Abstract
We have investigated dynamics of the Internet performance through the assessment of scaling features of a network ICMP echo mechanism or pinging. Time series of round-trip times (RTT) from the host computer to 5 destination hosts and back, recorded during three consecutive days and nights, have been used. To assess correlation and scaling features of network echo mechanism, we used method of detrended fluctuation analysis (DFA) for RTT data sets. It was shown that for different, 10 minute long periods of day and night observations, RTT data sets mostly fluctuate within a narrow range, though sometimes we observe strong sharp spikes. RTT variations mostly reveal persistent behavior. DFA fluctuation curves often are characterized by crossovers indication stronger or lesser changes in the dynamics of network performance. Distribution function of DFA scaling exponents of considered RTT time series mostly was asymmetric with long tail on the right hand side. Dynamical changes occurring in the scaling features of Internet network as assessed by RTT fluctuations do not depend on the location of the host and destination nodes. Larger delays in round-trip time responses make the scaling behavior of the RTT series complicated and strongly influence their long range correlation features.
1. Introduction
According to available literature data, interest in questions related to the information transfer through the Internet network permanently increases (see, e.g., 1–11). Generally, is well known that the Internet forms the network where routers navigate packets of data from one computer to another. The testing of reachability of a host at the network level has been performed since the early days of the deployment of Internet because it was clear that the character of the process of packet delay may affect the quality of service. Further, the understanding of mechanisms of Internet packet delay may help to design an efficient congestion control mechanism as well as developing network behavior prediction algorithms enabling model property of complex delay processes. Consequently, comprehensive investigation of network behavior is presently regarded as question of decisive importance.
The standard facility which monitors performance in Internet network is ICMP echo mechanism based on Packet Internet Groper (PING) program. Hence, ICMP is often used since almost all hosts and routers respond to ICMP packets and this, so-called active measurement, method can be used for various network environments [1–7]. Generally active measurement means that probe packets are injected into the network from a probe host, and we observe the response of the network to these probe packets. As it is easy to use, has accurate results, and can be flexibly deployed anywhere in the network, active measurement became the primary method of network measurement. Alternatively, besides active one, passive measurement method; for example, TCP, can be used too [8, 9] but, since RTT measurements using TCP or ICMP are close enough, here we decided to be restricted by active measurement data series [9].
Measuring and monitoring of round-trip time, the significant network performance characteristic, is important for multiple reasons. RTT data quantify the speed at which IP packets travel across a specific path. Thus, increased RTT is the sign that less packets are allocated, and vice versa as the RTT decreases, more packets will be allocated. From the literature it is known that RTT, or latency, may vary in very wide range. Such essential quantitative changes, according to Jorgensen and colleagues [10], have potential to negatively affect the quality of network performance. On the other hand, it is clear that besides the quantitative changes in RTT values, qualitative changes are much more important which may occur in the dynamics of RTT variation. These changes may occur due to different causes and can seriously affect the process of packets distribution in Internet network [10, 11]. Knowledge of these dynamical features will help operators and end-users in better understanding of insights of underlying processes and allow protecting and optimizing their network performance [6, 12, 13].
Many studies on different aspects of Internet packet delay or RTT features, in diverse network environments, have been reported [see, e.g., 4–6, 9, 11]. Considerable part of these researches is devoted to the dynamics of RTT variation and often are focused on the problem of self-similarity, long range memory, and scaling behavior. Such interest to dynamics of processes in echo mechanism of such a complex system like Internet (with complicated cluster and hierarchical structures, spatiotemporal correlation with feedback, self-organization, and connection diversity) is quite understandable. Indeed, as we mentioned above, without knowledge of dynamical features of RTT variation (including its scaling characteristics), it will be impossible to solve or even correctly pose important questions related to the prediction of Internet packet delay and improving the network performance. Results of the mentioned researches convince that scaling features of network traffic greatly influences the character of network performance, its resilient and robustness to random errors, queuing time, breakdowns, attacks, and so forth [12, 14, 15].
