A Web Browsing Traffic Model for Simulation: Measurement and Analysis

Transcription

1 A Web Browsing Traffic Model for Simulaion: Measuremen and Analysis Lourens O. Walers Daa Neworks Archiecure Group Universiy of Cape Town Privae Bag, Rondebosch, 7701 Tel: (021) , Fax: (021) Pieer S. Krizinger Daa Neworks Archiecure Group Universiy of Cape Town Privae Bag, Rondebosch, 7701 Tel: (021) , Fax: (021) Absrac The simulaion of packe swiched neworks depends on accurae workload models o serve as inpu for nework models. We derive a workload model for daa raffic generaed by an individual browsing he web. The parameers of he model characerize user, web browser sofware, and web server sofware behaviour, independenly of underlying nework characerisics such as laency and hroughpu, which differ beween nework sies. We measured daa on a campus nework by capuring packe races of IP, TCP and header daa. The daa were processed by exracing daases for he model parameers from he daa. The approach of obaining daases for parameers is novel as a heurisic algorihm was used o achieve his. The parameer daases were analyzed by using visual echniques and goodness-of-fi measures for deriving analyic disribuions. The workload model will be implemened as a raffic generaing module in a nework simulaor. Traffic generaed by he model will be validaed by analyzing bursiness and self-similariy characerisics of he raffic, as well as comparing i o independenly measured raffic. This paper presens our work up o dae, which includes he definiion of our workload model, he measuremen and processing of web raffic daa and iniial findings from our saisical analysis of he daa. I. INTRODUCTION Srucural modelling is an approach o nework raffic modelling which akes ino accoun underlying characerisics of raffic sreams. For example, Inerne raffic can be broken down ino source-desinaion specific raffic, applicaion specific raffic or user specific raffic. This approach conrass he black box modelling approach which analyzes aggregae raffic as a monolihic body of daa. By modelling componen raffic sreams i is ofen possible o shed ligh on characerisics of aggregae raffic sreams e.g. Willinger e al. [1] found a srong connecion beween self-similariy of aggregae nework raffic and he occurrence of heavy-ailed, infinie variance disribuions wihin individual source-desinaion nework connecions. We employed he approach of srucural modelling by defining a deailed characerizaion of raffic generaed by an individual web user. By deailed we mean a characerizaion of web raffic ha akes ino accoun he nuances of web raffic generaed by a user e.g. a small exual HTML file being downloaded almos always being followed by a series of large graphics files, or he relaively small bu numerous reques packes generaed by a web browser clien in order o download acive conen or graphics files making up a web documen. One migh ask why modelling he numerous small reques packes is imporan when mos of he bandwidh is used by much larger response packes. The ineracion of TCP and, and in paricular he slow sar mechanism of TCP has a considerable influence on he performance of [2]. TCP is fundamenally a bulk ransfer proocol and is poorly suied o frequen, shor, reques-response-syle raffic such as ha of web raffic. Shor connecions, such as hose required o ransmi small reques packes inerac poorly wih TCP s slow sar congesion avoidance algorihm which causes increased laency for mos web users [2]. Several recen simulaion sudies have aken hese facs ino consideraion by using deailed web raffic, TCP and radio inerface models e.g. Saehle e al. [3] used simulaion o show ha he QoS of Inerne Access wih GPRS in is firs phase is comparable o ha of a modem wih a speed of 32kps, for medium raffic loads. Using a bidirecional web raffic model Kalden e al. [4] showed ha GPRS provides bandwidhefficien suppor for bursy applicaions such as web access. The paper is organized as follows. Secion II discusses relaed work. We presen our workload model in Secion III. Secion IV discusses he measuremen mehodology we employed o obain daa. The heurisic algorihm we implemened o exrac daases for he model parameers is presened in Secion V. The saisical mehodology we followed is explained in Secion VI, and preliminary resuls discussed in Secion VII. Secion VIII concludes he paper and discusses remaining work. II. RELATED WORK During he laer half of he 1990 s, World Wide Web raffic has dominaed he Inerne and became he main focus of raffic modelling. Traffic modelling work also sared o ake ino consideraion he self-similar naure of nework raffic as he seminal paper on he self-similariy of eherne raffic by Leland e al. [5] suggesed. Crovella e al. [6] showed ha web raffic is self-similar, and ha he self-similariy is in all likelihood aribuable o he heavy-ailed disribuions

