• Journal of Korea Multimedia Society
• /
• v.9 no.5
• /
• pp.635-648
• /
• 2006

As the advances of Internet infra structure and the support of console and mobile for network games, the industry of online game has been growing rapidly, and the online game traffic in the Internet has been increasing steadily. For design and simulation of game network, the analysis of online game traffic have to be preceded. Therefore a number of papers have been proposed for the purpose of analyzing the traffic data of network games and providing the models. We make and use GameNet Analyzer as a dedicated tool for game traffic measurement and analysis in this paper. We measure the traffic of FPS Quake 3, RTS Starcraft and MMORPG World of Warcraft (WoW), and analyze the packet size, packet IAT(inter-arrival time), data rate and packet rate according to the number of players and in-game behaviors. We also present the traffic models using measured traffic data. These analysis and models of game traffic can be used for effective network simulation, performance evaluation of game network and the design of online games.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10e
• /
• pp.280-282
• /
• 2002

최근 업무 전산화로 인한 분산 컴퓨팅 환경이 확대되고 네트워크 기반의 응용 서비스들이 다양하게 개발됨에 따라 네트워크 트래픽은 증가 일로에 있으며 어느 호스트에서 어떤 형태의 트래픽이 얼마만큼 유발되는지를 알아내는 일은 한정된 네트워크 자원을 효율적으로 활용하는데 매우 중요한 일이 되었다. 하지만, 현재의 네트워크관리시스템들은 트래픽 모니터링에 따른 통계값 제공 등의 단순 평면적인 정보만을 제공할 뿐, 네트워크를 정밀 분석하고 그에 따른 대책을 마련하기에는 미약하다. 따라서 효율적인 네트워크 자원 활용을 위하여 네트워크 트래픽을 자세히 분석하며, 네트워크 계층별, 지역별, 호스트별 및 응용 서비스 별로 트래픽을 측정 및 분석할 수 있는 시스템의 개발이 필요하다. 본 논문은 한국전력데이터통신망을 대상으로 네트워크 트래픽의 발원지로부터 목적지까지의 백본 및 LAN 구간에서의 트래픽을 플로우별로 수집, 분석할 수 있는 트래픽 분석 시스템을 설계 및 구현하였다본 시스템은 트래픽 측정을 위해 백본에서는 Netflow 기능을 이용하며, LAN 구간에서는 패킷 캡처 방식의 Probe를 이용한다. 이때 기존의 패킷 캡처 방식의 기능을 개선하여 이를 플로우화 함으로써 LAN구간에서도 동일한 인터페이스를 통하여 네트워크 트래픽을 분석할 수 있게 하였다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.2B
• /
• pp.279-288
• /
• 2004

Rapidly emerging P2P(Peer to Peer) applications generate very bursty traffic, which gives a lot of burden to network, and the amount of such traffic is increasing rapidly. Thus it is becoming more important to understand the characteristics of such traffic and reflect it when we design and analyze the network. To do that we measured the traffic in a campus network and present flow statistics and traffic models of the measured traffic, and compare them with those of the web traffic. The results indicate that P2P traffic is much burstier than web traffic and as a result it negatively affects network performance. We modeled P2P traffic using self-similar traffic model to predict packet delay and loss occurred in network which are very important to evaluate network performance. We also predict queue length distribution and loss probability in SSQ(Single Sewer Queue). To assess accuracy of traffic model, we compare the SSQ statistics of traffic models with that of the traffic trace. The results show that self-similar traffic models we use can predict P2P traffic behavior in network precisely. It is expected that the traffic models we derived can be used when we design network capacity and predict network performance and QoS of the P2P applications.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.23 no.8
• /
• pp.1907-1914
• /
• 1998

This paper proposes the adaptive connection admission cotrol using the variale MRR(measurement reflection ratio) and the distribution of the number of cells arriving during the fixed interval. This distribution is estimated from the measured number of cells arriving at the output buffer during the fixed interval and traffic parameters specified by user. MRR is varied by the difference of estimated distribution and measurement distribution. As MRR is adaptively varied by estimated distribution error of accepted connections, it quickly reduces estimation error. Also, the scheduling scheme is proposed for multiplexed traffic with various traffic characteristics. For each traffic class, this scheme estimates adaptively equivalent bandwidth and schedules according to equivalent bandwidth ratio of each traffic class, so it improves cell loss rate and link utilization.