All the abovementioned makes clear why for the last several years, one of the most interesting aspects of complex and interwoven Internet network researches become an investigation of their scaling features [see, e.g., 9, 11]. At the same time, in spite of the important advance achieved in the last years, it need be stated that we still lack knowledge of many aspects of the scaling behavior of packet delay especially in the sense of a quantitative characterization of the RTTfluctuations and their dynamical properties [14].
Based on the experience gained by many research groups up to day, in the present work we intended to continue the study of scaling features of RTT data sets based on original measurements at local host node at Georgian Technical University, Tbilisi, Georgia. In this research we decided to be based on the research scheme applied earlier by research group of Wang and colleagues [12]. They have carried out analysis for measurement node at Massachusetts Institute of Technology (MIT), Boston, and five destination nodes (e.g., MIT, Harvard University (HARVARD), Boston, University of California, Los Angeles (UCLA), University of Southern California (USC), Los Angeles, and University of Science and Technology of China (USTC), Hefei). In our case, we used the same remote node shaving, as mentioned, measurement node at Georgian Technical University, Tbilisi, Georgia (GTU). On the basis of these data sets we investigated dynamical features of internet performance assessing scaling characteristics of a RTT variation.
2. Materials and Methods
As it was pointed in previous section, based on the ICMP protocol we conducted active measurement by ping facility to measure RTT, a key performance metric for web applications [4–6]. Here it is necessary to underline that there are a diversity of causes for changes in RTT, or latency, such as insertion latency, the influence of physical distance of the path, the so-called queue latency, traffic level, and so forth [12, 16].
According to the aim of the present research, we collected RTT data of the five different Internet paths mentioned above having the measurement node always at GTU. These destination nodes, located in different distances from the measurement node, are located, respectively, at GTU (0.5 km), HARVARD (8672 km), UCLA (114010 km), USC (11411 km), and USTC (6354 km).
For every path, we measured RTT at two different working hours and two different nonworking hours, since the network load should usually be quite different during the two periods. The measurement interval was always 10 ms and each measurement included 50000 samples. The probe packet is 56 bytes. Finally, for the present research, we selected RTT data sets recorded during three consecutive days of observation.
Often for different analysis, purposes stationarity of Internet network is assumed [7]. In fact though, this practically never is the case, like it is for a diverse of time series generated by natural and physical processes [17–20]. This is why in our research after selection of necessary data sets, we proceeded to the scaling and long range correlation features analysis of RTT data sets using well-known detrended fluctuation analysis (DFA) method that is capable of eliminating artifacts arising from nonstationarities. Given RTT time series of N samples were first integrated and then divided into boxes of equal length n, according to standard DFA procedure [19, 20]. In each box, the polynomial local trend was calculated and removed. After N/n mean squared residuals, Detrended Fluctuation Functions (F (n)) were calculated for each box (or window) of size n:
This computation was repeated over all time scales (window sizes) to determine the relationship between the average fluctuation, F (n), and window size n. A log-log plot of F (n) versus n was then linearly regressed to obtain the slope, α, the scaling exponent, which is a typical fingerprint of the scaling behavior intrinsic to the data. As far as F (n) increases with the box size n, in case of fractal or self-similar properties of analyzed data, a power law behavior F (n)∼ n α can be revealed. If a power law scaling exists, the F (n) versus n relationship, in double logarithmic fluctuation plot, will be linear or close to be linear and the scaling exponent α can be estimated. Scaling exponent α = 0.5 indicates uncorrelated dynamics [21, 22]. If α is different from 0.5, then the time series is regarded as persistent or antipersistent, with α > 0 5 or α < 0 5 accordingly [21–23].
DFA scaling exponent α is considered as an indicator of the nature of the fluctuations giving the information about the long range power law correlation properties in the analyzed data sets [21–24]. In the frame of present analysis, we used second order of the polynomial fitting. Scaling exponents in the range 1 < α < 2 correspond to the integral of a fractional Brownian signal and α = 1.5 correspond to the well-known Brownian motion [20, 24].
