denition for mice and elephants [20]. Roughly speaking, mice correspond to short data transfers whereas elephants are generated by transfers of large amounts of data. The basic motivation for introducing mice and elephants is in that these two types of trac have dierent networking behaviors. Mice are suciently short so that they do not leave or leave slightly the TCP slow start period and are then not very sensitive to the level of congestion of the network. On the contrary elephants are expected to be more sensitive to network conditions since they are controlled by the TCP ow control loop. A common observation is that mice are in large number but oer a rather low amount of trac. On the contrary, elephants are in small number but represent a large percentage of the total load on a link. While this dichotomy was not totally clear up to a recent past (see for instance network measurements from the MCI backbone network [7]), the discrimination between mice and elephants becomes more and more evident with the emergence of peer-to-peer (p2p) applications, which give rise to a large amount of trac on a small number of TCP connections. This observation leads us to analyze ADSL trac on the basis of the mice/elephant dichotomy and to analyze each component separately. The use of this dichotomy is the main dierence with the analysis carried out by Olivier and Benameur [19], where global statistics of ows are described. The nal goal of this paper is to design a mathematical model for describing the bit rate on a transmission link of an IP backbone network and to identify its dierent components. While the presence of mice is not really critical for dimensioning purposes, information about mice and more generally on the structure of the bit rate process is however crucial when analyzing sampled ` data, for instance a la Netow, where one out of N packets is captured. In this case, mice appear as noise, which has to be ltered for inferring the global characteristics of the bit rate process. The organization of this paper is as follows: Basic denitions are given in Section II. Mouse trac is analyzed in Section III in the case of non p2p mice and in Section IV in the case of p2p mice. Elephant trac is described in Section V. A model for describing the total bit rate on a link is introduced in Section VI and further measurement results are presented in order to check the robustness of the model. Finally, some concluding remarks are presented in Section VII. Some technical results are proved in Appendices.

Problem formulation

Denitions and notation
Throughout this paper, we consider a 1 Gbps link between the France Telecom IP backbone network and several ADSL areas. Trac in direction to these dierent ADSL areas is multiplexed on this single link. In the following, we observe TCP trac only. Measurements were performed in December 2002 between 1:27 pm and 2:51pm, which corresponds to a moderate activity period. The bit rate process evaluated over time intervals with length = 100 ms roughly seems to be stable. This gives rise to a chronological series, which will be assumed to be wide sense stationary in the following. Results derived for this specic trac trace will be compared against more recent measurements carried out in November 2003. To analyze trac characteristics, we adopt, as mentioned in the Introduction, the mice and elephants dichotomy. As a convention, we adopt in this paper the following denition: a mouse is a data transfer comprising a number of packets less than or equal to L = 20; a mouse is terminated when no packets of the mouse have been observed for a time period of = 5 seconds. Other denitions for mice are possible; for instance in the paper by Zhang et al [25], a small data transfer contains at most 104 bytes. If the MTU is equal to 1500 bytes, 104 bytes roughly correspond to 8 packets. The value of 20 packets is chosen because if we assume that the maximum congestion window size is 8Kbytes and if there is an ACK for two segments received by the destination, then about 15 packets are necessary to hit the maximum congestion window size at the end of the slow start phase. The timer of 5 seconds may appear at rst glance very sharp. However, since we intend to describe the bit rate of mice, we have to consider the time period when the mouse is active (i.e.,

