# Analysis of Elephant Users in Broadband Network Traffic

Péter Megyesi, Sándor Molnár

► To cite this version:

Péter Megyesi, Sándor Molnár. Analysis of Elephant Users in Broadband Network Traffic. 19th Open European Summer School (EUNICE), Aug 2013, Chemnitz, Germany. pp.37-45, 10.1007/978-3-642-40552-5_4 . hal-01497035

HAL Id: hal-01497035

https://inria.hal.science/hal-01497035

Submitted on 28 Mar 2017

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Analysis of Elephant Users in Broadband Network Traffic

Péter Megyesi and Sándor Molnár

High Speed Networks Laboratory,
Department of Telecommunications and Media Informatics,
Budapest University of Technology and Economics,
H-1117, Magyar tudósok körútja 2.,
Budapest, Hungary
{megyesi,molnar}@tmit.bme.hu

**Abstract.** *Elephant and mice* phenomena of network traffic flows have been an interesting research area in the past decade. Several operational broadband measurement results showed that the majority of the traffic is caused by a small percentage of large flows, called the *elephants*. In this paper, we investigate the same phenomenon in regards of users. Our results show that even though the packet level statistics of *elephant users* and *elephant flows* show similar characteristics, there is only a small overlap between the two phenomena.

**Keywords:** traffic measurement, traffic analysis, elephant flows, elephant users

## 1 Introduction

Traffic profiling is a crucial objective for network monitoring and management purposes. Flow characterization has been given a large attention by the research community in the past decade. Flows have been classified by their size of traffic (as *elephant and mice*) [1] [2] [3], by their duration in time (as *tortoise and dragonfly*) [4], by their rate (as *cheetah and snail*) [5] and by their burstiness (as *porcupine and stingray*) [5]. Several studies were written about the correlation between these flow behaviors [6] [7].

However, current literature lacks in profiling users in such regards. In this paper we investigate the *elephant and mice* phenomena regarding Internet users. We analyzed two recent measurements taken from high speed operational networks and found that *elephant users* show similar packet level characteristics to *elephant flows*. We also determined that there is a much smaller overlap between these two phenomena that one would expect. We found that only a small portion (10%-30%) of *elephant flows* are generated by *elephant users* and also the generation of *elephant flows* is not a necessary condition for being an *elephant user*. These results indicate that further investigation of user characterization could aid network operators in the future to apply different services or charging policies for different users.
The contribution of this paper is threefold. First, to our knowledge, our study is the first that presents the discussed characteristics of *elephant users*. Second, we point out that there is only a small overlap between *elephant flows* and *elephant users*. Finally, our measurements from recent networks show that the *elephant and mice* phenomena of flows and users are still present in todays networks.

This paper is organized as follows. Section 2 presents the related work. In Section 3 we give the definition of *elephants* and the properties of the two datasets we used for our research. Section 4 presents the results of our measurements. Finally, in Section 5 we conclude our work.

## 2 Related Work

There are several different definitions for *elephant flows* in the literature. In [2] authors propose two techniques to identify *elephants*. The first approach is based on the heavy-tail nature of the flow bandwidth distribution, and one can consider a flow as an *elephant* if it is located in this tail. The second approach is more simple, *elephants* are the smallest set of flows whose total traffic exceeds a given threshold. Estan and Varghese [3] used a different definition. They considered a flow as an *elephant* if its rate exceeds the 1% of the link utilization.

However, the definition given by Lan and Heidemann [5] become a rule of thumb in later literature (e.g. both [7] and [8] use this definition). They define *elephant flows* as flows with a size larger than the average plus three times the standard deviation of all flows. They use the same idea for categorize flows by their duration, rate and burstiness as *tortoise*, *cheetah* and *porcupine*, respectively. [5] was also the first study that presented the *cheetah and snail* and the *porcupine and stingray* classifications. *Tortoise and dragonfly* properties of traffic flows were first investigated in [4]. Here, the authors considered a flow as *tortoise* simply if its duration was larger than 15 minutes. Given the generality and the rule of thumb nature of the definition by Lan and Heidemann [5] we will use the same definition for *elephants* later in this paper.