3. Results and Discussion
As mentioned above, key performance metric for web applications, RTT, is the duration, measured in milliseconds, from when a browser sends a request to when it receives a response from a server. Supposedly RTT can be influenced by the following: a distance that a signal has to travel, the medium used to route a signal, number of intermediate routers or servers, level of traffic, queuing, and so forth. For clearness of further discussions, we also point here that RTT and latency are regarded as closely related as far as first one is transmission time to host and back while the latest is time to the host.
Here we investigated dynamical features of Internet performance assessing scaling characteristics of a network echo mechanism. Similar to results of earlier researches the shape of used RTT recordings (not shown here) indicated that considered process is unstationary [see, e.g., 14, 23, 27, 28]. All used RTT data sets were highly fluctuating within a narrow range, with some strong, isolated spikes followed by smaller values indicating that the network at certain times is in the relatively congested state and vise versa. Consequently, characterized by heavy tailed distribution functions, RTT data sets can be divided into small part of strongly spiky components of large delay times and much larger part of delay times fluctuating within a relative narrow range. Some authors claimed earlier that spikes in RTT data sets appear periodically [6, 12, 13, 25, 26], but we, like Wang [12], do not observe periodicity in spikes occurrences.
After selection of RTT data sets, they have been normed to standard deviation, and we started the DFA analysis. Having in mind that RTT data sets were unstationary, it becomes more understandable that robust against many types of nonstationarity DFA method was preferable in our research.
We underline that as far as opposite to number of previous researches, we aimed to analyze original dynamical features of echo mechanism; in the present work we avoided any filtering of data sets in order to preserve internal structure of target process.
In Figures 1 and 2, we present results of DFA calculation accomplished for entire length of available RTT data sets recorded during three consecutive days and nights of observation. Presented here are the results obtained for polynomial fit , but the results for higher orders of polynomials (3 and 4) have been found to be generally similar. It is important that in most cases fluctuation curves reveal presence of crossovers. Among the target nodes selected for this study, there was no one for which the fluctuation curves of the RTT series, recorded day or night (during the three days of observation), would always be linear. At the same time, in some cases, crossovers look very conditional since divide parts of fluctuation curves with close enough slopes. It is interesting that, sometimes, linearity of fluctuation curve is observed for closely located destination node, like for the first-day observations in case of GTU, or for far located nodes such as UCLA and in some extent for USC. RTT recordings for the second-day observations show linearity of fluctuation curve only for USC node. Third-day observation indicated crossovers for all selected destination nodes. Similar is the situation for night time measurements. Linearity of fluctuation curve was observed for first-night RTT recordings in case of Harvard and USTC nodes, second-night RTT data of UCLA and USC nodes, and GTU and Harvard nodes data sets recorded during third-night observations (see Figure 2). It is also worth mentioning that DFA scaling exponents calculated for entire scale range (global exponent) of fluctuation curves without crossovers are different for different destination nodes or observation period. Namely, in case of destination node USC for the second day and second night (Figures 1(b) and 2(b)), RTT time series looked similarly close to random-like (α = 0.54) while the first-day measurement for the same node (Figure 1(a)) shows closer to persistent behavior (α = 0.59). Clear persistence is revealed for the first-day observations of GTU (α = 0.69) and UCLA (α = 0.91) nodes, as well as for the first-night Harvard (α = 0.65), second-night UCLA (α = 0.74), and third-night GTU (α = 0.59) node observations. Fractional Brownian motion type behavior of RTT observations recorded for USTC node during first night (a = 1.29) and Harvard node third night (α = 1.44) are also needed to be pointed. All this indicates complicated character of RTT variation depending on the network load features and other presently unknown factors. At the same time it looks obvious that scaling features of RTT variation are not influenced by time of observation or by far or close location of destination node.
