Joel Halpern, Newbridge

Position Statement for
NSF Workshop on Internet Statistics Measurement and Analysis

Our primary concern is determing what how our switching and internetworking equipment should evolve: both this generation of equipment and the succeeding generations. In particular one of the key issues we face is the mapping of a connectionless internetworking flow onto a connection-oriented network. Both the network element capacities (connections per second, maximum active connections, etc.) and the network element design (e.g. cache vs. full table vs ?) are heavily influenced by the environment in which the product will be used.

Although the notion of information gathering for network engineering is well understood (and well deployed in certain other networks, e.g. the phone network), there are a few basic questions about "what" should be measured:

  1. How should we "model" traffic in the face a continuing evolution of traffic sources: HTTP traffic must have had some impact on flow size and RealAudio and Xing would also seem to be likely candidates to make significant changes in characteristics. Is it even reasonable to expect a small set of models, let alone a single set of models,
  2. Today we seem to frequently assume we need to measure "flow length", "flow creation rate", "numbers of active flows": what are we missing ?
  3. How can we deploy mechanisms that allow us to quickly determine, in a global yet quantitative sense, whether or not the traffic flow "of the hour" is similar to what the "consensus estimate" is,

To ensure that customers can still afford equipment, there are a couple of questions aimed directly at providing a fully-instrumented solution while containing costs:

  1. Is there anything to be gained by moving to a "statistical" sampling of traffic as opposed to a "full sample" approach: at least one Ethernet hub vendor believed there was in the LAN switching arena. Would anyone ever accept a bill that was based on statistical sampling ?
  2. Can we distinguish between "long term statistics" that are "always" collected for network engineering reasons and "special study statistics" that are used to isolate the cause of performance problems.

To a certain extent, answering these questions may be a simple matter of moving the "state of the art" into the "state of practice".