and Michalis Faloutsos
University of California,Riverside
Ten Years of Internet Traffic Modeling
Self-similarity and scaling phenomena have dominated Internet traffic analysis for
the past decade.With the identification of long-range dependence (LRD) in
network traffic, the research community has undergone a mental shift from
Poisson and memory-less processes to LRD and bursty processes.Despite its
widespread use, though, LRD analysis is hindered by our difficulty in actually
identifying dependence and estimating its parameters unambiguously.The authors
outline LRD findings in network traffic and explore the current lack of accuracy
and robustness in LRD estimation. In addition, the authors present recent
evidence that packet arrivals appear to be in agreement with the Poisson
assumption in the Internet core.
replicate the Internet and study it as a
whole, so we rely on thorough analysis of
network measurements and their trans-
formation into models to help explain the
Internet’s functionality and improve its
About 10 years ago, the introduction
of long-range dependence (LRD) and
self-similarity revolutionized our under-
standing of network traffic. (LRD means
that the behavior of a time-dependent
process shows statistically significant
correlations across large time scales; self-
raffic modeling and analysis is a fun-
damental building block of Internet
engineering and design. We can’t
similarity describes the phenomenon in
which the behavior of a process is pre-
served irrespective of scaling in space or
time.) Prior to that, researchers consid-
ered Poisson processes (that is, the pack-
et arrival process is memory-less and
interarrival times follow the exponential
distribution) to be an adequate represen-
tation for network traffic in real sys-
tems.1LRD flew in the face of conven-
tional wisdom by stating that network
traffic exhibits long-term memory (its
behavior across widely separated times is
correlated). This assertion challenged the
validity of the Poisson assumption and
shifted the community’s focus from
2 SEPTEMBER • OCTOBER 2004 Published by the IEEE Computer Society1089-7801/04/$20.00 © 2004 IEEEIEEE INTERNET COMPUTING
Network Traffic,” Int’l Conf. Network Protocols, IEEE CS
Press, 1996, pp. 171–180.
8. M.E. Crovella and A. Bestavros, “Self-Similarity in World
Wide Web Traffic: Evidence and Possible Causes,”
IEEE/ACM Trans. Networking, vol. 5, no. 6, 1997, pp.
9. W. Willinger et al., “Self-Similarity through High-Variabil-
ity: Statistical Analysis of Ethernet LAN Traffic at the
Source Level,” IEEE/ACM Trans. Networking, vol. 5, no. 1,
1997, pp. 71–86.
10. A. Feldmann et al., “The Changing Nature of Network Traf-
fic: Scaling Phenomena,” ACM Computer Comm. Rev., vol.
28, Apr. 1998, pp. 5–29.
11. Z.L. Zhang et al., “Small-Time Scaling Behaviors of Inter-
net Backbone Traffic: An Empirical Study,” Proc. IEEE
Infocom, IEEE CS Press, 2003, pp. 1826–1836.
12. J. Cao et al., “On the Nonstationarity of Internet Traffic,”
Sigmetrics/Performance, ACM Press, 2001, pp. 102–112.
13. Y. Zhang et al., “On the Constancy of Internet Path Prop-
erties,” Proc. ACM Sigcomm Internet Measurement Work-
shop, ACM Press, 2001, pp. 197–212.
14. M.S. Taqqu and V. Teverovsky, “On Estimating the Intensi-
ty of Long-Range Dependence in Finite and Infinite Vari-
ance Time Series,” A Practical Guide to Heavy Tails: Sta-
tistical Techniques and Applications, Birkhauser, 1998, pp.
15. P. Abry and D. Veitch, “Wavelet Analysis of Long-Range
Dependence Traffic,” IEEE Trans. Information Theory, vol.
44, no. 1, 1998, pp. 2–15.
16. T. Karagiannis, M. Faloutsos, and R.H. Riedi, “Long-
Range Dependence: Now You See It, Now You Don’t!”
Proc. IEEE Global Telecommunications Conf. Global
Internet Symp., 2002.
17. V. Paxson, “Fast Approximation of Self Similar Network Traf-
fic,” Computer Comm. Rev., vol. 27, no. 5, 1997, pp. 5–18.
18. T. Karagiannis, M. Molle, and M. Faloutsos., “A Nonsta-
tionary Poisson View of Internet Traffic,” Proc. IEEE Info-
com, IEEE CS Press, 2004.
19. R. Jain and S. Routhier, “Packet Trains: Measurements and
a New Model for Computer Network Traffic,” IEEE J.
Select. Areas Comm., vol. 4, no. 6, 1986, pp. 986–995.
Thomas Karagiannis is a PhD candidate in the Department of
Computer Science and Engineering at the University of Cal-
ifornia, Riverside. His technical interests include Internet
traffic measurements, analysis of Internet traffic dynam-
ics, Internet protocols, and peer-to-peer networks. Kara-
giannis received a BSc in the Department of Applied Infor-
matics at University of Macedonia, Thessaloniki, Greece.
He is a member of IEEE. Contact him at firstname.lastname@example.org.
Mart L. Molle is a professor in the Department of Computer Sci-
ence and Engineering at the University of California, River-
side. His research interests include the performance evalu-
ation of protocols for computer networks and of distrib-
uted systems. Molle received a BSc (Hons.) in mathemat-
ics/computing science from Queen’s University at Kingston,
Canada, and an MS and PhD in computer science from the
University of California, Los Angeles. He is a member of
the IEEE. Contact him at email@example.com.
Michalis Faloutsos is a faculty member in the Computer Sci-
ence Department at the University of California, Riverside.
His interests include Internet protocols and measurements,
multicasting, and ad hoc networks. Faloutsos received a BS
in electrical and computer engineering from the National
Technical University of Athens and an MSc and PhD in
computer science from the University of Toronto. Contact
him at firstname.lastname@example.org.
IEEE INTERNET COMPUTING www.computer.org/internet/SEPTEMBER • OCTOBER 20049