2 of ransmission imes of documens and silen imes beween documen requess. The daa races used in he Crovella sudy were recorded by Cunha e al. [7]. These races served as he basis of he workload generaor SURGE developed by Barford e al. [8]. The objecive of he SURGE workload generaor is o generae raffic represenaive of he World Wide Web in order o exercise web servers and neworks. SURGE generaes web raffic equivalen o a se of real users accessing a web server. Mah [9] developed an empirical model of nework raffic. The parameers modelled are represened by heir empirical cumulaive disribuion funcions (as opposed o analyic disribuion funcions). The Inverse Transformaion Mehod is applied o hese in order o generae he relevan random numbers. The model is derived from packe races and models bidirecional raffic i.e. raffic from he web-clien o he web-server (requess) as well as raffic in he opposie direcion (responses). Choi e al. [10] developed an analyic behavioral model of web raffic. The parameers modelled are represened by analyic disribuion funcions which were chosen by means of applying he visual Quanile-Quanile plo echnique o daases. The parameers characerize he behavior of web users and model unidirecional raffic from he server o he clien. We briefly give an overview of Mah s model as i is closes in srucure and purpose o ours. Table I shows he parameers modelled by Mah. We use he word User hroughou his aricle o refer o a web user (person) making requess by using a Web Clien (browser sofware). User Size Web Clien Size User Response Size Web Clien Response Size Number of Web Clien s Think Time Consecuive Documen Rerievals per Server Server Populariy TABLE I MAH PARAMETERS MODELLED During a simulaion raffic is generaed according o Mah s model as follows: 1) A web server is seleced according o he Server Populariy able (Table conaining relaive populariy of servers). 2) A period of lengh called Think Time elapses. 3) A User clicks on a web-page generaing a reques of size User Size, which is sen o he web server. 4) The web server receives he reques, and responds wih a documen of size User Response Size. 5) The Web Clien receives he response, and responds by generaing a number of requess equal o Number of Web Clien s, each of size Web Clien Size. 6) The web server receives each of he requess, and responds wih a documen of size Web Clien Response Size for each reques. 7) The process reurns o Sep 2 and repeas Consecuive Documen Rerievals per Server number of imes before a new server is chosen in Sep 1 I should be noed ha he model does no represen inerarrival imes. Inerarrival imes are influenced in par by TCP flow conrol and congesion conrol algorihms. These algorihms depend on he laency and bandwidh of he nework environmen ha he web clien and servers are in. Also, he web proxy cache server/s beween he web clien and server have differen cache managemen algorihms which affec inerarrival imes. Any measuremens of inerarrival imes will be affeced by hese facors. A simulaion of web raffic using Mah s model will have o include a simulaion of he acual TCP algorihms as well as he web proxy caching algorihms. III. WORKLOAD MODEL As menioned before, he workload model is similar o he one developed by Mah [9]. I is bidirecional and herefore differeniaes beween User and Web Clien s, and User and Web Clien Responses. The model is layered, and is shown in Figure 1. BS : Browsing Session Web WR : UReq : User UResp : User Response CReq : Web Clien CResp : Web Clien Response Web Dialogue Fig. 1. Browsing Session Arrival Process Web Arrival Process Clien Side Server Side UReq WR BS BS BS UResp WR CReq CReq CReq CResp CResp WR CResp Layered Web Browsing Workload Model The Browsing Session Layer models he ime during which a user browses he web. We chose a 15 minue period of inaciviy o signal he end of a Browsing Session. We chose 15 minues as an indicaor of he end of a Browsing Session as we observed ha mos users do no spend more han 15 minues on reading a single web page, hey eiher reques anoher page or sop browsing. The Web Layer models requess for web documens. A web documen is composed of a exual HTML file and he graphical images displayed along wih he ex.