when some packets of the mouse are transmitted). Long mice are mostly due to FIN segments, which arrive quite a long time after the last data segment or single SYN segments, which eventually do not initiate any data transfer. This introduces some bias in the evaluation of the duration of mice. To avoid this phenomenon, we use the 5 second timer to remove segments, which are too far away from data segments. The counterpart of this method is that single packet mice articially appear. The ow size distribution is displayed in Figure 1(a). It turns out that the majority of ows comprise less than 1000 bytes and actually correspond, as shown in the following, to mice. Even though these ows are the most numerous, they contribute a very small proportion of the total amount of trac, as shown in Figure 1(b) representing the distribution of X n /Zn , where {Xn } is the amount of trac due to mice and {Zn } is the global bit rate process. Mice actually contribute about 6% of global trac but represent more than 97% of the total number of ows.
0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09
(a) Flow size in bytes (taille des ots en octets)
(b) PDF of Xn /Zn (PDF de Xn /Zn )
Figure 1: Flows on the backbone link (Flots sur le lien dorsal). Finally, more than 49% of trac is due to p2p applications (Kazaa, Morpheus, Edonkey, Gnutella, etc.), as shown in Table 1. The signicant proportion of p2p trac gives rise to remarkable phenomena, which are described in the next sections. Note that p2p trac is observed via port numbers. Since recent p2p protocols use dynamic port numbers, a large part of p2p trac cannot be directly observed. In spite of this limitation, we see that almost 50% of trac is due to p2p applications. The real gure is certainly closer to 80%. Applications http ftp nntp others total non p2p trac Edonkey Kazaa&Morpheus Napster Gnutella Total p2p trac percentage 14.6 2.1 1.9 31.8 50.4 37.5 7.8 3.8 0.5 49.6

non p2p

Table 1: Composition of ADSL trac per application (Composition du trac ADSL par application).

First observations

Figure 2 displays the distribution of the number of packets and bytes comprised in a mouse. It turns out that most of mice comprise less than 1000 bytes and as stated in the previous section, most of ows are indeed mice (see Figure 1(a)).

0.2 0.18 0.16 0.14 0.12 0.1 0.08 0.06 0.04 0.20 0.16 0.14 0.12 0.1 0.08 0.06 0.04 0.2000
(a) Number of packets (nombre de paquets)
(b) Number of bytes (in logarithmic scale) (nombre doctets en chelle logarithmique) e
Figure 2: Characteristics of a mouse (Caractristiques dune souris). e From Figure 2, we also observe that a large number of mice are composed only of one or two packets. Single packet mice are Reset segments, SYN segments, which are not really associated to a mouse because of transaction interruption or very long response times by servers, or FIN segments, which arrive far away from the last data segments and which appear as single packet mice because of the 5 second timer used to terminate a mouse. Moreover, a large number of single packet mice are generated by p2p protocols. Two packet mice are composed of SYN and FIN segments only. This is due to the fact that a large number of TCP connections (associated with HTTP transactions for instance) are opened and immediately closed or not used at all; this may be caused by too long response times by servers, which lead users to interrupt their transactions, or by the fact that certain implementations of HTTP systematically opens several TCP connections in parallel (for instance Version 1.0 of HTTP). Actually, only a small number of mice carry data segments. This phenomenon has to be taken into account when characterizing the mouse arrival process, as shown in the following. When analyzing more carefully the generation process of mice, it turns out that mice generated by p2p protocols exhibit a behavior which is quite dierent from that of other mice, referred to as regular mice and related to usual applications using TCP, such as HTTP, ftp, etc. Regular mice are mainly associated with HTTP transactions. On the contrary, p2p mice are signalling messages sent by users and servers, for instance in order to locate a content. Hence, p2p mice have a much more complicated behavior than regular mice. This is why we analyze the two types of mice separately. Note that since mice are not sensitive to TCP fairness, global mice trac is the superposition of p2p and non p2p mice trac; these two types of trac do not really interact one with other and can therefore be analyzed separately.