• Journal of Internet Computing and Services
• /
• v.5 no.4
• /
• pp.23-33
• /
• 2004

In this paper, we propose a novel traffic measurement based detection of network attack symptoms on high speed Internet backbone links. In order to do so, we characterize the traffic patterns from the normal and the network attacks appeared on Internet backbone links, and we derive two efficient measures for representing the network attack symptoms at aggregate traffic level. The two measures are the power spectrum and the ratio of packet counts to traffic volume of the aggregate traffic. And, we propose a new methodology to detect networks attack symptoms by measuring those traffic measures. Experimental results show that the proposed scheme can detect the network attack symptoms very exactly and quickly. Unlike existing methods based on Individual packets or flows, since the proposed method is operated on the aggregate traffic level. the computational complexity can be significantly reduced and applicable to high speed Internet backbone links.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.05a
• /
• pp.637-638
• /
• 2017

The MQTT broker has problems such as packet loss and delay due to degraded network performance according to traffic. However, the MQTT broker does not support a separate interface for traffic measurement, so it can not cope with network degradation. In this paper, we propose a system for traffic measurement of MQTT broker. The proposed system uses the jnetpcap library to measure all traffic to and from the MQTT broker.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.41 no.5
• /
• pp.37-45
• /
• 2004

As Internet technologies are mature, many new applications that are different characteristics are emerging. Recently we see wide use of P2P(Peer to Peer) applications of which traffic shows different statistical characteristics compared with traditional application such as web(HTTP) and FTP(File Transfer Protocol). In this paper, we measured subscriber network of KT(Korea Telecom) to analyze P2P traffic characteristics. We show flow characteristics of measured traffic. We also estimate Hurst parameter of P2P traffic and compare self-similarity with web traffic. Analysis results indicate that P2P traffic is much bustier than web traffic and makes both upstream traffic and downstream traffic be symmetric. To predict parameters related QoS such as packet loss and delays we model P2P traffic using two self-similar traffic models and predict both loss probability and mm delay then compare their accuracies. With simulation we show that the self-similar traffic models we derive predict the performance of P2P traffic accurately and thus when we design a network or evaluate its performance, we can use the P2P traffic model as reference input traffic.

• The KIPS Transactions:PartC
• /
• v.18C no.4
• /
• pp.243-250
• /
• 2011

Nowadays, the traffic type and behavior are extremely diverse due to the appearance of various services on Internet, which makes the need of traffic identification important for efficient operation and management of network. In recent years traffic identification methodology using statistical features of flow has been broadly studied. We also proposed a traffic identification methodology using payload size distribution in our previous work, which has a problem of low completeness. In this paper, we improved the completeness by solving the PSD conflict using IP and port. And we improved the accuracy by changing the distance measurement between flow and statistic signature from vector distance to per-packet distance. The feasibility of our methodology was proved via experimental evaluation on our campus network.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.11B
• /
• pp.750-757
• /
• 2005

This paper reports on the study of P2P traffic behaviors in a high-speed campus network under a simple firewall which drops packets with default port numbers for the well-blown P2P applications. Among several ways of detecting P2P traffic, the easiest method is to filter out packets with the default port number of each P2P application. After deploying the port-based firewall against P2P-traffic, it is expected that the amount of P2P traffic will be decreased. However, during the eight-month measurement period, three new commercial P2P applications have been identified and their traffic usages have reached up to $30/5.6\%$ of the total outbound/inbound traffic volumes at the end of the measurement period. In addition, the most famous P2P application, eDonkey, has adapted and has escaped detection through port hopping. The measurement result shows that the amount of eDonkey traffic is around $6.7/4.0\%$ of the total outbound/inbound traffic volume. From the measurement results, it is observed that the port-based firewall is not effective to limit the usage of P2P applications and that the P2P traffic is steadily growing due to not only the evolution of existing P2P applications such as port hopping but also appearances of new P2P applications.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.11b
• /
• pp.1073-1076
• /
• 2003

인터넷 트래픽은 폭발적으로 증가하고 있으며, 이에 따라 QoS를 보장하기 위한 여러 연구들이 진행되고 있다. 인터넷 트래픽에 대한 연구가 진행됨에 따라 자기 유사성을 가지며, 기존의 poisson을 이용한 모델링은 실제 트래픽과 차이가 있음이 밝혀졌다. 또한, 인터넷 트래픽은 burstiness 성질을 상당히 가지고 있으며, 이는 관측 시간간격에 크게 영향을 받지 않는 것으로 나타난다. 본 논문에서는 이러한 트래픽의 burstiness 성질을 이용한 트래픽 측정 방법을 제시하였다.