3 The Web Dialogue Layer shows an example of a ypical ineracion beween a web clien and server during a Web. The arrows in Figure 1 indicae when a reques or response is sen, and he size of a box indicaes he size of he file and hence he ransmission ime of he file. A response is sen immediaely afer a file is received on eiher side. A ypical scenario is for a user o reques an HTML file. On arrival a he server side, he server responds o he reques by sending he requesed file o he clien. The clien responds by sending requess for all he graphical objecs ha needs o be displayed along wih he ex. On arrival a he server side, he server responds o he requess by sending he requesed files o he clien. The parameers we model are displayed in Table II. Browsing Iner-Session Time Number of Web s per Session Web Inerarrival Time User Size Web Clien Size Web Clien Inerarrival Time User Response Size Number of Web Clien Responses Web Clien Response Size TABLE II PARAMETERS MODELLED The Browsing Iner-Session Time is he ime beween he end of one Browsing Session and he sar of anoher. The Web Inerarrival Time and Web Clien Inerarrival Time are he only inerarrival ime parameers modelled. As menioned in Secion II, i is no advisable o use inerarrival imes measured on he Inerne in raffic models due o he influence ha differen nework environmens have on inerarrival imes. However, we will show in Secion IV ha he environmen in which we ook our measuremens had no undue influence on he Web Inerarrival Time and Web Clien Inerarrival Time parameers. IV. DATA MEASUREMENT METHODOLOGY There are generally hree mehods of obaining web raffic daa, and hey have been used in various sudies. They are: Server Logs [11], Clien Logs [7], and Packe Traces [9], [12]. Web Server Logs are very useful for analyzing he workload of a specific web server. They are no appropriae for our work as i is an impossible ask o analyze all he server logs visied by a specific user during a browsing session. Clien Logs are creaed by cusomising web browser sofware o wrie logfiles of required daa. This approach suis our needs as i provides exacly he daa we require. The browser used by mos people a he universiy is Microsof Explorer, and as we canno make changes o his sofware, his mehod is also impossible for us o implemen. Packe Traces are obained by recording daa from a shared medium such as an Eherne LAN. The recorded daa are used o reconsruc he browsing sessions of individuals browsing he web. The advanage of his approach is ha a large sample of user daases can be obained relaively easily. The disadvanage is ha unlike clien logs he required daa have o be obained by reconsrucing browsing sessions, from someimes incomplee daa, using heurisic mehods. As he firs mehod is inappropriae for our needs, and he second oo difficul o implemen, we chose o use packe races o obain web raffic daases. We developed a daa capuring ool, similar o he Bi-Layer Tracing ool [13], o use for collecing packe races. The ool exracs daa from Nework, Transpor and Applicaion Layer packe headers and wries i o logfile. Table III shows which daa is exraced by he ool. Daa IP address of browsing hos TCP por of browsing hos ed URL Referer URL Conen-Lengh of Conen-Lengh of Response Conen-Type field Arrival ime Proocol Header IP TCP IP, TCP and TABLE III DATA EXTRACTED FROM IP, TCP AND HEADERS The arrival ime daa is measured by he sysem clock. The ool is implemened in C using he Linux Socke Filer (LSF). The Linux Socke Filer filers packes in Kernel Space. Packes meeing filer crieria are passed o User Space while all oher packes are discarded. All processing by he TCP/IP sack is herefore avoided. The performance gain of using kernel space filering enabled us o measure raffic on a 100Mbs link. The ool is implemened for boh Inel and SPARC archiecures. We insrumened wo machines wih he daa capuring ool and placed hem a he Trace Collecion Poins on he campus nework as illusraed in Figure 2. The posiion of he machines on he nework ensured ha all requess from and responses o universiy sudens and saff browsing he web were capured. We capured raffic generaed by hoss over a 1 monh long period. The measuremen machines were synchronized by means of he Nework Time Proocol (NTP) [14]. Synchronizaion was necessary as daa capured by he machines were merged ino one daase. The resulan daase was used for analysis. Some pars of he analysis required accuracy in he order of hundreds of milliseconds. The machines clocks were synchronized o wihin ens of milliseconds of each anoher. The parameer Web Clien Inerarrival Times is measured in microseconds, which would cause a problem during he merging of daases. Luckily all Web Clien s in a se are always sen o he same proxy machine, and he analysis is herefore no affeced by he merging process.