Regular mouse trac

In this section, we analyze mice, which are apparently not generated by p2p protocols, i.e., with port numbers dierent from 1214 (Kazaa), 4662 (Edonkey), 6346 (Gnutella) and other p2p protocol port numbers. Note that the observation of port numbers does not suce to be sure that some mice are not generated by p2p protocols. However, this seems to be sucient to capture the global behavior of regular mice; this is why we discriminate mice only on the basis of port numbers. 6
The objective of this section is to describe the bit rate process of regular mice and to propose a probabilistic model approximating this process.
Observation of the bit rate process
Let denote the number of bits due to non p2p mice in the time interval [n, (n + 1)) m divided by = 100 ms. The process {Xn } representing the instantaneous bit rate oered m by non p2p mice is highly varying as depicted in Figure 3(a); {X n } has been observed over a time period of 4900 seconds between 1:27 pm to 2:51 pm; only a time interval of 700 seconds is m displayed in Figure 3(a). The empirical distribution of X n is given in Figure 3(b), which shows m that this distribution is almost Gaussian. This is not sucient to show that the process {X n } is Gaussian but as it will turn out in the following, this process can actually be well approximated by a Gaussian process.
9e+06 8e+06 7e+06 6e+06 5e+06 4e+06 3e+06 2e+06 1e+0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1e+06 2e+06 3e+06 4e+06 5e+06 6e+06 7e+06 8e+06 9e+06 Empirical distribution Gaussian approximation

(a) Bit rate (dbit) e

(b) Stationary distribution (distribution stationnaire)
m Figure 3: Instantaneous bit rate and stationary distribution of the bit rate process {X n } estimated m over time intervals with length = 100 ms (Dbit instantan {X n } et distribution stationnaire e e du dbit valu sur des intervalles de temps de = 100ms) e e e m Explaining the form of the sample path of the process {X n } requires an in-depth description of non p2p mouse trac. This is done in the next sections.

Mice arrival process

In a rst step, we have observed arrivals of individual mice. The mouse inter-arrival time is remarkably exponential as shown in Figure 4, where the complementary distribution function (cdf) of the inter-arrival time and that of the duration of mice are displayed. The inter-arrival time can be approximated by an exponential random variable with mean 0.003578. The cdf of the mouse duration S can be well approximated by a Weibullian distribution with zero location parameter, scale parameter = 1.035 and skew parameter = 0.673034; the empirical mean mouse duration is equal to 1.39 s, which is very close to the theoretical value (1 + 1/) = 1.36, (x) denoting the Euler Gamma function. This means that P(S > x) exp x

At rst glance, one may conclude that mice arrive according to a Poisson process. However, when we compute the stationary distribution of the number of mice active at an arbitrary instant, we should obtain, under the assumption that mice do not interact one with the other, a Poisson 7
1 Empirical distribution Approximation

0.1 0.1 0.01 0.01 0.001

0.0.005 0.01 0.015 0.02 0.025 0.03 0.035

0.15 20

(a) Inter-arrival time (Inter-arrive) e

e (b) Duration (Dure)

Figure 4: Complementary distribution functions of the inter-arrival time and the duration of non p2p mice (Distribution complmentaire de linter-arrive et de la dure des souris non p2p). e e e distribution if the mouse arrival process were Poisson (namely, the stationary distribution of the number of customers in an M/G/ queue). In particular, the variance should be equal to the mean value. However, experimental data show that this last property is not veried. We specically have the mean and the variance equal to 372 and 566.12, respectively. This is sucient to show that the mouse arrival process is actually not Poisson. To overcome this problem, we note that, as mentioned in the previous section, mice are actually not independent. In reality, for a same destination IP address, a certain number of mice arrive near one to each other, forming what we call in the following a macro-mouse. We specically dene a macro-mouse as a set of non p2p mice, which have the same destination address and which arrive within a rather short time interval, say with a length of = 1 second; moreover, we impose that a macro-mouse comprises more than one packet. The inter-arrival time of macro-mice is displayed in Figure 5(b) and the distribution of their duration in Figure 5(a). Their inter-arrival time is exponential with mean 1/ m = 0.00562. The probability distribution of the duration of a macro-mouse can be well approximated by a two parameter Weibullian distribution with scale parameter m = 1.78 and skew parameter m = 0.8; the mean duration of a macro-mouse is E[S] = 2.136 seconds (the theoretical value is m (1 + 1/m ) = 2.01 s). Finally, the distribution of the number of mice in a macro-mouse is displayed in Figure 5(c); the mean value is equal to 2.27. When computing the stationary distribution of the number of macro-mice active at a given instant (stationary distribution at an arbitrary instant), we get a Poisson distribution (see Figure 6). Moreover, we have computed the distribution of the number of macro-mice active at the arrival time of a macro-mouse (distribution at arrival instants). It turns out that these two experimental distributions are almost indistinguishable. As a consequence, we have the celebrated ASTA (Arrival See Time Averages) property. In view of the classical ANTIPASTA results [5], it is then reasonable to conjecture that the macro-mouse arrival process is Poisson. Of course, the Poisson process veries ASTA; this is the well known PASTA (Poisson Arrival See Time Averages) property but ASTA alone is not sucient to prove that a process is Poisson. In Figure 6, the theoretical Poisson distribution with mean E[S] has been plotted to illustrate the coincidence of the dierent distributions. For the time being, we assume that the arrival process of macro-mice is Poisson. This conjecture will be veried in the following. Thus, in spite of the fact that the individual mouse arrival process is not Poisson, grouping mice in an adequate manner yields a Poisson process. We then proceed with the description of the bit rate process on the basis of macro-mice.

