Network Traffic Characteristics of Data Centers in the Wild - Sigcomm
Network Traffic Characteristics of Data Centers in the Wild - Sigcomm
Network Traffic Characteristics of Data Centers in the Wild - Sigcomm
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
5. APPLICATIONCOMMUNICATIONPAT-<br />
TERNS<br />
In<strong>the</strong>previoussection,wedescribed<strong>the</strong>set<strong>of</strong>applicationsrunn<strong>in</strong>g<strong>in</strong>each<strong>of</strong><strong>the</strong>10datacentersandobservedthatavariety<strong>of</strong>applicationsrun<strong>in</strong><strong>the</strong>datacentersandthat<strong>the</strong>irplacementisnonuniform.Inthissection,weanalyze<strong>the</strong>aggregatenetworktransmissionbehavior<strong>of</strong><strong>the</strong>applications,bothat<strong>the</strong>flow-levelandat<br />
<strong>the</strong>f<strong>in</strong>er-gra<strong>in</strong>edpacket-level. Specifically,weaimtoanswer<strong>the</strong><br />
follow<strong>in</strong>gquestions:(1)Whatare<strong>the</strong>aggregatecharacteristics<strong>of</strong><br />
flowarrivals,sizes,anddurations? and(2)Whatare<strong>the</strong>aggregatecharacteristics<strong>of</strong><strong>the</strong>packet-level<strong>in</strong>ter-arrivalprocessacrossallapplications<strong>in</strong>arack—thatis,howburstyare<strong>the</strong>transmissionpatterns<strong>of</strong><strong>the</strong>seapplications?Theseaspectshaveimportant<br />
implicationsfor<strong>the</strong>performance<strong>of</strong><strong>the</strong>networkanditsl<strong>in</strong>ks.<br />
Asbefore,weuse<strong>the</strong>packettraces<strong>in</strong>ouranalysis.<br />
5.1 Flow-LevelCommunication<strong>Characteristics</strong><br />
First,weexam<strong>in</strong>e<strong>the</strong>number<strong>of</strong>activeflowsacross<strong>the</strong>4data<br />
centerswherewehavepacket-leveldata,EDU1,EDU2,EDU3,<br />
andPRV2.Toidentifyactiveflows,weusealong<strong>in</strong>activitytimeout<strong>of</strong>60seconds(similartothatused<strong>in</strong>previousmeasurements<br />
studies[19]).<br />
InFigure3(a),wepresent<strong>the</strong>distribution<strong>of</strong><strong>the</strong>number<strong>of</strong>active<br />
flowswith<strong>in</strong>aonesecondb<strong>in</strong>,asseenatsevendifferentswitches<br />
with<strong>in</strong>4datacenters.Wef<strong>in</strong>dthatalthough<strong>the</strong>distributionvaries<br />
across<strong>the</strong>datacenters,<strong>the</strong>number<strong>of</strong>activeflowsatanygiven<br />
<strong>in</strong>tervalislessthan10,000. Basedon<strong>the</strong>distributions,wegroup<br />
<strong>the</strong>7monitoredswitches<strong>in</strong>totwoclasses. In<strong>the</strong>firstclassare<br />
all<strong>of</strong><strong>the</strong>universitydatacenterswitchesEDU1,EDU2andEDU3,<br />
andone<strong>of</strong><strong>the</strong>switchesfromaprivateenterprise,namelyPRV24,<br />
where<strong>the</strong>number<strong>of</strong>activeflowsisbetween10and500<strong>in</strong>90%<strong>of</strong><br />
<strong>the</strong>time<strong>in</strong>tervals.In<strong>the</strong>secondclass,are<strong>the</strong>rema<strong>in</strong><strong>in</strong>gswitches<br />
from<strong>the</strong>enterprise,namely,PRV21,PRV22,andPRV23,where<br />
<strong>the</strong>number<strong>of</strong>activeflowsisbetween1,000and5,000about90%<br />
<strong>of</strong><strong>the</strong>time.<br />
Weexam<strong>in</strong>e<strong>the</strong>flow<strong>in</strong>ter-arrivaltimes<strong>in</strong>Figure3(b).Wef<strong>in</strong>d<br />
that<strong>the</strong>timebetweennewflowsarriv<strong>in</strong>gat<strong>the</strong>monitoredswitchis<br />
lessthan10µsfor2-13%<strong>of</strong><strong>the</strong>flows. Formost<strong>of</strong><strong>the</strong>switches<strong>in</strong><br />
PRV2,80%<strong>of</strong><strong>the</strong>flowshavean<strong>in</strong>ter-arrivaltimeunder1ms.This<br />
observationsupports<strong>the</strong>results<strong>of</strong>apriorstudy[19]<strong>of</strong>aclouddata<br />
center.However,wefoundthatthisobservationdoesnotholdfor<br />
<strong>the</strong>universitydatacenters,wherewesee80%<strong>of</strong><strong>the</strong>flow<strong>in</strong>terarrivaltimeswerebetween4msand40ms,suggest<strong>in</strong>gthat<strong>the</strong>sedatacentershavelesschurnthanPRV2and<strong>the</strong>previouslystudiedclouddatacenter[19].Amongo<strong>the</strong>rissues,flow<strong>in</strong>ter-arrival<br />
timeaffectswhatk<strong>in</strong>ds<strong>of</strong>process<strong>in</strong>gcanbedoneforeachnew<br />
flowand<strong>the</strong>feasibility<strong>of</strong>logicallycentralizedcontrollersforflow<br />
placement.Wereturnto<strong>the</strong>sequestions<strong>in</strong>Section7.<br />