(a)
(b)
(c)
(a)
(b)
(c)
Complex character of Internet performance, as assessed by features of RTT variation, is revealed by the presence of crossovers in fluctuation curves. In general, it is known that a crossover phenomenon usually arises due to changes in the correlation properties of the analyzed process at different temporal or spatial scales [19, 27]. In such cases, when DFA fluctuation curve is not linear (crossovers present), correct extraction of global exponents for the entire scale is questionable. In Figures 1 and 2, local exponents for different scaling regions of fluctuation curves are shown. In accordance to earlier findings [12], in the case of most analyzed in our work RTT time series, DFA plot consists of two or sometimes three distinct regions characterized by straight lines before and after crossover points. In Figures 1 and 2, we notice different scaling exponents for different scaling regions. Also a significant shift of the position of crossover points was noted for different observation time periods. Such shift(s) in the location of crossover point(s) usually are interpreted as a reduction of temporal correlation in the analyzed process. This means that unknown influences in Internet network induce a decrease in the temporal organization of the echo mechanism. It is also important that the found crossovers may correspond to different types of transitions among nonpersistent, antipersistent, or persistent behaviors in RTT time series. For example, as we see in Figure 1, almost nonpersistent behavior (α = 0.51 ± 0.01) observed for short scales (windows) in first-day recordings of Harvard node RTT time series was changed to clearly persistent behavior (α = 0.98 ± 0.03) for larger scales. Moreover, we observe two crossovers in first-day RTT series to USTC node where Brownian noise type behavior (α = 1.46 ± 0.04) at short time scale was transformed to clearly persistent behavior at middle scales (α = 0.73 ± 0.02) and become random-like at larger scales (α = 0.49 ± 0.03).
Two crossovers present also in the fluctuation curves of second-day RTT time series. Namely, RTT sequences to Harvard node, at small middle and larger scales indicate transition from persistent (α = 0.72 ± 0.02) to antipersistent (α = 0.26 ± 0.01) long range correlated behavior followed by negatively correlated (antipersistent) noise (α = 1.20 ± 0.02) [28, 29]. Complicated transition from the clearly correlated to uncorrelated (random-like) and again persistent correlated behavior is revealed for UCLA RTT series (α = 0.99 ± 0.02, α = 0.46 ± 0.01, and α = 0.86 ± 0.02 for short, middle, and large time scales accordingly). In case of USTC node, RTT time series, recorded in second day, behave almost like for first-day data sets excluding long range correlation detected for long scales (α = 0.88 ± 0.04). By the way, for USTC node, RTT time series recorded during third-day observations seem to be characterized by one crossover and considered process of RTT variation at small and long scales is positively long range correlated (α = 0.74 ± 0.02; α = 0.67 ± 0.01). Recorded for third day, GTU, Harvard, and UCLA nodes RTT sequences also have one crossover. As can be seen in Figure 1(c), the last two of these time series reveal transition from persistent to slightly less persistent behavior (α = 0.77 ± 0.03; α = 0.61 ± 0.01 accordingly), while RTT for GTU node indicate transition from close to uncorrelated noise to clear persistence for long scales (α = 1.12 ± 0.01 and α = 0.71 ± 0.01). Changing character of correlation is shown also for USC node where we again observe two crossovers separating positively correlated short and large scales by the close to be uncorrelated random-like behavior in the middle time scale (α = 0.96 ± 0.02; α = 0.52 ± 0.02; α = 0.77 ± 0.01 accordingly).
Night-time measurements, in sense of presence of straight linear parts and crossovers in fluctuation curves, do not reveal principal differences from what we observed for day time measurements. Indeed, in the cases when there are no crossover points, the linear fluctuation curves of RTT time series recorded during first, second, and third observation nights indicate different types of behavior (see Figure 2). Indeed, RTT time series recorded during first night for Harvard node, second night for UCLA and USC, and third night for GTU nodes reveal mostly positively correlated persistent behavior (α = 0.65 ± 0.08; α = 0.73 ± 0.01; α = 0.54 ± 0.01; and α = 0.59 ± 0.01 accordingly. In case of RTT data recorded in second night for UCLA node, the character of fluctuation was close to be regarded as nonpersistent random-like, with α = 0.54 ± 0.01. At the same time, results for first-night recordings of USTC and third-day recordings of Harvard RTT data sets point that process at entire time scales looked close to be uncorrelated Brownian noise (α = 1.29 ± 0.01 and α = 1.44 ± 0.05 accordingly).
According to the results presented in Figures 1 and 2, it can be said that in general there is no principal difference in the shape of DFA fluctuation curves for day and night time RTT recordings. This is true for the cases both when we observe the so-called simplex or linear fluctuation curves and when there are crossovers. What is said is interesting in the light of earlier results indicating that the extent of temporal variation of RTT depends on the time of day [30].