0.0.01 0.02 0.03 0.04 0.05 0.06

(a) Duration (Dure) e

(b) Inter-arrival time (Inter-arrive) e
0.5 0.45 0.4 0.35 0.3 0.25 0.2 0.15 0.1 0.16
(c) Number of mice in a macro-mouse (Nombre de souris dans une macrosouris)
Figure 5: Characteristics of a macro-mouse (Caractristiques dune macro-souris). e

Bit rate process of mice

When we consider the bit rate created by macro-mice, we can adopt a uid ow approach. More precisely, by neglecting discrete packet arrivals, we assume that the bit rate of a macro-mouse is constant and equal to the total number of bits divided by the duration of the macro-mouse. We then get the uid approximation of the bit rate of the macro-mouse. The key point is that since the mean arrival rate m 178 of macro-mice is large, the uid bit rate { m } of macro-mice, t dened by m = Yj (2) t
where At is the set of macro-mice active at time t and Yj is the uid bit rate of the jth macromouse, can be approximated in distribution by a Gaussian process, which auto-correlation function is perfectly known (see Appendix A for details). The uid bit rate over the nth time interval with length is dened by 1 (n+1) m n m = s ds. (3) n n Once we have computed the uid bit rate process { m }, we can reasonably assume that discrete packet arrivals give rise to a white noise since the number of packets is very large. Thus, the actual m bit rate process {Xn } of macro-mice should be equal to the uid bit rate process { m } perturbed n by a white noise. To validate this approach, we use a Kalman lter to eliminate the white noise altering the actual bit rate process. (See Appendix D for the use of the Kalman lter in the present context.) For this purpose, we compute the mean and the variance of the dierence of the actual bit m rate process {Xn } and the approximating process {m }. Experimental data give the mean and n 9
1 arbitrary instants arrival instants theoretical
Figure 6: Distribution of the number of active macro-mice at arbitrary and arrival instants (Distribution du nombre de macro-souris actives a un instant arbitraire et a un instant darrive). ` ` e the standard deviation equal to dm = 372 bit/s (negligible when compared with the mean bit rate equal to 4.4 Mbit/s) and m = 840 Kbit/s, respectively. On the basis of these experimental mean and standard deviation, the actual bit rate has been ltered by using a Kalman lter, to give the m m process {Xn }. The comparison between {Xn } and the process {n } is illustrated in Figure 7. n It appears that these two processes are very close one to each other and we may reasonably m approximate the actual bit rate process {Xn } as m n X n = m + m n , where {n } is a standard white noise.

