**2. Network traffic**

### **2.1 Packet network traffic measuring**

The measuring and analyzing of real network traffic provide us with a very important knowledge about computer network states. In analyzing process, we need statistical mathematical tools. These tools are crucial for accuracy of a derived mathematical model, described by stochastic parameters for packet size and inter-arrival time [9]. Using this simulation model, we want to acquire information about telecommunication network's performances for:


During past years another aspect of network traffic studying has also appeared. In this case, the network traffic is researched from application or data source point of view, especially focused on statistics of file sizes and inter-arrival times between files [19]. These research works are very important for describing a relation between packet network traffic on lower ISO/OSI layers and data source network traffic on higher layers of ISO/OSI model. Based on the research of WWW network traffic, it has been shown that file sizes of such traffic are best described by Pareto distribution with shape parameter *α* = 1 [38]. That was also shown for the FTP traffic, where the shape parameter of Pareto distribution is in the range 0.9 < *α* < 1.1 [20]. In [6], [39], and [40] it is shown that inter-arrival time of TCP connections are self-

With expansion of simulation tools, which are used for simulation of communication networks, the knowledge about simulating the network traffic also becomes very important. One of the important tasks in simulations is also knowledge about modeling and simulating of network traffic. Network traffic is usually modeled in simulation tools from an application point of view [42], [45]. It is usually supposed that the file size statistics and file inter-arrival times are known [39], [40]. Such kinds of traffic models are supported by most commercial telecommunication simulation tools such as the OPNET Modeler [10], [11], [24], used in our simulations and experiments. Consequently, for using the measured data of packet traffic, when modeling file statistics, it is necessary to transform packets' statistics into files' statistics [9, 10]. This transformation contains opposite operations in relation to the fragmentation and encapsulation process. Extensive research and investigation about traffic sources in contemporary networks show that this approach requires an in-depth analysis of packet's traffic (which needs specialized, very powerful and consequently, expensive instruments). This approach, in the case of encrypted packets and non-standard application protocols, is not completely possible. In such cases, capture of entire packets is also necessary, which can be problematic in contemporary high-speed networks. Another approach estimates distribution parameters of file data sources from measured packets' network traffic. For such approach, we have developed and tested different methods [42], [45]. Estimated distribution parameters are used for modeling of the measured network traffic for simulation purposes. Through the use of these methods we want to minimize discrepancies between the measured and simulated traffic in regards to an average bit rate

The measuring and analyzing of real network traffic provide us with a very important knowledge about computer network states. In analyzing process, we need statistical mathematical tools. These tools are crucial for accuracy of a derived mathematical model, described by stochastic parameters for packet size and inter-arrival time [9]. Using this simulation model, we want to acquire information about telecommunication network's

similar processes, which can be described by Weibull heavily tailed distribution.

and bursts, which are characteristic of self-similar traffic.

• building and development of new network devices and protocols,

**2. Network traffic** 

performances for:

• bottleneck searching,

**2.1 Packet network traffic measuring** 

• improvement of the current network,

• and for ensuring quality of service (QoS) for real-time streaming multimedia applications.

Using this information, network administrators can make the network more efficient.

The simplest tools that measure and capture the packets of network traffic are packet sniffers. Packet sniffers, also known as protocol or network analyzers, are tools that monitor and capture network traffic with all content of network traffic. We can use sniffers to obtain the main information about network traffic, such as packet size, inter-arrival time and the type and structure of IP protocol. Sniffers have become very important and indispensable tools for network administrators. Figure 1 shows traffic captured by a packet sniffer.


Fig. 1. User interface of WireShark sniffer during the network capturing.

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 355

Fig. 2. Comparison of self-similar network traffic (left) and synthetic traffic created by Poisson model (right) on different time scales (100, 10, 1, 0.1 and 0.01s). Self similar traffic contains bursts on all time scales in contrast to the generated synthetic traffic, based on the

bursts can be described by a self-similarity model, because it shows bursts over a widerange of time scales [1]-[4]. This contrasts the traditional traffic model (Poisson model),

The definition of self-similarity is usually based on fractals for the standard stationary time

Let *X* = (*Xt*, *t* = 0, 1, 2,…) be a covariance stationary stochastic process; that is a process with a constant mean, finite variance *σ2* = *E*[(*Xt* – *µ*)2], with auto-covariance function *γ*(*k*) = *E*[(*Xt* –

[ ]

− − <sup>+</sup> = = <sup>=</sup> <sup>−</sup>

μ

<sup>012</sup> ( ) ( )( ) ( ) , ,, , ( ) *t tk t <sup>k</sup> EX X r k <sup>k</sup> E X*

μ

<sup>1</sup> *rk k L k k* ( ) ( ), , , 0 1

 μ

*L tx L t* →∞

β<sup>−</sup> <sup>≈</sup> →∞ < < (2)

(1)

= for all x > 0. Such functions

*µ*)(*Xt*+*k* – *µ*)], that depends only on *k*. Then the autocorrelation function *r*(*k*) is:

2 2

Assume *X* has an autocorrelation function, which is asymptotically equal to:

β

Poisson model, which tends to average on longer time [1].

which becomes very smooth during the aggregation process.

γ

> σ

where *L*1(*k*) slowly varies at infinity, that is 1 1 lim( ( ) / ( )) <sup>1</sup> *<sup>t</sup>*

are for example *L*1(*t*) = *const.* and *L*1(*t*) = log(*t*)) [5], [6].

**2.3 Self-similarity** 

series [5], [6], [21].

Any sniffers are able to extract this data from the IP headers. Knowing them, it is then simple to calculate a length of IP PDU (Protocol Data Unit), which also contains a header of higher layer protocols. Using an in-depth header analysis, it is possible, in the similar way to the IP header, to calculate the lengths of all these headers.

An analytical description of network traffic does not exist, because we cannot predict the size and arrival time of the next packet. Therefore, we can only describe network traffic as a stochastic process. Hence, we have tried to describe these two stochastic processes (arrival time and packet size) with the use of Hurst parameter and probability distributions.