In case of both day and night time data sets, the presence of crossovers indicate changing character of correlation in RTT variation cannot be explained by the location of destination node or certain period of observation. Indeed, first-night observations of closely located destination node of GTU reveal transition from uncorrelated Brownian motion (α = 1.35 ± 0.01, at small scales) to persistent (α = 0.61 ± 0.04, at larger scales) behavior (note that crossover is shifted to larger scales). It is important that fluctuation curve of second-night RTT recordings of this node is almost linear, with practically negligible differences in correlation features before and after crossover (α = 0.84 ± 0.03 and α = 0.82 ± 0.02 accordingly). More or less close to fractional Brownian type behavior, with scaling exponents in the range 1 < α < 2 [20, 24], is displayed for second-night Harvard, first-night UCLA, and third-night USTC RTT recordings, with difference that, for the last two cases, small and large scales are intermitted by middle scale persistent behavior (Figure 2). Our results in complete accordance with earlier findings [1, 14] point out the extreme heterogeneity of the Internet processes transmission supposedly related to the fact of strong differences in transmission speed between different points of the network.
It deserves to be said that presence of spikes in considered data sets, causing strong differences in calculated values of coefficients of variation for certain day or night RTT series, is not connected with the question of presence of crossovers in DFA fluctuation curves. For example, RTT recorded in the first- and second night at GTU node are characterized by strong spikes (Cv = 10.12 and Cv = 4.17) though fluctuation curve of first one has clear crossover while the second one practically is linear (see Figures 2(a) and 2(b)). Also, RTT recorded at third night at USC (Cv = 10.6) have one crossover though that recorded at USTC (Cv = 0.013) has two crossovers.
So far as, sometimes slopes of parts of fluctuation curves, divided by crossover, were very close; prior to continuing with our following analysis we anyway would like to talk about slopes of fluctuation curves on the entire available scale. It looks interesting that slopes for entire scales in the case of day-time RTT recordings were in the range 0.54 to 0.99, being in overwhelming cases clearly persistent. Night recordings, on the other hand, in some cases reveal broader range of slopes being actually from 0.66 to 1.2, indicating sometimes close to fractional Brownian type of behavior.
Next, we applied sliding window procedure to reveal time-varying long range dependence in the RTT time series at different node locations. DFA exponents were calculated for consecutive 1000 data windows shifted by 100 data steps. As far as analyzed RTT data sets were long enough, we selected 1000 data long windows that, on one hand, enabled us to trace details of scaling features variation in the data sets and, on the other hand, ensured appropriate level of the reliability of calculations. Moreover, selected length windows were appropriate to avoid mistakes in the calculation of fluctuation function, which may happen if the data in DFA boxes of smaller sizes is scarce. Thus, reliable calculations for large number of small size boxes are important for accurate estimation of the fluctuation function because in the case of larger boxes, due to their low number, strong noise effects may occur due to averaging problems [21, 31, 32]. 1000 data length windows looked most appropriate to ensure acceptable time resolution and the correct calculation of scaling characteristics of used RTT data sets. As far as fluctuation curves on larger scales often have crossovers, we have considered only windows with close to be linear fluctuation curves. Selection criterion was such that standard deviations of increments of fluctuations do not exceed 10 times of minimal STD for all windows.
In Figures 3 and 4, results of these calculations, for different observation nodes, are presented as plots of frequency of occurrences of DFA scaling exponents calculated for consecutive 1000 data windows shifted by 100 data steps along entire length of available RTT time series. As it follows from the obtained results, in most cases both for day and night recordings, frequency of occurrences of DFA scaling exponents of RTT data sets is better described by unimodal, asymmetric, and skewed left or right long tailed distributions. It is interesting that according to results of the previous researches, original RTT data sets are also characterized by heavy tail distributions [10, 14, 30, 33].