6e+06 5.5e+06 5e+06 4.5e+06 4e+06 3.5e+06 3e+06 2.5e+Filtered bit rate Fluid approximation
m Figure 7: Filtered bit rate process {Xn } and uid approximation (Dbit ltr {Xn } et approxie e m mation uide). Let us now consider the uid bit rate process. Since the length of the integration interval in equation (3) is small, one may expect that m m. It follows that the auto-correlation n n m }, dened by function cm ( ) of the process {n c m ( ) = n cov[m m ) ] (n+ , m] var[
should be close to cm ( ), where cm (h) is the autocorrelation function of the process { m }, t given by (see Appendix A) 2 E[Ym (Sm h)+ ] cm (h) = , 2 E[Ym Sm ] where Ym and Sm denote the uid bit rate and the duration of a macro-mouse, respectively. 10
Of course, the bit rate of a macro-mouse depends upon its duration. However, it is experi2 mentally observed that E[Ym | Sm ] does not vary so much with respect to the duration S m ; see Appendix B for more details. In the following, to simplify the computations, we assume that 2 E[Ym | Sm ] is a constant equal to m = 1.5.109. As a consequence, we have cm (h) E[(Sm h)+ ] =1P E[Sm ] 1 , m h m
where we have taken into account the fact that the distribution of S m has the form given by equation (1) and P (a, x) is the incomplete Gamma function [1] dened by P (a, x) = 1 (a)

eu ua1 du.

Note that in the above expression, we explicitly assume that the macro-mouse arrival process is Poisson in order to compute the auto-correlation function c m. The function on the right hand side of the above equation is the auto-correlation function of the number of customers in an M/G/ queue with Weibullian service times. Finally, it remains a fraction of single packet mice, which are not included in macro-mice. The resulting bit rate is very small (a few tens of Kbps). The stationary distribution of this residual m bit rate process {Xn } is given in Figure 8(a) and can be very well approximated by a Gaussian distribution with mean dm = 3, 668 bit/s and standard deviation m = 606.8 bit/s. It can be m m checked by considering linear combinations of ( Xn+ 1 ,. , Xn+ k ) for arbitrary 1 ,. , k that the m process {Xn } is indeed Gaussian, with an autocorrelation function displayed in Figure 8(b). It m turns out that there are almost no correlations in the process { Xn }, which can then be represented m = dm + m n , where {n } is a standard white noise. as Xn

0 1800

Figure 12: Distribution of the number of active p2p macro-mice at arbitrary and arrival instants ` ` e distribution du nombre de macro-souris p2p actives a un instant arbitraire et a un instant darrive.
2.4e+06 2.35e+06 2.3e+06 2.25e+06 2.2e+06 2.15e+06 2.1e+06 2.05e+06 2e+06 1.95e+06 1.9e+1025 Filtered bit rate Fluid approximation
Figure 13: Comparison of the ltered bit rate process of p2p macro-mice and the associated uid bit rate - comparaison du dbit ltr des macro-souris p2p et du dbit uide associ. e e e e of the process { }, given by t c (h) =
2 E[Y (S h)+ ] , 2 E[Y S]
Y and S denoting the bit rate and the duration of a p2p macro-mouse, respectively. 2 As in the case of regular mice, it is experimentally observed that E[Y | S ] is not so much dependent upon S. Hence, we shall assume in the following that this function is a constant (equal to = 1.0e7). Hence, for computing the auto-correlation function of the process { }, t we assume that E[Y 2 | S = s] is a constant (equal to ). As a consequence, we have c (h) E[(S h)+ ] =1P E[S ] 1 , h
n the autocorrelation function of the process { } is approximated as c ( ) c ( ). To verify the above approximations and representation (6) for the bit rate process of p2p mice, we compute the experimental spectral density of the process {X n } and the theoretical density given by 2 + 2 + (x), 2 where (x) is the spectral density of the occupation process in an M/G/ queue with Weibullian service times.
As in the previous section we remove the white noise in the process {X n } by using a Kalman lter. We then plot the resulting empirical spectral density and we compare it with the theoretical density (x). Figure 14 shows that these two functions are close one to each other. This justies a posteriori the Poisson assumption for the arrival process of p2p macro-mice.
1e+10 Filtered bit rate Theoretical asymptotic approximation 1e+09
Figure 14: Spectral density of the ltered bit rate process and approximation by the function e e e (x) - densit spectrale du dbit ltr et approximation par la fonction (x).
Characteristics of elephants
In this section, we investigate the bit rate created by elephants. We proceed as in the previous sections via the identication of the spectral density associated with the chronological series describing the bit rate process.

