traffic 1 and test traffic 2) we estimate distribution and its parameters for data source traffic processes for simulation purpose. For that reason, we made an estimation of data source traffic from the captured packet traffic through the mimic defragmentation process method [45]. For both test traffics, the suitably heavy (Pareto or Weibull) and also light-tailed (exponential) distributions are chosen.

Based on the estimated distribution parameters for both measured test traffic (test traffic 1 and test traffic 2), we generated self-similar traffic in the OPNET simulation tool with two different station types – RPG and IP stations. We have created six different scenarios for each of test traffic. In the first two scenarios, the network traffic is generated by an RPG station, where a self-similarity is described by Hurst parameter. During the first scenario, we use heavy-tailed distribution for the data size process, while in the second a light-tailed distribution (exponential) is used. In the next four scenarios, network traffic is generated using the IP station, where we use different combination's distributions for the data size process and data inter-arrival time. One of the criterions, for successful modeling, is the difference between bit and packet-rates of the test traffic and modeled traffic in OPNET simulation tool. Besides the average values of bit and packet-rates, the more important criteria are also bursts' intensity within the network traffic. For each of test traffics (test traffic 1 and test traffic 2), the traffic which best represents the measured test traffic is chosen from six modeled traffics.

**Test traffic 1** poses the property of long-range dependence, so there are a lot of bursts in the traffic. We model this measured-test traffic over six different scenarios. The results are shown in Figure 6 and Table 2. Table 2 shows the main properties of measured test traffic 1 and estimated distribution parameters which were used in OPNET simulation tool for simulating network traffic (the left side of Table 2). Table 2 (the right side) also shows main properties of simulated network traffics (six different scenarios) in OPNET simulation tool based on estimated distributions.

Table 2 shows modeling results for test traffic 1 over six different scenarios in OPNET simulation tool. There are estimated statistical parameters such as Hurst parameters and distributions used in models and simulation results using these models. Figure 11 shows all six modeled traffic traffics generated by OPNET, with estimated distributions and parameters from Table 2.

The best approximation for test traffic 1 is modeled traffic 5 from Table 2, which is described by Pareto distribution for data size process and Weibull distribution for data inter-arrival time. Figure 12 shows a comparison between the second test traffic and the modeled traffic 5 for bit rates. From all critera after comparison, we can say that the modeled traffic 5 is a good approximation of measured test traffic 1.

as a self-similar network traffic. Table 1 contains the estimated parameters *H* for both traffics, which are estimated by variance, R/S and periodogram methods. We also conducted tests about short and long-range dependence. In the case of the first test traffic, the autocorrelation function decayed hyperbolically, which means, that this traffic can have the property of a long-range dependence. For the second test traffic autocorrelation, function decayed exponentially towards 0. For this case, the sum of autocorrelations has finite results and, therefore, the test traffic 2 has the property of short-range dependence.

For both test traffics (test traffic 1 and test traffic 2) we estimate distribution and its parameters for data source traffic processes for simulation purpose. For that reason, we made an estimation of data source traffic from the captured packet traffic through the mimic defragmentation process method [45]. For both test traffics, the suitably heavy (Pareto or

Based on the estimated distribution parameters for both measured test traffic (test traffic 1 and test traffic 2), we generated self-similar traffic in the OPNET simulation tool with two different station types – RPG and IP stations. We have created six different scenarios for each of test traffic. In the first two scenarios, the network traffic is generated by an RPG station, where a self-similarity is described by Hurst parameter. During the first scenario, we use heavy-tailed distribution for the data size process, while in the second a light-tailed distribution (exponential) is used. In the next four scenarios, network traffic is generated using the IP station, where we use different combination's distributions for the data size process and data inter-arrival time. One of the criterions, for successful modeling, is the difference between bit and packet-rates of the test traffic and modeled traffic in OPNET simulation tool. Besides the average values of bit and packet-rates, the more important criteria are also bursts' intensity within the network traffic. For each of test traffics (test traffic 1 and test traffic 2), the traffic which best represents the measured test traffic is chosen

**Test traffic 1** poses the property of long-range dependence, so there are a lot of bursts in the traffic. We model this measured-test traffic over six different scenarios. The results are shown in Figure 6 and Table 2. Table 2 shows the main properties of measured test traffic 1 and estimated distribution parameters which were used in OPNET simulation tool for simulating network traffic (the left side of Table 2). Table 2 (the right side) also shows main properties of simulated network traffics (six different scenarios) in OPNET simulation tool

Table 2 shows modeling results for test traffic 1 over six different scenarios in OPNET simulation tool. There are estimated statistical parameters such as Hurst parameters and distributions used in models and simulation results using these models. Figure 11 shows all six modeled traffic traffics generated by OPNET, with estimated distributions and

The best approximation for test traffic 1 is modeled traffic 5 from Table 2, which is described by Pareto distribution for data size process and Weibull distribution for data inter-arrival time. Figure 12 shows a comparison between the second test traffic and the modeled traffic 5 for bit rates. From all critera after comparison, we can say that the modeled traffic 5 is a

Weibull) and also light-tailed (exponential) distributions are chosen.

from six modeled traffics.

based on estimated distributions.

good approximation of measured test traffic 1.

parameters from Table 2.