Next,weexam<strong>in</strong>e<strong>the</strong>distributions<strong>of</strong>flowsizesandandlengths<br />
<strong>in</strong>Figure4(a)and(b),respectively.FromFigure4(a),wef<strong>in</strong>dthat<br />
flowsizesareroughlysimilaracrossall<strong>the</strong>studiedswitchesand<br />
datacenters.Across<strong>the</strong>datacenters,wenotethat80%<strong>of</strong><strong>the</strong>flows<br />
aresmallerthan10KB<strong>in</strong>size.Most<strong>of</strong><strong>the</strong>bytesare<strong>in</strong><strong>the</strong>top10%<br />
<strong>of</strong>largeflows.FromFigure4(b),wef<strong>in</strong>dthatformost<strong>of</strong><strong>the</strong>data<br />
centers80%<strong>of</strong><strong>the</strong>flowsarelessthan11secondslong.Theseresultssupport<strong>the</strong>observationsmade<strong>in</strong>priorastudy[19]<strong>of</strong>acloud<br />
datacenter. However,wedonotethat<strong>the</strong>flows<strong>in</strong>EDU2appear<br />
tobegenerallyshorterandsmallerthan<strong>the</strong>flows<strong>in</strong><strong>the</strong>o<strong>the</strong>rdata<br />
centers. Webelievethisisdueto<strong>the</strong>nature<strong>of</strong><strong>the</strong>predom<strong>in</strong>ant<br />
applicationthataccountsforover70%<strong>of</strong><strong>the</strong>bytesat<strong>the</strong>switch.<br />
F<strong>in</strong>ally,<strong>in</strong>Figure5,weexam<strong>in</strong>e<strong>the</strong>distribution<strong>of</strong>packetsizes<br />
<strong>in</strong><strong>the</strong>studieddatacenters.Thepacketsizesexhibitabimodalpat-<br />
272<br />
CDF<br />
(a)<br />
CDF<br />
(b)<br />
1<br />
0.8<br />
0.6<br />
0.4<br />
0.2<br />
0<br />
EDU1<br />
EDU2<br />
EDU3<br />
PRV21 PRV22 PRV23 PRV24 10 100 1000 10000 100000<br />
1<br />
0.8<br />
0.6<br />
Number <strong>of</strong> Active Flows<br />
0.4<br />
0.2<br />
0<br />
EDU1<br />
EDU2<br />
EDU3<br />
PRV21 PRV22 PRV23 PRV24 10 100 1000 10000 100000<br />
Flow Interarrival Times (<strong>in</strong> usecs)<br />
Figure3: CDF<strong>of</strong><strong>the</strong>distribution<strong>of</strong><strong>the</strong>number<strong>of</strong>flowsat<br />
<strong>the</strong>edgeswitch(a)and<strong>the</strong>arrivalrateforflows(b)<strong>in</strong>EDU1,<br />
EDU2,EDU3,andPRV2.<br />
tern,withmostpacketsizescluster<strong>in</strong>garoundei<strong>the</strong>r200Bytesand<br />
1400Bytes.Surpris<strong>in</strong>gly,wefoundapplicationkeep-alivepackets<br />
asamajorreasonfor<strong>the</strong>smallpackets,withTCPacknowledgments,asexpected,be<strong>in</strong>g<strong>the</strong>o<strong>the</strong>rmajorcontributor.Uponclose<br />
<strong>in</strong>spection<strong>of</strong><strong>the</strong>packettraces,wefoundthatcerta<strong>in</strong>applications,<br />
<strong>in</strong>clud<strong>in</strong>gMSSQL,HTTP,andSMB,contributedmoresmallpacketsthanlargepackets.Inoneextremecase,wefoundanapplicationproduc<strong>in</strong>g5timesasmanysmallpacketsaslargepackets.<br />
Thisresultspeakstohowcommonlypersistentconnectionsoccur<br />
asadesignfeature<strong>in</strong>datacenterapplications,and<strong>the</strong>importance<br />
<strong>of</strong>cont<strong>in</strong>uallyma<strong>in</strong>ta<strong>in</strong><strong>in</strong>g<strong>the</strong>m.<br />
5.2 Packet-LevelCommunication<strong>Characteristics</strong><br />
Wefirstexam<strong>in</strong>e<strong>the</strong>temporalcharacteristics<strong>of</strong><strong>the</strong>packettraces.<br />
Figure6showsatime-series<strong>of</strong>packetarrivalsobservedatone<strong>of</strong><br />
<strong>the</strong>sniffers<strong>in</strong>PRV2,and<strong>the</strong>packetarrivalsexhibitanON/OFF<br />
patternatboth15msand100msgranularities.Weobservedsimilar<br />
trafficpatternsat<strong>the</strong>rema<strong>in</strong><strong>in</strong>g6switchesaswell.<br />
Per-packetarrivalprocess: Leverag<strong>in</strong>g<strong>the</strong>observationthat<br />
trafficisON/OFF,weuseapacket<strong>in</strong>ter-arrivaltimethresholdto<br />
identify<strong>the</strong>ON/OFFperiods<strong>in</strong><strong>the</strong>traces. Let arrival95be<strong>the</strong><br />
95thpercentilevalue<strong>in</strong><strong>the</strong><strong>in</strong>ter-arrivaltimedistributionataparticularswitch.Wedef<strong>in</strong>eaperiodonas<strong>the</strong>longestcont<strong>in</strong>ualperioddur<strong>in</strong>gwhichall<strong>the</strong>packet<strong>in</strong>ter-arrivaltimesaresmallerthan<br />
arrival95.Accord<strong>in</strong>gly,a period<strong>of</strong>fisaperiodbetweentwoON<br />
periods.TocharacterizethisON/OFFtrafficpattern,wefocuson<br />
threeaspects:(i)<strong>the</strong>durations<strong>of</strong><strong>the</strong>ONperiods,(ii)<strong>the</strong>durations
Change language