Bit rate of mini-elephants
me me Let {Xn } denote the bit rate process created by mini-elephants, where X n is the number of bits due to mini-elephants over the interval (n, (n + 1)] divided by. As in the previous section, we compute in a rst step the uid bit rate associated with mini-elephants. This gives rise to the continuous time uid bit rate process {me }. Moreover, we compute the uid bit rate process t {me } over the time intervals (n, (n + 1)] for n = 0, 1, 2,. as in equation (3). n We then calculate the mean and the variance of the dierence between the uid bit rate process me {me } and the actual bit rate process {Xn }; these two quantities are equal to dme = 18 Kbit/s n and me = 3 Mbit/s, respectively. On the basis of these two values, we then use a Kalman lter to eliminate the white noise due to discrete packet arrivals and altering the actual bit rate process me me {Xn }; this gives rise to the ltered bit rate process { Xn }. The comparison between the ltered me me bit rate process {Xn } and the uid bit rate process {n } is illustrated in Figure 19. It turns out that these two processes are reasonably close one to each other (the maximum relative error is about 1%). Moreover, the distributions of the number of active mini-elephants seen at an arbitrary instant and that seen by an arriving mini-elephant are given in Figure 20. It turns that these two distri-
1.02e+08 1.015e+08 1.01e+08 1.005e+08 1e+08 9.95e+07 9.9e+07 9.85e+Filtered bit rate Fluid approximation
Figure 19: Fluid bit rate vs. ltered bit rate of mini-elephants - dbit uide versus dbit des e e lphants. ee

0 7000

Figure 20: Probability distribution function of the number of active mini-elephants at an arbitrary ee instant and that seen by an arriving mini-elephant - distributions du nombre de mini-lphants actifs a un instant arbitraire et a un instant darrive. ` ` e butions are very close one to each other and one may reasonably assumed that the mini-elephant arrival process is Poisson, with intensity me = 26.4 s1. Contrary to mice studied in the previous sections, mini-elephants, which are themselves included in elephants, are suciently large to be in congestion avoidance regime and one may then expect that mini-elephants share the bandwidth of the network according to the TCP control loop. But, we have to draw attention to the fact that the observed link carries a large number of elephants, which may be bottlenecked somewhere else in the network, in particular in the access network. Therefore, using an M/G/ model as in the previous section may not be so far from the reality. To check this assumption, we compute the spectral density of the bit rate process and we compare it with the theoretical one obtained by using an M/G/ model. By using the same technique as for mice and by observing that the conditional expectation 2 E[Yem | Sem ] weakly depends upon Sme (see Appendix B) and can be taken equal to a constant me , we have 2 X me (x) me + me Lme (x); (7) 2 where {Lme } is the process describing the number of active mini-elephants and where experimental t data show that me = 5.6e9. Furthermore, it turns out that the duration of mini-elephants can be well approximated by a two-parameter Weibullian distribution with the scale parameter me = 0.494 and skew parameter me = 122.94 seconds, as shown in Figure 21.

Figure 23: Spectral density of the ltered elephant mice bit rate process and the approximation em (x) - densit spectrale du dbit ltr des lphants souris et approximation em (x). e e e ee
Synthesis of the global bit rate and further considerations

Global bit rate

From the previous sections, we come up with the following representation for the bit rate process e {Xn } of elephants: e ack n n Xn = me + Xn + em + e n + de , (10) where
ack {Xn } is the bit rate process of ACK elephants, that we can assume in a rst approximation to be of the form dack + ack n , where {n } is a standard white noise, ack 83.66 kbit/s and dack = 1 Mbit/s,
{me } is the uid bit rate of mini-elephants, which can be considered as a Gaussian process n with mean 99.65 Mbit/s and spectral density me me (x) when x is suciently small, {em } is the uid bit rate associated with the uid bit rate of elephant mice, with mean n 963.6 Kbit/s and spectral density em em (x), {n } is a standard white noise and e =