4 Campus Nework Swich Trace Collecion Poin Trace Collecion Fig. 2. Poin Proxy Proxy Nework Configuraion Gaeway Rouer Inerne As menioned in Secion III, he Web Inerarrival Time and Web Clien Inerarrival Time are he only inerarrival ime parameers we model. These parameers model he ime beween web user clicks and web clien iniiaed requess for graphics files respecively. They are no inrinsically linked o nework behaviour, and if in fac we had been able o insrumen all he web browsers a he universiy, we would have been able o measure hese parameers wihou any influence by nework condiions. As Figure 2 however shows, our measuremen machines were placed on he nework. This means ha he ime i akes for a packe o ravel from a web user s hos on he universiy campus nework o he measuremen machine would influence he measuremens of hese variables. The universiy campus nework however has a fiber opic backbone wih capaciy of 100Mbs. The uilizaion on his nework is very low, beween 15% and 20% on average, and very seldomly higher han 25%, which resuls in low laency and variabiliy of laency beween users on he campus nework and he measuremen machines. We herefore measure daa for hese parameers a he Trace Collecion Poins. V. DATA PROCESSING As menioned in Secion IV, he daases obained by means of a packe race do no conain direc informaion abou he 9 modelled parameers shown in Table II. The challenge we faced was o use he informaion conained in he daases as shown in Table III, o obain he informaion shown in Table II. We used heurisic mehods o obain bes-guess values for he 9 parameers. The mehods were implemened in a Daa Exracion Program which exracs daases for he 9 parameers from he 5051 daases. There are hree main problems he Daa Exracion Program has o solve: The User vs. Web Clien Differeniaion Problem: Is a reques a User or Web Clien? I.e did a person or web browser generae he reques? All furher exracion depends on he answer o his quesion. For insance, i would no be possible o decide when a new Web is made, or when a new Browsing Session sars wihou knowing wheher a reques was generaed by a User or Web Clien. The Web Clien Maching Problem: Howdowe mach Web Clien s found in he daases o he correc User s responsible for hem? I.e. which User is responsible for he generaion of a specific se of Web Clien s? The Web Clien Inerarrival Time and Number of Web Clien Responses parameers are dependen on he correc machings. The Response Maching Problem: How do we mach response packes o he GET reques packes which requesed hem? The informaion obained by solving his problem is used in he soluion of he previous wo problems. The informaion also enables us o dispose of TCP connecions, and he daa associaed wih hese connecions, which erminaed abnormally. A. User vs. Web Clien Differeniaion Algorihm The differeniaion algorihm is heurisic. By sudying he measured web raffic, we idenified a se of reques characerisics, each of which implies ha a reques is a Web Clien. The characerisics we idenified are based on he following properies of requess: ffl ed URL ffl Referer URL ffl Type of reques ffl Inerarrival ime beween requess The ed and Referer URL s are recorded in he daases and he Inerarrival ime beween requess can be calculaed from values in he daases. The Type of reques can be inferred from he file exension of he ed URL. We disinguish beween he following ypes of requess: HTML: s for files wih HTML conen i.e. files wih he following exensions:.hml,.js,.cgi,.php,.asp,.pl,.cfm,.vbs and.css GRAPHICS: s for graphics files i.e. files wih he following exensions:.gif,.jpg,.png and.jpeg OTHER: s for all oher files The lis of reques characerisics we idenified is long, and is herefore no lised here. We lis wo of he characerisics in Table IV. No. Descripion 1 A GRAPHICS reques wih a Referer URL maching he ed URL of a preceding HTML reques is a Web Clien 2 A GRAPHICS reques wih a Referer URL maching ha of any oher reques preceding i by a mos 10 seconds is a Web Clien TABLE IV REQUEST CHARACTERISTICS A reques is caegorized by maching is properies o hose of each enry in he lis of characerisics. If i maches an enry,

