On the Double-Faced Nature of P2P Traffic

Transcription

1 On the Double-Faced Nature o P2P Traic Raaele Bolla, Marco Canini, Riccardo Rapuzzi, Michele Sciuto DIST - Department o Communication, Computer and System Sciences, University o Genoa Via Opera Pia 13, 16145, Genova, Italy {raaele.bolla, marco.canini, riccardo.rapuzzi, michele.sciuto}@unige.it Abstract Over the last ew years, peer-to-peer (P2P) ile sharing applications have evolved to become a major traic source in the Internet. The ability to quantiy their impact on the network, as a consequence o both signaling and download traic, is undamental to a number o network operations, including traic engineering, capacity planning, quality o service, orecasting or long-term provisioning, etc. We present here a measurement study on the characteristics o the traic associated with dierent P2P applications. Our aim is to oer useul insight into the nature o P2P traic, which we consider a step toward building P2P traic aggregates generators in simulative environments. We show that P2P traic can be divided into two distinguished behavioral proiles, which, independently o the application protocol, present signiicant dierences in the average and standard deviation o our measurements: arrival times, durations, volumes and average packet sizes o P2P conversations. These proiles well represent the typical behavior o signaling and download traic. Based on our indings, we argue that, i such distinction is not taken into account, the statistical measurements needed to model P2P traic aggregates would result biased, and potentially bring to misleading results. 1 Introduction Over the last ew years, peer-to-peer (P2P) ile sharing applications have evolved to become a major traic source in the Internet. Plus, the successul P2P paradigm is now used by an increasing number o systems to oer eicient and scalable services ranging rom content distribution, network TV, voice-over-ip to sotware updates. An important consequence related to the appearance o P2P systems is related to the high traic volumes caused by these applications. The ability to quantiy their impact on the network, as a consequence o both signaling and download traic, is undamental to a number o network operations, including traic engineering, capacity planning, quality o service, orecasting or long-term provisioning, etc. We present here a measurement study on the characteristics o the traic associated with dierent P2P applications. We identiy P2P traic in our data sets by using a payload classiier based on pattern matching. We develop a characterization o this traic that ocuses towards its behavior as it is experienced at the network layer. In this work, which grounds up on our previous work in [1], we deine a measurement, Content Transer Index, to distinguish two classes o behavior or P2P traic: the download and the signaling traic proile. Finally, we show that these two proiles present relevant dierences in the average and standard deviation o our measurements: arrival times, durations, volumes and average packet sizes. Based on our indings, we argue that the statistical measurements needed to model P2P traic aggregates would result biased, and potentially bring to misleading results, i its two-aced nature is not taken into account. We believe this work gives a sincere contribution towards building P2P traic aggregates generators in simulative environments. Our work is similar to [1], but it is dierent in that: (i) we don t limit our study to the edonkey protocol, and (ii) we identiy the P2P traic in our data sets by using a payload classiier, rather than the application port numbers. As their results are comparable with the ones reported in this paper, we consider promising our approach, which doesn t rely on the protocol opcode inormation to distinguish download rom signaling traic. In another related work [2], the authors have analyzed BitTorrent traic characteristics, using an instrumented version o the oicial client. They suggest that conversation durations and sizes can be reasonably well approximated by the lognormal distribution, which is also conirmed in our results. A complementary work is [3], where the authors model and characterize BitTorrent-like systems by using measurements at the application layer. The remainder o this paper is organized as ollows. In Section 2, we describe how we identiied P2P traic in our data sets. In Section 3, we present our characterization o

