Self-configuring network traffic generation

Abstract

The ability to generate repeatable, realistic network traffic is critical in both simulation and testbed environments. Traffic generation capabilities to date have been limited to either simple sequenced packet streams typically aimed at throughput testing, or to application-specific tools focused on, for example, recreating representative HTTP requests. In this paper we describe Harpoon, a new application-independent tool for generating representative packet traffic at the IP flow level. Harpoon generates TCP and UDP packet flows that have the same byte, packet, temporal and spatial characteristics as measured at routers in live environments. Harpoon is distinguished from other tools that generate statistically representative traffic in that it can self-configure by automatically extracting parameters from standard Netflow logs or packet traces. We provide details on Harpoon's architecture and implementation, and validate its capabilities in controlled laboratory experiments using configurations derived from flow and packet traces gathered in live environments. We then demonstrate Harpoon's capabilities in a router benchmarking experiment that compares Harpoon with commonly used throughput test methods. Our results show that the router subsystem load generated by Harpoon is significantly different, suggesting that this kind of test can provide important insights into how routers might behave under actual operating conditions.

Workload Modeling for Computer Systems Performance Evaluation

“…A tool that models Internet flows in an application-neutral manner is Harpoon [640]. The model is based on four distributions:…”

Applying wavelets for the controlled compression of communication network measurements

“…This tool has been used by many researchers [25], [26], [27], [28] for evaluating their traffic models with respect to the correct reproduction of the scaling structure of the modeled traffic. By comparing the busrtiness of the synthesized and original traffic at a variety of scales, researchers can evaluate how closely their model matches the correlation structure of the modeled network.…”

Using Wavelets for Compression and Detecting Events in Anomalous Network Traffic

“…This approach has been used by many researchers [20], [21], [22], [23] for evaluating their traffic models with respect to the correct reproduction of the scaling structure of the modeled traffic. By comparing the busrtiness of the synthesized and original traffic at a variety of scales, researchers can evaluate how closely their model matches the correlation structure of the modeled network.…”