Efficient computation of queueing delay at a network port from output link packet traces

Current Internet core routers provide enough buffer capacity at each output port to keep the link busy for 250 msec. to avoid disrupting TCP flows because of dropped packets. Since link speeds are rising much more quickly than the availability and cost-effectiveness of large high-speed memories, there is now significant interest in reducing these buffers. Queue inferencing (QI) - a passive, external method for calculating the time-dependent queue lengths and waiting times using start/end service event timestamps - is an ideal tool for studying the effects of such buffer size reductions because it can be applied in situ to packet traces collected from existing equipment carrying live traffic without any service disruptions. Although existing QI algorithms are too computationally expensive for this purpose, we observe that packet-sizes in a typical network trace are skewed towards a few “favored” sizes, and introduce two different methods for exploiting this property. First, since the output of a QI algorithm is a deterministic function of the service time sequence in a busy period, and our traces contain many repetitions of common packet-size sequences, we cache the output of the QI algorithm for later reuse. Second, we develop a new incremental QI algorithm, which can start from cached results for any prefix of the current busy period. Combining both methods leads us to structure the cache as a decision tree. Using network traces from WIDE project backbone to evaluate our method, we found that both the frequency of occurrence for particular busy periods and for busy-period lengths follow a decreasing power law, where busy periods lengths greater than 20 were very rare and none were greater than 70. Moreover, although we found that the size of the complete decision tree grows linearly with the length of the trace, we can restrict the tree to a finite number of “active” nodes (i.e., those nodes for which the probability of a visit is above some threshold) and use simple constant-time bounds to handle the rare exceptional cases.