2 P2P traic. The results o this characterization applied to a number o measurements are shown in Section 4. Finally, Section 5 concludes the paper. 2 collection We analyzed traces contemporarily collected or 46 consecutive hours, at two dierent links o the university s campus network. For both traces, we captured every packet seen on each direction o the links along with its ull payload and we removed the link layer header (i.e., Ethernet). To capture the irst trace (DEPT), the monitor was located on the link connecting our department to the campus network. The second trace (GENUA) was captured by monitoring the campus connection to the Internet. We ignore the TCP connections or which we don t observe the triple handshake. Table 1 lists general workload dimensions o our data sets: counts o distinct source and destination IP addresses, the number o lows, packets, and bytes observed. In this study we deine lows as unidirectional, while we use conversation to denote bidirectional traic, i.e., a conversation is composed by two lows: traic rom A to B, and traic rom B to A. Each low is always identiied by two end points consisting o {IP, port} pairs and the transport level protocol. In the case o the UDP, we set a timeout o 6 seconds to determine the end o a conversation. We used an open source tool, namely ipp2p [4], to classiy the P2P traic in our traces. It identiies P2P lows via pattern matching, i.e., searching the payload content o the packets or known protocol signatures. This classiier acts every time a packet is received, and marks a conversation as identiied as soon as a known pattern is ound in at least one o its directions. For scalability reasons, only up to the irst N packets o each conversation are tested. N is a user conigurable parameter, that we set to 1 as done in [9]. Because this tool is not available as an o-line, trace processing tool (it is originally meant to be deployed in the Linux s iptables irewall or traic shaping purposes), we ported its source code to the Click Modular Router [7], which we used as a viable analysis ramework [6]. We validated our version o the tool against its original version by comparing the results obtained rom the classiication o our data sets. The outputs were indeed the same. Finally, we collated the classiication results obtained with our ipp2p classiier with the output o the payload classiier used to validate BLINC [5], obtaining very close results on our data sets. In this paper, we present results obtained using the GENUA data set; the results or the DEPT data set are similar and not presented here due to lack o space. Table 2 presents the volumes o P2P traic in GENUA trace, divided by P2P application. The values express the percentage with respect to the total amount o P2P traic. Both the traces are 46 hours long. Set Src. IP Dst. IP Flows Packets Bytes DEPT K K 16.8 M M 13.3 G GENUA 4.2 M 2.5 M 12. M 1.4 G 883. G Table 1. General workload dimensions o our traces Protocol Flows Packets Bytes Payload [%] [%] [%] Bytes [%] edonkey 83,78 46,19 42,12 41,88 BitTorrent 13,65 37,19 45,72 46,33 DC,34 7,5 9,99 1,23 Gnutella 2,21 9,11 2,16 1,56 Table 2. Breakdown by protocol o P2P traic in the GENUA data set In the remainder o the paper we mainly ocus on the traic generated by edonkey and BitTorrent, since this constitutes the majority in our campus network 1. However, we also report results about the traic associated with Gnutella and DirectConnect. 3 P2P traic characterization P2P traic can be roughly divided into download traic and signaling traic: the irst is caused by the transer o content, the latter is mainly due to the presence o an overlay network, and possibly a search service. A way to accurately dierentiate download rom signaling traic would be to implement a protocol analyzer. Although one can leverage existing tools, e.g. binpac [8], to build protocol analyzers, this solution has several drawbacks: (i) it requires speciic knowledge o P2P protocols; (ii) it demands access to the payload o each packet; (iii) building analyzers or a signiicant number o protocols is deinitely time consuming. Moreover, it is our desire to oer a characterization o P2P traic that ocuses towards its behavior as it is observable at the network level through simple passive measurements, including volumes o transerred content, conversations arrival times and durations, and average packet sizes. In our approach we identiy two behavioral classes that we shall reer to as the download and the signaling traic proile. To some extents we re abusing the terminologies, as it is possible, though not common, that a download conversation can exhibit the typical characteristics o signaling 1 P2P traic is believed to be hazardous or networks, and our campus network makes no exception. We are aware that a iltering system has been deployed, realizing traic shaping or the most common P2P applications.

3 [%] F [%] F (a) edonkey -TCP (b) BitTorrent - TCP [%] F [%] F (c) edonkey - UDP (d) DirectConnect - TCP Figure 1. Relationships between the conversations, payload bytes and the. The histograms are plotted with bin size.1 traic 2 and vice versa. However, we are mostly interested in distinguishing the conversations by considering the actual eects that they pose on the network, treating P2P with generality, rather then by using an accurate identiication o their role. We ground our approach on a simple intuition. The idea is that, during a ile download, a peer, on average, gets packets illed up to the maximum segment size (MSS) and sends back ewer packets to acknowledge the received data. Even when the peers are exchanging pieces o a single ile with one another (as realized in BitTorrent), causing balanced conversations, still, the average payload size tends to reach the MSS. Conversely, the signaling conversations are characterized by a latter proile, consisting o a more even count o exchanged bytes and packets. The accurate identiication o edonkey conversations 3 in our traces supports our intuition. In order to quantiy the dierences between these traic proiles we ormalize a measurement that oers a statistical characterization o P2P traic. We deine the Content Transer Index () o a conversation C as: F + F P MSS(C) + + F p MSS(C) [,1], where F, are the lengths o the two lows constituting C, such that F. One can use three dierent low ea- 2 E.g., early truncated downloads are not clearly distinguishable rom signaling conversations. 3 As done in [1], we classiy edonkey conversations to be download i one o its packets contains at least one o the edonkey protocol opcodes OP SENDINGPART or OP COMPRESSEDPART. tures to represent its length: the packet count, the count o payload bytes and the count o headers and payload bytes. We present here the results obtained by using the count o payload bytes as the low length. P and p represent the average number o payload bytes per packet calculated or the low with length F and respectively. The MSS o the conversation C is expressed as MSS(C). For the UDP, we assume that the MSS corresponds to the maximum transer unit (MTU) minus the IP and UDP headers lengths. Hence, given a pair o end points {A, B}, the gives an indication o how the content is transerred. At the opposite end o the spectrum there are two distinct traic proiles: when the conversation is latter or balanced (i.e., A and B exchange an even quantity o content, mainly using packets whose payload size is ar rom the MSS), the s value tends to zero; when the conversation is rich o content which is either transerred rom a single end point that dominates the conversation (unbalanced), or eiciently exchanged between the two end points, the s value tends to one. Figure 1(a), 1(b), 1(c) and 1(d) present a graphical visualization o the relationships between the conversations, payload bytes and the o edonkey TCP, BitTorrent TCP, edonkey UDP and DirectConnect TCP conversations respectively. Each igure shows three overlapping histograms, symbolizing the ollowing igures corresponding to the same range: the number o conversations, the