5 i is caegorized as a Web Clien, if i doesn mach a single enry, i is caegorized as a User. Characerisic No. 1 in Table IV follows inuiively from he ineracion beween a web-clien and web-server i.e. a requesed HTML page usually generaes several requess for graphics files. Characerisic No. 2 follows from he observaion ha images making up a web-page are downloaded in quick succession o one anoher. Figure 3 shows he implemenaion of Characerisic No. s 1 and 2. if(his fileype == GRAPHICS) /* Characerisic No. 1 */ for(all previous requess in hml reques queue) if(his referer url == prev reques url)f his caegory = Web Clien break g else if(file has no been classified ye) /* Characerisic No. 2 */ if(his fileype == GRAPHICS) for(all previous requess in all reques queue) if(arrival ime difference > 10) break else if(his referer url == prev referer url)f his caegory = Web Clien break g Fig. 3. Implemenaion of Characerisic No. s 1 and 2 The all reques queue in Figure 3, is a queue which sores properies of all previous requess (i.e. HTML, GRAPHICS and OTHER requess). The hml reques queue is a queue which sores properies of only HTML requess. The code in Figure 3 for Characerisic No. 1 does he following: I loops hrough all he requess in he hml reques queue. If for any one of hese he URL maches he Referer URL of he curren reques, we caegorize he curren reques as being a Web Clien. We esed he algorihm by capuring web raffic generaed by ourselves, whils keeping rack of he URL s we requesed. We processed he measured daa using he Daa Exracion Program, and compared he resuls wih he records we kep during he es. The program performed exremely well, i correcly caegorized all requess excep for requess issued from pop-up windows opened by some web pages. B. Web Clien Maching Problem This problem is parially solved in he process of solving he User vs. Web Clien Differeniaion Problem. Minor addiions o he program can keep rack of which User generaed a paricular Web Clien. We herefore won discuss his problem any furher here. C. Response Maching Problem The maching of responses o GET requess is difficul as an header conains no informaion associaing a paricular response wih a paricular reques. The problem was solved by using our knowledge of how uses TCP connecions. requess are pipelined on a TCP connecion, meaning ha muliple requess are made wihou waiing for responses o reurn. Responses reurn in he same sequence as requess made. If we keep rack of all GET requess made on all TCP connecions we can mach responses o requess. We use a queue o keep rack of GET requess on a TCP connecion. New requess are added o he ail of he queue, and requess are removed from he head of he queue, and mached o incoming responses. We mainain a queue for every TCP connecion opened by a hos. We recorded SYN, FIN and RST flags in our daa. These flags ell us when a TCP connecion is opened, closed and erminaed abnormally. We open a TCP connecion queue everyime a SYN flag is encounered in a daase, and close he queue if a FIN or RST packe is encounered on ha connecion. Whils a TCP connecion queue is open we add GET requess o i as hey occur in he daase. When a response arrives, we mach i o he GET reques a he head of he queue, and remove he reques from he queue. VI. STATISTICAL METHODOLOGY We will find analyic disribuions o represen each of he nine parameers of our workload model. By analyic disribuion we mean boh he family of he disribuion e.g. normal or exponenial, and he parameers associaed wih his family e.g. locaion and scale. We use he following visual echniques o uncover characerisics of he daa ha are suggesive of underlying mahemaical properies: 1) The Hisogram 2) The Empirical Cumulaive Disribuion Funcion 3) The Log Empirical Complemenary Cumulaive Disribuion Funcion 4) The Probabiliy Plo We use goodness-of-fi echniques o es inferences suggesed by visual analysis, and o quanify he evidence suggesed by visual analysis. We use he Anderson Darling es and he 2 discrepancy measure. We use boh measures as he Anderson Darling es is more accurae han he 2 discrepancy measure for small daases, bu canno be used for very large daases [15], [8]. The 2 discrepancy measure as defined by Pederson e al. [16] is a binning echnique based on he χ 2 goodness-of-fi saisic. The Anderson Darling es is based on he empirical disribuion funcion (EDF) [17]. EDF ess are generally more powerful han hose based on binning echniques such as χ 2 ypes of ess. VII. PRELIMINARY RESULTS We compleed he analysis of he Browsing Iner-Session Time parameer. The visual analysis as well as he Anderson Darling es showed ha he Weibull disribuion provides he bes fi for mos of he 2526 daases under es. 74% Of he daases passed he Anderson Darling es a a 5% significance level. Figure 4 shows Weibull probabiliy plos for 2 randomly seleced daases.

