14.9. 14.9 Appendix A

14.9.1. 14.9.1 Measurements for link utilisation

The following charts demonstrate that even though the average link utilisation for the various Hurst parameters is almost identical, the frequency and the size of the peaks increase with the burstiness, causing cell drops in routers and switches. The utilisation is expressed in the [0, 1] scale not in percentages:

Figure 14.40.  Utilisation of the frame relay link for fixed size messages.

Utilisation of the frame relay link for fixed size messages.

Figure 14.41.  Utilisation of the frame relay link for Hurst parameter Utilisation of the frame relay link for Hurst parameter H=0.55 ..

Utilisation of the frame relay link for Hurst parameter H=0.55 .

Figure 14.42.  Utilisation of the frame relay link for Hurst parameter Utilisation of the frame relay link for Hurst parameter H=0.95 (many high peaks). (many high peaks).

Utilisation of the frame relay link for Hurst parameter H=0.95 (many high peaks).

14.9.2. 14.9.2 Measurements for message delays

Figures 14.4314.45 illustrate the relation between response time and various Hurst parameters:

Figure 14.43.  Message delay for fixed size message.

Message delay for fixed size message.

Figure 14.44.  Message delay for Message delay for H=0.55 (longer response time peaks). (longer response time peaks).

Message delay for H=0.55 (longer response time peaks).

Figure 14.45.  Message delay for Message delay for H=0.95 (extremely long response time peak). (extremely long response time peak).

Message delay for H=0.95 (extremely long response time peak).


14.9-1 Name some attributes, events, activities and state variables that belong to the following concepts:

  • Server

  • Client

  • Ethernet

  • Packet switched network

  • Call set up in cellular mobile network

  • TCP Slow start algorithm

14.9-2 Read the article about the application of the network simulation and write a report about how the article approaches the validation of the model.

14.9-3 For this exercise it is presupposed that there is a network analyser software (e.g., LAN Analyzer for Windows or any similar) available to analyse the network traffic. We use the mentioned software thereinafter.

  • Let's begin to transfer a file between a client and a server on the LAN. Observe the detailed statistics of the utilisation of the datalink and the number of packets per second then save the diagram.

  • Read the Capturing and analysing Packet chapter in the Help of LAN Analyzer.

  • Examine the packets between the client and the server during the file transfer.

  • Save the captured trace information about the packets in .csv format. Analyse this file using spreadsheet manager. Note if there are any too long time intervals between two packets, too many bad packets, etc. in the unusual protocol events.

14.9-4 In this exercise we examine the network analysing and baseline maker functions of the Sniffer. The baseline defines the activities that characterise the network. By being familiar with this we can recognise the non-normal operation. This can be caused by a problem or the growing of the network. Baseline data has to be collected in case of typical network operation. For statistics like bandwidth utilization and number of packets per second we need to make a chart that illustrates the information in a given time interval. This chart is needed because sampled data of a too short time interval can be false. After adding one or more network component a new baseline should be made, so that later the activities before and after the expansion can be compared. The collected data can be exported to be used in spreadsheet managers and modelling tools, that provides further analysing possibilities and is helpful in handling gathered data.

Sniffer is a very effective network analysing tool. It has several integrated functions.

  • Gathering traffic-trace information for detailed analysis.

  • Problem diagnosis with Expert Analyzer.

  • Real-time monitoring of the network activities.

  • Collecting detailed error and utilization statistics of nodes, dialogues or any parts of the network.

  • Storing the previous utilization and fault information for baseline analysis.

  • When a problem occurs it creates visible or audible alert notifications for the administrators.

  • For traffic simulation monitoring of the network with active devices, measuring the response time, hop counting and faults detection.

  • The Histroy Samples option of the Monitor menu allows us to record the network activities within a given time interval. This data can be applied for baseline creation that helps to set some thresholds. In case of non-normal operation by exceeding these thresholds some alerts are triggered. Furthermore this data is useful to determine the long-period alteration of the network load, therefore network expansions can be planned forward.

  • Maximum 10 of network activities can be monitored simultaneously. Multiple statistics can be started for a given activity, accordingly short-period and long-period tendencies can be analysed concurrently. Network activities that are available for previous statistics depends on the adapter selected in the Adapter dialogue box. For example in case of a token ring network the samples of different token ring frame types (e.g, Beacon frames), in Frame Relay networks the samples of different Frame Relay frame types (e.g, LMI frames) can be observed. The available events depend on the adapter.