In [9] Sarvotham et al. present a comprehensive study that traffic bursts are usually caused by only few number of high bandwidth connections. They separate the aggregated traffic into two components, *alpha* and *beta* by their rate in every 500ms time window. If the rate of the flow is greater than a given threshold (mean plus three standard deviations) than the traffic is *alpha*, otherwise it is *beta*. Authors determine that while the *alpha* component is responsible for the traffic bursts, the *beta* component has similar second order characteristics to the original aggregate.

The term *elephant user* appears in [10] where the authors calculate the Gini coefficient for the user distribution. The Gini coefficient is usually used in economics for measuring statistical dispersion of a distribution. They calculate the value of the Gini coefficient for the distribution of the number of bytes generated by the users as 0.7895 but no further discussion is presented.
In [11] authors investigate application penetration in residential broadband traffic. They calculate the results separately for the top 10 heavy-hitters (the top 10 users that generated the most traffic) in their measurement data. Besides pointing out the fact that the majority of the data is generated by a small group of users the paper does not tackle any further issues about elephant users.

# 3 Methodology

In this section we present the source of the two network traces we used in this study. We also give the definition of elephants and the metrics we used to analyze them.

## 3.1 Datasets

The first trace was measured by the The Cooperative Association for Internet Data Analysis (CAIDA) [13] in a 10 Gbit/s backbone link between Chicago and San Jose. They periodically take measurements on this link and make them available for the research community upon request in an anonymous format (removed payload and hashed IP addresses). We analyzed multiple subsets of these data and since we found similar result we chose one given time period to present our findings. This trace was recorded on 13:15 (UTC), 20th of December 2012 and contains four minutes of network traffic. Furthermore, we refer to this measurement as *CAIDA Trace*.

The second measurement was taken in the campus network of the Budapest University of Technology and Economics (BME) on 16:31 (CET), 18th of December 2012 and contains six minutes of traffic. The measured link was a 10Gigabit Ethernet port of a Cisco 6500 Layer-3 switch which transfers the traffic of two buildings on the campus site to the core layer of the university network. This measurement is not available to the public. However, we consider the results relevant to present since our findings are similar to the *CAIDA Trace* even though the nature of network is different. We refer to this measurement as *BME Trace*.

Table 1 presents the basic statistics of the two traces. Generally, the *CAIDA Trace* contains more data than the *BME Trace* by one order of magnitude.

## 3.2 Measuring Elephants

During the identification of *elephant users and flows* we use the definition presented in [5]: a user or a flow is considered an *elephant* if its flow size or traffic volume is grater than the average plus three times the standard deviation of all the flow sizes or traffic volumes of flows and users, respectively. Table 1 presents the values of these threshold for the two traces. The *elephant and mice* phenomenon clearly exist: less than a thousandth of the users and flows are responsible for roughly 60%-80% of the total traffic.

In the next section we firstly show that the *elephant* phenomenon also exist with different threshold levels by plotting the cumulative distribution of user and
<table><caption>Table 1: Statistics of the two traces used for analysis</caption><thead><tr><th></th><th>CAIDA Trace</th><th>BME Trace</th></tr></thead><tbody><tr><td>Number of packets</td><td>105444780</td><td>6804958</td></tr><tr><td>Number of users</td><td>680300</td><td>63668</td></tr><tr><td>Number of flows</td><td>3876982</td><td>264117</td></tr><tr><td>Total traffic</td><td>65.6 Gbyte</td><td>5.66 Gbyte</td></tr><tr><td>Elephant user threshold</td><td>15.9 Mbyte</td><td>13.7 Mbyte</td></tr><tr><td>Number of elephant users</td><td>661</td><td>56</td></tr><tr><td>Proportion of elephant users</td><td>0.097%</td><td>0.088%</td></tr><tr><td>Total traffic of elephant users</td><td>71.5%</td><td>84.5%</td></tr><tr><td>Elephant flow threshold</td><td>2.3 Mbyte</td><td>4.96 Mbyte</td></tr><tr><td>Number of elephant flows</td><td>2714</td><td>151</td></tr><tr><td>Proportion of elephant flows</td><td>0.07%</td><td>0.057%</td></tr><tr><td>Total traffic of elephant flows</td><td>61.7%</td><td>83.41%</td></tr></tbody></table>

flow sizes against theirs cumulative proportion of the total traffic. Furthermore, we present the comparison of the following three packet level metrics, (1) byte and packet throughput, (2) packet size distribution and (3) inter packet time distribution. We chose these metrics because they are the most frequently used packet level characteristics for comparing traffic traces [12]. Additionally, we investigate presence of both *elephant* and *non-elephant* flows in the traffic of *elephant users*.

