Traffic Pattern Analysis

MAGNeT is a useful tool for investigating differences between traffic generated by an application and that same traffic but after modulation by the protocol stack, i.e., when the traffic hits the network. An example of this kind of modulation is shown in Figure 8. This figure is the MAGNeT trace of using FTP to send a Linux 2.2.18 bzipped tar file from our facilities in Los Alamos, NM to a location in Dallas, TX. As can be seen by examining the graph, the FTP application attempts to send 10KB segments of data every 1/5 of a second. However, the Linux protocol stack (TCP and IP in the case of FTP) modulates this traffic pattern into approximately 1500 byte packets at considerably shorter intervals.

It may be assumed that since the maximum data size on an Ethernet network is 1500 bytes, the protocol stack is simply modulating the data to this size to obtain valid Ethernet traffic. However, if the traffic stream as it was delivered to the network is sent through another TCP stack (this is exactly the case when using a tcpdump-derived traffic trace as input to a network simulation), we again see modulation. Every successive run of network-delivered traffic through TCP further modulates the traffic, as shown in Table 2. The table reflects the average data size of output TCP packets and the average time in seconds between output TCP packets, using the data stream from the previous TCP output as input. Likewise, Figure 9 shows the effect of successive TCP stacks on achieved bandwidth across the same WAN pathway used for the original FTP transfer.

Figure 8: MAGNeT FTP Trace

Table 2: Effect of Multiple TCP Stacks

Trial	Data Size	Interpacket Spacing
		(sec)
Application	3284	0.124
1st TCP stack	1016	0.045
2nd TCP stack	919	0.037
3rd TCP stack	761	0.079
4th TCP stack	723	0.122

As shown in Table 2, successive TCPs reduce the data size of each packet in an exponential fashion. In addition, the first TCP stack (that is, the TCP stack used by the application) radically reduces the inter-packet spacing, while each successive TCP stack (e.g., the TCP stacks of a network simulation) slowly increases the inter-packet delay. The ultimate effect is to drastically reduce the achieved bandwidth during actual transfers, as reflected in Figure 9. After just three TCP stacks, the achievable bandwidth has been reduced by 76%.

Figure 9: Effect of Multiple TCP Stacks