  • Set up a filter (Capture/Define filter) between your PC and a remote Workstation to sample the IP traffic.

  • Set up the following at the Monitor/History Samples/Multiple History: Octets/sec, utilization, Packets/sec, Collisions/sec and Broadcasts/sec.

  • Configure sample interval for 1 sec. (right click on the Multiple icon and Properties/Sample).

  • Start network monitoring (right click on the Multiple icon and Start Sample).

  • Simulate a typical network traffic, e.g, download a large file from a server.

  • Record the “Multiple History” during this period of time. This can be considered as baseline.

  • Set the value of the Octets/sec tenfold of the baseline value at the Tools/Options/MAC/Threshold. Define an alert for the Octets/sec: When this threshold exceeded, a message will be sent to our email address. On Figure 14.46 we suppose that this threshold is 1,000.

    Figure 14.46.  Settings.


  • Alerts can be defined as shown in Figure 14.47.

    Figure 14.47.  New alert action.

    New alert action.

  • Set the SMTP server to its own local mail server (Figure 14.48).

    Figure 14.48.  Mailing information.

    Mailing information.

  • Set the Severity of the problem to Critical (Figure 14.49).

    Figure 14.49.  Settings.


  • Collect tracing information (Capture/Start) about network traffic during file download.

  • Stop capture after finished downloading (Capture/Stop then Display).

  • Analyse the packets' TCP/IP layers with the Expert Decode option.

  • Check the “Alert message” received from Sniffer Pro. Probably a similar message will be arrived that includes the octets/sec threshold exceeded:

From: ...

Subject: Octets/s: current value = 22086, High Threshold = 9000 To: ...

This event occurred on ...

Save the following files:

  • The “Baseline screens”

  • The Baseline Multiple History.csv file

  • The “alarm e-mail”.

14.9-5 The goal of this practice is to build and validate a baseline model using a network modelling tool. It's supposed that a modelling tool such as COMNET or OPNET is available for the modeller.

First collect response time statistics by pinging a remote computer. The ping command measures the time required for a packet to take a round trip between the client and the server. A possible format of the command is the following: ping hostname -n x -l y -w z ≥ filename where “x” is the number of packet to be sent, “y” is the packet length in bytes, “z” is the time value and “filename” is the name of the file that includes the collected statistics.

For example the ping -n 5 -l 64 ≥ c:

ping.txt command results the following file:

Pinging with 64 bytes of data:

Reply from bytes=64 time=178ms TTL=124

Reply from bytes=64 time=133ms TTL=124

Reply from bytes=64 time=130ms TTL=124

Reply from bytes=64 time=127ms TTL=124

Reply from bytes=64 time=127ms TTL=124

  • Create a histogram for these time values and the sequence number of the packets by using a spreadsheet manager.

  • Create a histogram about the number of responses and the response times.

  • Create the cumulative density function of the response times indicating the details at the tail of the distribution.

  • Create the baseline model of the transfers. Define the traffic attributes by the density function created in the previous step.

  • Validate the model.

  • How much is the link utilization in case of messages with length of 32 and 64 bytes?

14.9-6 It is supposed that a modelling tool (e.g., COMNET, OPNET, etc.) is available for the modeller. In this practice we intend to determine the place of some frequently accessed image file in a lab. The prognosis says that the addition of clients next year will triple the usage of these image files. These files can be stored on the server or on the client workstation. We prefer storing them on a server for easier administration. We will create a baseline model of the current network, we measure the link-utilization caused by the file transfers. Furthermore we validate the model with the correct traffic attributes. By scaling the traffic we can create a forecast about the link- utilization in case of trippled traffic after the addition of the new clients.

  • Create the topology of the baseline model.

  • Capture traffic trace information during the transfer and import them.

  • Run and validate the model (The number of transferred messages in the model must be equal to the number in the trace file, the time of simulation must be equal to the sum of the Interpacket Times and the link utilization must be equal to the average utilization during capture).

  • Print reports about the number of transferred messages, the message delays, the link utilization of the protocols and the total utilization of the link.

  • Let's triple the traffic.

  • Print reports about the number of transferred messages, the message delay, the link utilization of the protocols and the total utilization of the link.