Fig. 11. Modeling measured test traffic 1 in OPNET simulation tool with six different estimated parameters from Table 2 (scenario 1 and 2 with RPG station, scenario 3, 4, 5, 6 with IP station).

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 371

**Test traffic 2** is also modeled over six different scenarios, just like in the first case. Table 3 shows the main properties of measured test traffic 2 and estimated distribution parameters which were used in OPNET simulation tool for simulating network traffic (left side of Table 3). Table 3 (right side) also shows main properties of simulated network traffics (six different

As the best modeled traffic of test traffic 2 from all six cases (Table 3), we choose the case where simulated traffic is described by the exponential distribution for packet sizes and Weibull heavy-tailed distribution for inter-arrival time (modeled traffic 4). The bit-rate of this traffic is 33.27 (p/s) and packet-rate is 126.79 (kb/s), which are very close to the measured values. The Hurst parameter of the simulated traffic is 0.58, which is also close to the estimated values of the measured traffic. Figure 13 shows the comparison between the measured test traffic 2 and the best-modeled traffic (modeled traffic 4) for bit rates. From all critera after comparison, we can say that the simulated traffic is a good approximation of the

parameters for modeling parameters of measured and

packet rate (p/s)

*<sup>λ</sup>* = 3619 36.66 140.72 0.58

*<sup>λ</sup>* = 452.48 35.66 135.89 0.53

*<sup>λ</sup>* = 452.48 33.27 126.79 0.58

data size process

traffic 2 X X 35.61 114.51 0.55

Pareto *α* = 0.8373 *β* = 272

exponential

exponential

Pareto *α* = 0.8373 *β* = 34

Pareto *α* = 0.8373 *β* = 34

Table 3. The left side of table shows the estimated distributions and parameters for measured test traffic 2 (six different distribution combinations). The right side of table shows main properties of modeled network traffic in OPNET simulation tool (six scenarios),

modeled traffic in OPNET

bite rate

49.46 231.98 0.62

52.27 298.25 0.62

55.12 315.61 0.53

(kb/s) *<sup>H</sup>*

scenarios) in OPNET simulation tool.

traffic data inter-arrival

<sup>1</sup>*H* = 0.55

process

2 *H* = 0.55 exponential

exponential *λ* = 0.029

Weibull *α* = 0.57 *β* = 0.01894

Weibull *α* = 0.57 *β* = 0.01894

exponential *λ* = 0.029

where estimated distributions and its parameters were used.

measured traffic 2.

measured test

modeled

modeled

modeled 3

modeled 4

modeled 5

modeled 6


Table 2. The left side of table shows the estimated distributions and parameters for measured test traffic 1 (six different distribution combinations). The right side of table shows main properties of modeled network traffic in OPNET simulation tool (six scenarios), where estimated distributions were used.

Fig. 12. Comparison between the modeled traffic 5 generated in OPNET simulation tool and the measured test traffic 1 in bits per second (kb/s).

data size process

traffic 1 X X 24 108.90 0.73

Pareto *α* = 0.9835 *β* = 432

exponential

exponential

Pareto *α* = 0.9835 *β* = 34

Pareto *α* = 0.9835 *β* = 34

Fig. 12. Comparison between the modeled traffic 5 generated in OPNET simulation tool and

Table 2. The left side of table shows the estimated distributions and parameters for measured test traffic 1 (six different distribution combinations). The right side of table shows main properties of modeled network traffic in OPNET simulation tool (six scenarios),

traffic data inter-arrival

<sup>1</sup>*H* = 0.732

measured test

modeled

modeled

modeled 3

modeled 4

modeled 5

modeled 6

process

2 *H* = 0.732 exponential

exponential *λ* = 0.0458

Weibull *α* = 0.304 *β* = 0.00578

Weibull *α* = 0.304 *β* = 0.00578

exponential *λ* = 0.0458

where estimated distributions were used.

the measured test traffic 1 in bits per second (kb/s).