4 summation o the minimum and maximum length lows o the conversations (denoted with F + ) and the summation o just the minimum length lows (denoted with ). The number o conversations is normalized to the total number o conversations, while both summations o minimum and maximum length lows, and o just the minimum length lows are normalized to the total count o payload bytes. All the graphs but Figure 1(c) clearly show two distinctive proiles: containing most o the conversations, the signaling proile is having values below.2, whereas above.2, the download proile is dominated by the payload bytes. Also note in the signaling proiles that the conversations are quite balanced. As expected, the edonkey UDP conversations, that are carrying extended searches, generate a graph in which no conversation has value above.2. The same happens in the graph o Gnutella TCP conversation (that we omit or the lack o space), as the download traic o this protocol is eiciently iltered by the campus border router. Figure 1(d) contains a drastic example o how the two traic behave dierently: almost all the traic identiied as DirectConnect, accounting or 1.23% o the total P2P traic, is moved by just very ew conversations (.2% o the total P2P conversations), while the 94% o DirectConnect conversations transer an extremely small amount o data. Throughout the rest o the paper, we divide P2P traic into download vs. signaling by using the s value. In particular we use a threshold to distinguish the two classes: a conversation with a s value above the threshold is marked as a download conversation, while a value below the threshold determines a signaling conversation. We set the threshold to.2. This value was already used in our previous work in [1] which oers a validation o the, and it is visually derivable rom Figure 1. 4 Results In this section we present the results obtained by measuring arrival times, durations, volumes and average payload sizes o the download and signaling P2P conversations. For each measure, we report the measured data along with the best itting 4 statistical distribution and its parameters. We considered the ollowing candidate distributions: exponential, Pareto, lognormal, and. Note that we present the parameters in order to oer a numerical comparison o the empirical data across dierent protocols and traic proiles. Because these are preliminary results o this work, we are not suggesting to use them directly in the modeling o P2P traic aggregate generators, as this still require a deeper investigation. Arrival times. Figure 2 shows the s o the down- 4 By using the nonlinear least-squares method. load and signaling conversation arrival times, or edonkey and BitTorrent TCP traic. Table 3 lists their average and standard deviation. In all the our graphs, the best itting distribution is. Its parameters are more comparable when looking at the same traic proile rather then the same protocol. It is clear rom Table 3 that measuring the whole P2P traic or a given protocol leads to inaccurate values o the average and standard deviation o conversation arrival times, as there is a signiicant dierence between the values measured or download and signaling traic. Conversation type Avg. [s] Std. dev. [s] edonkey - download edonkey - signaling edonkey - all.1.15 BitTorrent - download BitTorrent - signaling BitTorrent - all Table 3. Average and standard deviation o the conversation arrival times [s] Durations. The s o the download and signaling conversation durations are shown in Figure 3, plotted or edonkey and BitTorrent TCP traic. The lognormal is the best itting distribution in all the our graphs. Table 4 lists their average and standard deviation. Interestingly the proiles o the download conversation durations are quite similar and the parameters o the itted lognormals are numerically very close, while the behavior o signaling traic is not so similar. We believe this is mostly due to the absence o a search service in the BitTorrent system, which is on the contrary available in the edonkey network. Once again, both the graphs and Table 4 indicate that the behavior o download and signaling traic is dierent. Measuring the P2P traic without distinguishing download rom signaling traic leads to inaccurate values or the average and standard deviation o conversation durations. Conversation type Avg. [s] Std. dev. [s] edonkey - download edonkey - signaling edonkey - all BitTorrent - download BitTorrent - signaling BitTorrent - all Table 4. Average and standard deviation o conversation durations [s] Volumes. Figure 4 reports the s o the conver-