  • If the link-utilization is under the baseline threshold then we leave the images on the server otherwise we move them to the workstations.

  • What is your recommendation: Where is better place to store the image files, the client or the server?

14.9-7 The aim of this practice to compare the performance of the shared and the switched Ethernet. It can be shown that transformation of the shared Ethernet to switched one is only reasonable if the number of collisions exceeds a given threshold.

a. Create the model of a client/server application that uses shared Ethernet LAN. The model includes 10Base5 Ethernet that connects one Web server and three group of workstations. Each group has three PCs, furthermore each group has a source that generates “Web Request” messages. The Web server application of the server responds to them. Each “Web Request” generates traffic toward the server. When the “Web Request” message is received by the server a “Web Response” message is generated and sent to the appropriate client.

  • Each “Web Request” means a message with 10,000 bytes of length sent by the source to the Web Server every Exp(5) second. Set the text of the message to “Web Request”.

  • The Web server sends back a message with the “Web Response” text. The size of the message varies between 10,000 and 100,000 bytes that determined by the Geo(10000, 100000) distribution. The server responds only to the received “Web Request” messages. Set the reply message to “Web Response”.

  • For the rest of the parameters use the default values.

  • Select the “Channel Utilization” and the (“Collision Stats”) at the (“Links Repor”).

  • Select the “Message Delay” at the (“Message + Response Source Report”).

  • Run the simulation for 100 seconds. Animation option can be set.

  • Print the report that shows the “Link Utilization”, the “Collision Statistics” and the report about the message delays between the sources of the traffic.

b. In order to reduce the response time transform the shared LAN to switched LAN. By keeping the clien/server parameters unchanged, deploy an Ethernet switch between the clients and the server. (The server is connected to the switch with full duplex 10Base5 connection.)

  • Print the report of “Link Utilization” and “Collision Statistics”, furthermore the report about the message delays between the sources of the traffic.

c. For all of the two models change the 10Base5 connections to 10BaseT. Unlike the previous situations we will experience a non-equivalent improvement of the response times. We have to give explanation.

14.9-8 A part of a corporate LAN consists of two subnets. Each of them serves a department. One operates according to IEEE 802.3 CSMA/CD 10BaseT Ethernet standard, while the other communicates with IEEE 802.5 16Mbps Token Ring standard. The two subnets are connected with a Cisco 2500 series router. The Ethernet LAN includes 10 PCs, one of them functions as a dedicated mail server for all the two departments. The Token Ring LAN includes 10 PC's as well, one of them operates as a file server for the departments.

The corporation plans to engage employees for both departments. Although the current network configuration won't be able to serve the new employees, the corporation has no method to measure the network utilization and its latency. Before engaging the new employees the corporation would like to estimate these current baseline levels. Employees have already complained about the slowness of download from the file server.

According to a survey, most of the shared traffic flown through the LAN originates from the following sources: electronic mailing, file transfers of applications and voice based messaging systems (Leaders can send voice messages to their employees). The conversations with the employees and the estimate of the average size of the messages provides the base for the statistical description of the message parameters.

E-mailing is used by all employees in both departments. The interviews revealed that the time interval of the mail sending can be characterised with an Exponential distribution. The size of the mails can be described with an Uniform distribution accordingly the mail size is between 500 and 2,000 bytes. All of the emails are transferred to the email server located in the Ethernet LAN, where they are be stored in the appropriate user's mailbox.

The users are able to read messages by requesting them from the email server. The checking of the mailbox can be characterised with a Poisson distribution whose mean value is 900 seconds. The size of the messages used for this transaction is 60 bytes. When a user wants to download an email, the server reads the mailbox file that belongs to the user and transfers the requested mail to the user's PC. The time required to read the files and to process the messages inside can be described with an Uniform distribution that gathers its value from the interval of 3 and 5 seconds. The size of the mails can be described with a normal distribution whose mean value is 40,000 bytes and standard deviation is 10,000 bytes.

Both departments have 8 employees, each of them has their own computer, furthermore they download files from the file server. Arrival interval of these requests can be described as an Exponential distribution with a mean value of 900 ms. The requests' size follows Uniform distribution, with a minimum of 10 bytes minimum and a maximum of 20 bytes. The requests are only sent to the file server located in the Token Ring network. When a request arrives to the server, it read the requested file and send to the PC. This processing results in a very low latency. The size of the files can be described with a normal distribution whose mean value is 20,000 bytes and standard deviation is 25,000 bytes.