parameters for modeling parameters of measured and

packet rate (p/s)

*<sup>λ</sup>* = 7547.2 29.18 181.44 0.59

*<sup>λ</sup>* = 933.4 27.56 168.94 0.51

*<sup>λ</sup>* = 933.4 25.14 153.71 0.62

modeled traffic in OPNET

bite rate

33.82 128.75 0.59

25.32 88.70 0.66

26.63 81.30 0.55

(kb/s) *<sup>H</sup>*

**Test traffic 2** is also modeled over six different scenarios, just like in the first case. Table 3 shows the main properties of measured test traffic 2 and estimated distribution parameters which were used in OPNET simulation tool for simulating network traffic (left side of Table 3). Table 3 (right side) also shows main properties of simulated network traffics (six different scenarios) in OPNET simulation tool.

As the best modeled traffic of test traffic 2 from all six cases (Table 3), we choose the case where simulated traffic is described by the exponential distribution for packet sizes and Weibull heavy-tailed distribution for inter-arrival time (modeled traffic 4). The bit-rate of this traffic is 33.27 (p/s) and packet-rate is 126.79 (kb/s), which are very close to the measured values. The Hurst parameter of the simulated traffic is 0.58, which is also close to the estimated values of the measured traffic. Figure 13 shows the comparison between the measured test traffic 2 and the best-modeled traffic (modeled traffic 4) for bit rates. From all critera after comparison, we can say that the simulated traffic is a good approximation of the measured traffic 2.


Table 3. The left side of table shows the estimated distributions and parameters for measured test traffic 2 (six different distribution combinations). The right side of table shows main properties of modeled network traffic in OPNET simulation tool (six scenarios), where estimated distributions and its parameters were used.

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 373

offer estimated parameters, used in simulations, where six traffics are simulated by different distributions for each of the measured test traffic. It can be seen from simulations that in the case of modeling self-similar traffic, short-range dependence is more appropriate for choosing exponential distribution to describe a packet-size process. The exponential distribution does not impact the extreme peaks in the modeled traffic. Pareto distribution is

Heavy-tailed distributions, especially Pareto, are suitable for modeling a packet-size process of the measured network traffic, which are self-similar and also have the property of a long-

There are discrepancies between the measured and the modeled traffics in the sense of packet-rate, bit-rate, bursts intensity, and variances. With a method which mimics defragmentation, a good approximation of the measured network traffic is obtained. We cannot claim that this is the optimal method for all situations, because there are some limitations, although it shows good results through simulation in OPNET Modeler. We have noticed that estimating the shape-parameter of Pareto is very delicate, because a small deviation in the parameter causes large discrepancies regarding the network traffic's

This work has been partly financed by the Slovenian Ministry of Defense as part of the target research program "Science for Peace and Security": M2-0140 - Modeling of Command and Control information systems, and partly by the Slovenian Ministry of Higher Education

[1] W. E. Leland, M. S. Taqqu, W. Willinger and D. V. Wilson, On the self-similar nature of

[2] W. Willinger and V. Paxson, Where mathematics meets the Internet, Notices of the

[3] K. Park, G. Kim and M. E. Crovella, On the Relationship Between File Sizes Transport

[4] M. E. Crovella and A. Bestavros, Self-Similarity in World Wide Web Traffic Evidence and Possible Causes, IEEE/ACM Transactions on Networking, 1997. [5] O. Sheluhin, S. Smolskiy and A. Osin, Self-Similar Processes in Telecommunications,

[6] K. Park and W. Willinger, Self-Similar Network Traffic and Performance Evaluation,

[7] T. Karagiannis, M. Molle and M. Faloutos, Understanding the limitations of estimation

[8] T. Karagiannis and M. Faloutos, Selfis: A tool for self-similarity and long range

methods for long-range dependence, University of California.

dependence analysis, University of California.

Ethernet traffic (Extended version), IEEE/ACM Transactions on Networking, Vol.2,

Protocols, and Self-Similar Network Traffic, International Conference on Network

average values, which is one of the important criteria for traffic modeling.

American Mathematical Society, 45(8): 961–970, 1998.

and Science, research program P2-0065 "Telematics".

Protocols, 171–180, Oct 1996.

John Wiley & Sons, 2007.

John Wiley & Sons, 2000.

unsuitable for this purpose.

**8. Acknowledgment** 

**9. References** 

pp.1-15, 1994.

range dependence (test traffic 1).

Fig. 13. Comparison between modeled traffic 4 generated in OPNET simulation tool and measured test traffic 2 in bits per second (kb/s).