6 Z Values Plo No Fig. 4. Log(In. Times) Z Values Plo No Log(In. Times) Weibull probabiliy plos for 2 of he daases The regression saisics for he sraigh lines fied o he Weibull probabiliy plos are shown in Table V. Plo No. R 2 Sd. Error of Esimae TABLE V LEAST SQUARES REGRESSION RESULTS FOR WEIBULL PROBABILITY PLOTS I is clear from Table V ha he Weibull disribuion is a very good fi o he daases. The shape and scale parameers for he Weibull disribuion were esimaed using Maximum Likelihood Esimaion as being: shape = 0:815 and scale = 60:51. VIII. CONCLUSION There is a need for deailed web workload models in he simulaion field. The characerizaion of relevan parameers for such models depends on he acquisiion of reliable, relevan and recen raffic measuremens. Such measuremens are ofen no easily obainable. We found ha freely available raffic measuremen sofware don provide he funcionaliy necessary for aking specialized measuremens such as ours. Wih he help of he Linux Socke Filer, and cusom wrien sofware using a heurisic algorihm we were able o obain he necessary daa. The analysis of daa raffic ofen involves analyzing very large daases. Common saisical ess such as he Anderson Darling es are no suiable for analyzing large daases. We have implemened boh he Anderson Darling es and he 2 discrepancy measure, which can be used o analyze large daases. We used his mehodology, assised by he relevan visual echniques, o obain he bes-fi disribuion for one of our model parameers. We will find analyic disribuions for he remaining eigh parameers, and implemen he model as a raffic generaion module in he ns simulaion package. We will validae he model by esing generaed raffic for bursiness and selfsimilariy, as well as comparing i o characerisics of measured raffic obained independenly from he raffic he model was derived from. REFERENCES [1] W. Willinger, V. Paxson, and M. S. Taqqu, Self-similariy and Heavy Tails: Srucural Modeling of Nework Traffic, in A Pracical Guide o Heavy Tails: Saisical Techniques and Applicaions, R. J. Adler, R. E. Feldman, and M. S. Taqqu, Eds. Boson: Birkhauser, [2] J. Heidemann, K. Obraczka, and J. Touch, Modeling he performance of over several ranspor proocols, IEEE/ACM Transacions on Neworking, vol. 5, no. 5, pp , Ocober [3] D. Saehle, K. Leibniz, and K. Tsipois, QoS of inerne access wih GPRS, in Proceedings of he 4h ACM inernaional workshop on Modeling, analysis and simulaion of wireless and mobile sysems. Rome, Ialy: ACM Press, 2001, pp [4] R. Kalden, I. Meirick, and M. Meyer, Wireless Inerne Access Based on GPRS, IEEE Personal Communicaions, vol. 7, no. 2, pp. 8 18, April [5] W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson, On he Self- Similar Naure of Eherne Traffic, in ACM SIGCOMM, D. P. Sidhu, Ed., San Francisco, California, 1993, pp [6] M. E. Crovella and A. Besavros, Self-Similariy in World Wide Web Traffic: Evidence and Possible Causes, in Proceedings ACM SIG- METRICS 1996: The ACM Inernaional Conference on Measuremen and Modeling of Compuer Sysems, Philadelphia, Pennsylvania, May 1996, pp , also, in Performance evaluaion review, May 1996, 24(1): [7] C. Cunha, A. Besavros, and M. E. Crovella, Characerisics of World Wide Web Clien-based Traces, Boson Universiy, CS Dep, Boson, MA 02215, Tech. Rep. BUCS-TR , April [Online]. Available: hp:// [8] P. Barford and M. Crovella, Generaing Represenaive Web Workloads for Nework and Server Performance Evaluaion, in Performance 1998/ACM SIGMETRICS 1998, 1998, pp [9] B. A. Mah, An Empirical Model of Nework Traffic, in 17h IEEE InfoComm Conference, April [10] H. Choi and J. Limb, A Behavioural Model of Web Traffic, in 7h Inernaional Conference on Nework Proocols (ICNP 1999), Torono, Canada, Ocober [11] M. F. Arli and C. L. Williamson, Web Server Workload Characerizaion: The Search for Invarians, in Measuremen and Modeling of Compuer Sysems, 1996, pp [12] A. Reyes-Lecuona, E. Gonzalez-Parada, E. Casilari, J. C. Casasola, and A. Diaz-Esrella, A page-oriened WWW raffic model for wireless sysem simulaions, in 16h Inernaional Teleraffic Congress(ITC16), D. Smih and P. Key, Eds., Edinburgh, June 1999, pp [13] A. Feldmann, BLT: Bi-Layer Tracing of and TCP/IP, WWW9/ Compuer Neworks, vol. 33, no. 1-6, pp , [Online]. Available: cieseer.nj.nec.com/ hml [14] D. Mills, RFC 1305: Nework Time Proocol, March 1992, Draf Sandard. [15] V. Paxson, Empirically-Derived Analyic Models of Wide-Area TCP Connecions, IEEE/ACM Transacions on Neworking, pp , Augus [16] S. P. Pederson and M. E. Johnson, Esimaing Model Discrepancy, TECHNOMETRICS, vol. 32, pp , [17] M. A. Sephens, Tess Based on EDF Saisics, STATISTICS: exbooks and monographs, vol. 68, pp , Lourens Walers received his BA degree in Hisory and BSc Hons degree in Compuer Science a he Universiy of Cape Town, in 1998 and 1999 respecively, and is currenly working owards he MSc degree. Pieer Krizinger has a Phd in Compuer Science from he Universiy of Waerloo in Canada and is a full professor in he Compuer Science Deparmen a he Universiy of Cape Town.