Voice-based messaging used only by the heads of the two departments, sending such messages only to theirs employees located in the same department. The sender application makes connection to the employee's PC. After successful connection the message will be transferred. The size of these messages can be described by normal distribution with a mean value of 50,000 bytes and a standard deviation of 1,200 bytes. Arrival interval can be described with a Normal distribution whose mean value is 1,000 seconds and standard deviation is 10 bytes.

TCP/IP is used by all message sources, and the estimated time of packet construction is 0.01 ms.

The topology of the network must be similar to the one in COMNET, Figure 14.50.

Figure 14.50.  Network topology.

Network topology.

The following reports can be used for the simulation:

  • Link Reports: Channel Utilization and Collision Statistics for each link.

  • Node Reports: Number of incoming messages for the node.

  • Message and Response Reports: The delay of the messages for each node.

  • Session Source Reports: Message delay for each node.

By running the model, a much higher response time will be observed at the file server. What type of solution can be proposed to reduce the response time when the quality of service level requires a lower response time? Is it a good idea to set up a second file server on the LAN? What else can be modified?


Law and Kelton's monography [ 217 ] provides a good overview about the network systems e.g. we definition of the networks in Section 14.1 is taken from it. About the classification of computer networks we propose two monography, whose authors are Sima, Fountain és Kacsuk [ 304 ], and Tanenbaum [ 313 ].

Concerning the basis of probability the book of Alfréd, Rényi [ 286 ] is recommended. We have summarised the most common statistical distribution by the book of Banks et al. [ 29 ]. The review of COMNET simulation modelling tool used to depict the density functions can be found in two publications of CACI (Consolidated Analysis Centers, Inc.) [ 53 ], [ 186 ].

Concerning the background of mathematical simulation the monography of Ross [ 291 ], and concerning the queueing theory the book of Kleinrock [ 200 ] are useful.

The definition of channel capacity can be found in the dictionaries that are available on the Internet [ 173 ], [ 340 ]. Information and code theory related details can be found in Jones and Jones' book [ 187 ].

Taqqu and Co. [ 220 ], [ 317 ] deal with long-range dependency.

Figure 14.1 that describes the estimations of the most common distributions in network modelling is taken from the book of Banks, Carson és Nelson könyvéből [ 29 ].

The OPNET software and its documentation can be downloaded from the address found in [ 259 ]. Each phase of simulation is discussed fully in this document.

The effect of traffic burstiness is analysed on the basis of Tibor Gyires's and H. Joseph Wenn's articles [ 151 ], [ 152 ].

Leland and Co., Crovella and Bestavros [ 77 ] report measurements about network traffic.

The self-similarity of networks is dealt by Erramilli, Narayan and Willinger [ 99 ], Willinger and Co. [ 344 ], and Beran [ 37 ]. Mandelbrot [ 234 ], Paxson és Floyd [ 267 ], furthermore the long-range dependent processes was studied by Mandelbrot and van Ness [ 235 ].

Traffic routing models can be found in the following publications: [ 17 ], [ 160 ], [ 180 ], [ 241 ], [ 253 ], [ 254 ], [ 266 ], [ 344 ].

Figure 14.22 is from the article of Listanti, Eramo and Sabella [ 224 ]. The papers [ 38 ], [ 92 ], [ 147 ], [ 267 ] contains data on traffic. Long-range dependency was analysed by Addie, Zukerman and Neame [ 5 ], Duffield and O'Connell [ 91 ], and Narayan and Willinger [ 99 ]. The expression of black box modelling was introduced by Willinger and Paxson [ 342 ] in 1997.

Information about the principle of Ockham's Razor can be found on the web page of Francis Heylighen [ 164 ]. More information about Sniffer is on Network Associates' web site [ 239 ].

Willinger, Taqqu, Sherman and Wilson [ 343 ] analyse a structural model. Crovella and Bestavros [ 77 ] analysed the traffic of World Wide Web.

The effect of burstiness to network congestion is dealt by Neuts [ 253 ], and Molnár, Vidács, and Nilsson [ 248 ].

The pareto-model and the effect of the Hurst parameter is studied by Addie, Zukerman and Neame [ 5 ]. The Benoit-package can be downloaded from the Internet [ 326 ].