------ =_NextPart_000_01BE080E.C42C49D6
Content-Type: text/plain
Here's an almost indecipherable graph which is a little bit interesting.
It classifies packets into different size categories and then graphs the
frequency at which packet trains of that particular length occur.
There are a couple of interesting things to note. First, the sharp
downward slope of the 0-40 byte class after run length 2-3. This might
suggest that ACK compression is somewhat limited (bursts of 2-4) which
in turn would limit outgoing bursts. However, there's not enough data
to back this up... Since this trace is from the OC3mon at FIX-West its
still possible (likely even) that there is congestion further along the
path to the sender (ie a busy web server) that would lead to greater ack
compression.
Another interesting feature is the purple bar which represents runs of
packets of different lengths. Roughly speaking I'd guess this
correlates with the amount of traffic "mixing" (not counting
discontinuities in packet startup and teardown). Its less bad than I
would have guessed. However, its important to note that this data is
about sequential order, not time....
Anyway, not enough data to make any conclusions... but enough to ask
some questions.
- Stefan
<<run length of packet length sequences.htm>>
------ =_NextPart_000_01BE080E.C42C49D6
Content-Type: application/octet-stream;
name="run length of packet length sequences.htm"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="run length of packet length sequences.htm"
<BASE HREF=3D"http://moat.nlanr.net/PLRL/">=0A=
<title>run length of packet length sequences</title>=0A=
<img src=3D/Images/moat2-logo-trans.gif>=0A=
=0A=
<center><h3>run length of packet length sequences</h3></center>=0A=
=0A=
<p>This study is undertaking an analysis of the behavior of sequences =
of=0A=
packets as specific packet sizes. The example is using an OC3mon =
trace=0A=
from the FIX-West network interconnection point.=0A=
=0A=
<h3>Runlengths of all packet sizes</h3>=0A=
=0A=
<p>To investigate the subject behavior for all packet sizes the <a=0A=
href=3DBin/oc32plenrunlength.pl>oc32plenrunlength.pl</a> conversion =
program=0A=
can be used. A <a href=3DFIXW-9711.dmp.oc32plenrunlength>sample =
output</a>=0A=
is included.=0A=
=0A=
<h3>Runlengths of clustered packet sizes </h3>=0A=
=0A=
<p>Eventually looking at all packet sizes becomes a bit unwieldy, as=0A=
exemplified in the previous example, and, unless information for =
very=0A=
specific packet sizes is sought, it may make more sense to cluster=0A=
ranges of sizes into size clusters. For this example we use a class=0A=
notion for thise ranges, starting at a 40 byte maximum and =
essentially=0A=
doubling for subsequent classes:=0A=
=0A=
<pre>=0A=
Class Range in bytes=0A=
=3D=3D=3D=3D=3D=3D=3D =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
0 0-40=0A=
1 41-80=0A=
2 81-160=0A=
3 161-320=0A=
4 321-640=0A=
5 641-1500=0A=
6 1500+=0A=
</pre>=0A=
=0A=
<p>The <a href=3DBin/oc32plenrunlengthc.pl>oc32plenrunlengthc.pl</a>=0A=
conversion program does such a conversion from a raw OC3mon dump,=0A=
and is a <a href=3DFIXW-9711.dmp.oc32plenrunlengthc>sample =
output</a>=0A=
for this application.=0A=
=0A=
<p>A graph of this data includes histograms of the classes 0 to 5=0A=
mentioned above, plus the run length of not having any class run=0A=
length. Class 6 did not appear in the trace.=0A=
=0A=
<p>=0A=
<center>=0A=
<a href=3Dplrl-c.big.gif><img src=3Dplrl-c.gif></a>=0A=
</center>=0A=
=0A=
<p><a href=3DBin/oc32plenrunlengthc2.pl>oc32plenrunlengthc2.pl</a>=0A=
is a similar program, but creates a <a=0A=
href=3DFIXW-9711.dmp.oc32plenrunlengthc2>matrix output</a> instead,=0A=
which can then be used in a spreadsheet iprogram, or converted to a =
<a=0A=
href=3DFIXW-9711.dmp.oc32plenrunlengthc2.wrl>VRML object</a> with the =
<a=0A=
href=3DBin/vsurf.pl>vsurf.pl</a> converter.=0A=
=0A=
<hr>=0A=
------ =_NextPart_000_01BE080E.C42C49D6--