em + me ,

de is a constant equal to dem + dme = 63 Kbit/s. More generally, when we consider the global bit rate {Z n }, we can approximate {Zn } as the superposition of a white noise and the process { n } describing the uid bit rate of minielephants, elephant mice, p2p macro-mice and non p2p macro-mice. Note that the uid bit rates of p2p macro-mice and non p2p macro-mice can be approximated by a Gaussian process. This approximation is not totally valid for mini-elephants and elephant mice since their arrival rate are not suciently large (a few tens units per seconds).We thus have Xn = n + n , (11)
where {n } is standard white noise, {n } is a Gaussian process with mean about 108 Mbit/s and with spectral density (x), with (x) = m m (x) + (x) + me me (x) + em em (x) and
= m + m + + + me + em + ack 1013. 2 2
We see that the magnitude of noise is huge and that the signal to noise ratio is very small. Nevertheless, by using adequate ltering techniques, we can remove noise and obtain the useful part of the signal. Moreover, it is worth noting that while mini-elephants oer the prevalent part of trac, no term in the sum on the r.h.s. of equation (12) is dominant. In particular, m m and me me are comparable; the spectral density of mini-elephant is only dominant near the origin (i.e., for low frequencies). Hence, when computing the global spectral density of the global bit rate {Z n }, adequate ltering should be performed in order to recover the relevant trac characteristics (for instance the arrival intensities of mice and elephants as well as the mean bit rate experienced by elephants). This point will be addressed in further studies.

(a) P2p macro-mice - macro-souris p2p
(b) Mini-elephants - mini-lphants ee
(c) Volume of mini-elephants - volume des mini-lphants ee
(d) Non p2p macro-mice - macro-souris non p2p
Figure 25: Square bit rate as a function of the ow duration - carr du dbit uide en fonction de e e la dure. e
The case of the non-p2p macro-mice given by Figure 25(d) requires further analysis. The higher variability observed in this case has been investigated and explained by the existence of both non p2p and p2p ows (using dynamic ports) in this class: further analysis shows a signicant dierence between the behaviour of http and non http (presumably mostly p2p) ows. Introducing a wellknown non p2p vs presumably dynamic p2p distinction among these ows might improve the modelling. Nevertheless, taking E[Y 2 | S] equal to a constant yields quite accurate results for spectral densities as shown in Figure 9.

Spectral density

Let be the spectral density of the process {Lt } describing the number of customers in an M/G/ queue in the stationary regime, where the intensity of the input Poisson process is denoted by and where service times are Weibullian with scale parameter and skew parameter. From the previous section, we know that the autocovariance function of the process {L t } is given for h R by 1 |h| cov(Lt , Lt+h ) = , , where (a, x) =
ua1 eu du. The spectral density is then dened as

eihx (x)dx =

Proposition 2 The spectral density (x) is given by 2 (x) = for (0, 1] and (x) = for > 1. Proof. Taking derivatives in the denition (16) of , we have
(1)n (n + 1) cos n n! (x)n+n=0 (1)n (x)2n (2n + 1)! n=0

2n + 2

ixeihx (x)dx = sgn(h)e(|h|/) ,
where sgn(h) is the sign of h. This entails that by Fourier inverse transform formula x(x) =

sin(hx)e(h/) dh.

Assume rst that > 1. By expanding sin(hx) in power series of x, we get x(x) = Since the series
(xh)2n+1 e(h/) dh = (x)2n+1 (2n + 1)! (2n + 1)! n=0
(1)n (xh)2n+1 e(h/) dh. (2n + 1)! n=0
is converging for > 1, we can exchange the sum and the integral in equation (20) and we obtain equation (18). When (0, 1], by expanding e(h/) in power series of h, we have x(x) = 2

Acknowledgement

This work has been partially supported by the RNRT project Metropolis.