5 (a) edonkey - download; λ = 1.53; κ = (c) edonkey - signaling; λ =.7; κ = (b) BitTorrent - download ; λ = 2.38; κ = (d) BitTorrent - signaling; λ =.82; κ =.77 Figure 2. o the conversation arrival times. κ and λ are the parameters sation volumes, plotted or edonkey and BitTorrent download and signaling traic. All the proiles are best itted by the lognormal distribution. The dierences in the parameters well reveal what is already clear in the graphs: download and signaling traic exhibit dierent proiles. The download conversation volumes are very similar or edonkey and BitTorrent, while the signaling ones are, on average, one order o magnitude smaller than the download conversation volumes or both protocols. Also note that we identiied some download conversations that are transerring hundreds o megabytes o data. Average payload sizes. Table 5 presents the average and standard deviantion o the download and signaling conversation average payload sizes, plotted or edonkey and Bit- Torrent TCP traic. The average payload size o a single conversation has been calculated as the mean o the average payload sizes o both lows or a signaling conversation, or as the maximum length low s average payload size in the case o a download conversation. Figure 5 present the relationships between the conversations, volumes and the average payload size or the signaling conversations o edonkey and BitTorrent. The graphs, which are realized using the same structure o Figure 1, show that there is signiicant dierence in terms o the average payload sizes used in these protocols. In particular, note that the conversations are more balanced or edonkey. We believe this relects the architectural dierences o the two P2P networks. However, or both protocols, there is no signaling conversation having average payload size greater than 3 bytes. Conversation type Avg. [bytes] Std. dev. [bytes] edonkey - download edonkey - signaling edonkey All BitTorrent - download BitTorrent - signaling BitTorrent All Table 5. Average and standard deviation o the conversation average payload sizes 5 Conclusion In this paper, we have presented a measurement study o P2P traic. We have irst applied the Content Transer Index to distinguish the traic into two classes o behavior: the download and the signaling traic proile. Based on this distinction, we have realized a number o measurements and shown that there are signiicant dierences in their average and standard deviation rom the case where the distinction is not taken into account. In particular, our measures result unbiased. These results indicate that the double-aced nature o P2P traic should be taken into account in modeling P2P traic aggregates. Acknowledgment This work was supported by the MIUR-PRIN unded project FAMOUS Fluid Analytical Models O autonomic Systems and by the MIUR-PRIN unded project RECIPE

6 (a) edonkey - download; µ = 5.5; σ = (c) edonkey - signaling; µ = 3.79; σ = (b) BitTorrent - download; µ = 5.97; σ = (d) BitTorrent - signaling; µ = 1.47; σ = 2.81 Figure 3. o the conversation durations. µ and σ are the lognormal parameters (a) edonkey - download; µ = 1.35; σ = (c) edonkey - signaling; µ = 6.18; σ = (b) BitTorrent - download; µ = 1.86; σ = (d) BitTorrent - signaling; µ = 5.73; σ = 1.54 Figure 4. o the conversation volumes. µ and σ are the lognormal parameters Robust and Eicient traic Classiication in IP networks. We would like to thank CSITA or supporting us in this research. Reerences [1] R. Bolla, M. Canini, R. Rapuzzi, and M. Sciuto. Characterizing the network behavior o P2P traic. In Proceedings o 4th International Telecommunication Networking Workshop on Qos in Multiservice IP Networks (QoS-IP), Feb. 28. to appear. [2] D. Erman, D. Ilie, and A. Popescu. Bittorrent session characteristics and models. In HET-NETs 5 Conerence Proceedings, July 25. [3] L. Guo, S. Chen,, Z. Xiao, E. Tan, X. Ding, and X. Zhang. Measurements, analysis, and modeling o bittorrent-like systems. In Proceedings o Internet Measurement Conerence, pages 35 48, Oct. 25. [4] IPP2P. [5] T. Karagiannis, K. Papagiannaki, and M. Faloutsos. BLINC: Multilevel traic classiication in the dark. In Proceedings o ACM Sigcomm, Aug. 25. [6] E. Kohler. Click or measurement. Technical Report TR61, UCLA Computer Science Department, Feb. 26. [7] E. Kohler, R. Morris, B. Chen, J. Jannotti, and M. F. Kaashoek. The click modular router. ACM Transactions on Computer Systems, 18(3): , Aug. 2.

7 [%] F Average payload size [bytes] [%] F Average payload size [bytes] (a) edonkey - signaling (b) BitTorrent - signaling Figure 5. Relationships between the conversations, volumes and the average payload size. The histograms are plotted with bin size 1 bytes [8] R. Pang, V. Paxson, R. Sommer, and L. Peterson. binpac: A yacc or writing application protocol parsers. In Proceedings o ACM Sigcomm Internet Measurement Conerence, Oct. 26. [9] S. Sen, O. Spatscheck, and D. Wang. Accurate, scalable innetwork identiication o P2P traic using application signatures. In Proceedings o the 13th international conerence on World Wide Web, May 24. [1] K. Tutschku. A measurement-based traic proile o the edonkey ilesharing service. In Proceedings o PAM, Apr. 24.