(a)
(b)
(c)
(a)
(b)
(c)
Full range and width at half maximum of DFA scaling exponents distribution functions convincingly indicate that from window to window correlation features may change drastically. In spite of such variability, from about 15 to 50 percent of cases calculated for shorter windows scaling exponents are grouped at certain values, depending on measurement node and period of data recording (see Figures 3 and 4). For example, scaling exponents, calculated for 1000 data windows of RTT series of Harvard node, during first, second, and third days of observation, indicate random or random-like slightly persistent (α from 0.5 to 0.54) behavior in 15% to 40% of all windows. Opposite to the first two days, in case of third-day Harvard node RTT data, distribution function of scaling exponents is most asymmetric and skewed right. Almost the same can be said for day time RTT data sets recorded for UCLA and USC destination nodes (Figure 3), where in 15% to 35% of all 1000 data windows analyzed process looks random-like or slightly persistent (α from 0.51 to 0.59) and distribution functions of scaling exponents always are long tailed, skewed right. Unusually, comparing to the above said, is the situation with USTC destination node where for the first and second days of observation in considerable part of 1000 data windows (from 10% to 20%) RTT variation looks as Brownian noise type (α ≈ 1.2). At the same time third-day RTT recordings show slightly persistent (α = 0.59) behavior in 21% of windows. Nevertheless, distribution functions of scaling exponents are long tailed though are skewed left. All what is mentioned is related to the far located destination nodes. Nonetheless, close GTU node also indicate different behavior of RTT data sets recorded in different days. Namely, first- and second-day RTT observations show clearly persistent behavior (α from 0.62 to 1.0) in 11%–18% of windows, while third-day data indicate shift to Brownian noise type (α ≈ 1.2) behavior in about 10% of windows. Distribution functions of RTT data sets recorded for close GTU node were different, being sometimes more or less symmetric or close to be skewed left or right long tailed.
It is important, that like in the case of analysis of entire length data sets, in case of 1000 data windows, we also do not observe principal differences for day or night observations. Indeed, as it is shown in Figure 4, DFA scaling exponents calculated for night time RTT measurements at different destination nodes show different behavior which cannot be simply explained by location of certain destination node or time of observation. Here we also observe presence of wide range of scaling exponents and character of distribution functions.
Thus, results of research indicate complex character of the dynamics of RTT variability which cannot be related to one or several causes mentioned above. In addition to what is mentioned above we add here that the importance of results of this and similar researches also is related to the fact that nowadays many devices have multiple network interfaces to achieve better robustness and efficiency. In such case one usually deals with multiple subflows and thus needs to determine subflows with minimal round-trip time when transmitting packets. Knowing complex character of RTT variation, described above, it becomes clear that quantitative vision of issue, being focused on the minimum RTT values, will not lead to a solution of problem and that it is necessary to focus on assessment of qualitative changes in dynamics of the process.
4. Conclusions
We investigated dynamics of Internet performance based on the assessment of scaling features of a network ping time series of echo mechanism. Time series of round-trip times from the host computer to 5 destination hosts and back have been recorded during three consecutive days and nights.
DFA method has been used for the purpose of long range correlation testing of RTT data sets. It was confirmed that RTT data sets fluctuate within wide range depending on time of observation or host location. At the same time, we find that dynamical changes occurring in the Internet network do not depend on the location of host and destination nodes or time of observation.
It was confirmed that RTT values fluctuate within wide range depending on time of observation or host location. This makes the scaling behavior of the RTT time series complicated what is expressed in essential changes in the long range correlation and scaling features of echo mechanism. It was shown that dynamical changes occurring in the round-trip time variation of Internet network do not depend on the location of host and destination nodes or on the time of observation. From this we conclude that the character of the found dynamical changes apparently is related to the internal dynamical structure of the analyzed Internet echo mechanism and is not caused just by the size of certain large measured RTT values, location of node, or time of recording.
DFA fluctuation curves of RTT data sets are usually characterized by more or less expressed crossovers, indicating changing dynamics of the analyzed process during the period of observation.
Distribution function of considered RTT time series mostly was asymmetric with long tail on the right hand side. Dynamical changes occurring in the scaling features of Internet network as assessed by RTT fluctuations do not depend on the location of the host and destination nodes.
Data Availability
The data used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.