References

[1] Abramowitz (M.), Stegun (I.) Handbook of mathematical functions. National Bureau of Standards, Applied Mathematics Series 55 (1972) [2] Abry (P.), Veitch (D.) Wavelet analysis of long range dependent trac. IEEE Trans. Information Theory, 44, no 2, pp. 215 (1998) [3] Ben Fredj (S.), Bonald (T.), Proutiere (A.), Regnie (G.), Roberts (J.) Statistical bandwidth sharing: A study of congestion at ow level, In IProc. ACM Sigcomm (2001) [4] Borovkov (A. A.) Limit laws for queueing processes in multichannel systems. Sibirsk. Mat. Z., 8, 9831004, (1967) [5] Bremaud (P.), Mazumdar (R.) Event and time averages: a review. Adv. Appl. Prob., 24, pp 377411, (1992) [6] Cao (J.), Ramanan (K.) A Poisson limit for buer overow probabilities. In Proc. Infocom 2002, New York. (2002). [7] Claffy (K.), Miller (G.), Thompson (K.) The nature of the beast: Recent trac measurement from an Internet backbone. In Proc. of Inet (1998) [8] Crovella (M.), Bestravos (A.) Self-similarity in world wide web. Evidence and possible causes. IEEE/ACM Trans. on Networking, pp. 835846 (1997) [9] Feldmann (A.), Gilbert (A.), Willinger (W.), Kurtz (T.) (1998). The changing nature of network trac: Scaling phenomena. Computer Communication Review, 28, pp (1998). [10] Fowler (H.), Leland (W.) Local area network trac characteristics, with implications for broadband network congestion management. IEEE J. Sel. Areas in Commun., 9, n o 7, pp 11391149 (1994). [11] Garrett (M.), Willinger (W.) Analysis, modeling and generation of sef-similar VBR videa trac. In Proc. Sigcomm, London, England (1994) [12] Hurst (H.) Long-term storage capacity of reservoirs. Trans. Amer. Soc. Civil. Eng., 116, pp. 770799 (1951).
[13] Iglehart (D. L.) Weak convergence of compound stochastic process. I. Stochastic Processes Appl., 1, pp 1131; corrigendum, ibid. 1, pp 185186 (1973). [14] Leland (W.), Taqqu (M.), Willinger (W.), Wilson (D.) On the self-similar nature of ethernet trac. IEEE/ACM Trans. Net., 2 , no 1, pp. 115 (1994). [15] Massoulie (L.), Simonian (A.) Large buer asymptotics for the queue with fbm input. Journal of Applied Probability, 36, no. 3, pp. 894-906 (1999). e [16] Neveu (J.) Processus ponctuels. In Ecole dEt de Probabilits de Saint-Flour, VI1976, e pp 249445. Lecture Notes in Math., Vol. 598. Berlin: Springer-Verlag (1977). [17] Norros (I.) A storage model with self-similar input. Queueing Systems, 16, pp. 387396 (1994). [18] Norros (I.) On the use of fractional Brownian motion in the theory of connectionless networks. IEEE J. Sel. Areas Commun., 13, no 6, pp. 953-962.(1995) [19] Olivier (P.), Benameur (N.) Flow level IP characterization. In Proc. ITC17, pp 25-26, Salvador de Bahia, Brasil (2001) [20] Papagiannaki (K.), Taft (N.), Bhattachayya (S.), Thiran (P.), Salamatian (K.), Diot C. On the feasibility of identifying elephants in Internet backbone trac. Rapport interne TR01-ATL-110918, Sprint Labs, Sprint ATL (2001) [21] Paxson (V.), Floyd (S.) Wide area trac: The failure of the Poisson assumption. IEEE/ACM Trans. on Networking, pp 226244 (1995) [22] Riedi (R.) On the multiplicative structure of network trac. In IMA Conference on Mathematics in Signal Processing, Warwick (2000) [23] Vehel (J. L.), Riedi (R.) Fractals in Engineering, chapitre Fractional Brownian motion and data trac modeling: The other end of the spectrum. Springer (1997). [24] Veitch (D.) Matlab code for the estimation of scaling exponents. Code disponible a ladresse ` http://www.emulab.ee.mu.oz.au/ darryl. [25] Zhang (Z.L.), Ribeiro (V.), Moon (S.), Diot (C). Small time scaling behavior of Internet backbone trac: An empirical study. In Proc. Infocom 2003 (April 2003)