<figure><img src="image_2.png" /><figcaption>Fig. 1: The *elephant and mice* phenomena presented by cumulative distribution of user traffic volume and flow sizes and their cumulative proportion of the total traffic</figcaption></figure>
<table><caption>Table 2: Proportion of elephants with different thresholds</caption><thead><tr><th rowspan="3">Threshold in Mbyte</th><th colspan="4">CAIDA Trace</th><th colspan="4">BME Trace</th></tr><tr><th colspan="2">Users</th><th colspan="2">Flows</th><th colspan="2">Users</th><th colspan="2">Flows</th></tr><tr><th>Ratio</th><th>Traffic</th><th>Ratio</th><th>Traffic</th><th>Ratio</th><th>Traffic</th><th>Ratio</th><th>Traffic</th></tr></thead><tbody><tr><td>0.1</td><td>2.17%</td><td>95.48%</td><td>1.21%</td><td>85.29%</td><td>1.21%</td><td>98.75%</td><td>0.53%</td><td>94.84%</td></tr><tr><td>0.5</td><td>0.8%</td><td>92.44%</td><td>0.29%</td><td>74.21%</td><td>0.53%</td><td>96.97%</td><td>0.16%</td><td>91.08%</td></tr><tr><td>1</td><td>0.54%</td><td>90.55%</td><td>0.18%</td><td>69.56%</td><td>0.37%</td><td>95.66%</td><td>0.11%</td><td>89.46%</td></tr><tr><td>2</td><td>0.37%</td><td>88.17%</td><td>0.11%</td><td>63.71%</td><td>0.23%</td><td>93.45%</td><td>0.08%</td><td>87.04%</td></tr><tr><td>5</td><td>0.23%</td><td>83.48%</td><td>0.04%</td><td>52.03%</td><td>0.14%</td><td>89.96%</td><td>0.06%</td><td>83.23%</td></tr><tr><td>10</td><td>0.13%</td><td>76.92%</td><td>0.02%</td><td>42.87%</td><td>0.1%</td><td>86.35%</td><td>0.03%</td><td>73.56%</td></tr><tr><td>15</td><td>0.1%</td><td>72.2%</td><td>0.017%</td><td>37.25%</td><td>0.08%</td><td>83.96%</td><td>0.025%</td><td>70.65%</td></tr><tr><td>20</td><td>0.08%</td><td>68.78%</td><td>0.011%</td><td>32.09%</td><td>0.06%</td><td>80.91%</td><td>0.02%</td><td>66.67%</td></tr><tr><td>50</td><td>0.03%</td><td>53.55%</td><td>0.003%</td><td>17.88%</td><td>0.03%</td><td>68.12%</td><td>0.007%</td><td>47.93%</td></tr></tbody></table>

# 4 Measurement Results

## 4.1 User and Flow Sizes

In Figure 1 one can investigate the *elephant and mice* phenomena for both traces. Here we plotted the cumulative distribution of user traffic volumes and flow sizes against their cumulative proportion of the total traffic. In Table 2 we collected the complementary values in percentage (1 minus the actual value) of the curves in Figure 1 for different thresholds. *Ratio* presents the proportion of users and flows whose traffic was larger than the *Threshold* value and *Traffic* represents their total share from the aggregated traffic.

<figure><img src="image_3.png" /><figcaption>Fig. 2: Traffic of elephants</figcaption></figure>
<figure><img src="image_4.png" /><figcaption>Fig. 3: Intensity of elephants</figcaption></figure>

## 4.2 Byte and Packet Throughput

In Figure 2 the traffic of *elephant users* and *elephant flows* are plotted against the original traffic. The relative difference are also presented. In case of the *BME Trace* the *elephants* are responsible for sufficient amount of the total traffic (80%-85%), while in the *CAIDA Trace* this ratio is a bit smaller (60%-70%). Since the traffic of *elephants* seems to follow the bursts in the original traffic (the relative differences are also smaller at these peaks), the results suggests that *elephant users* are main cause for traffic burstiness.

Figure 3 present the number of packets in every one second time interval. Here, the relative difference is much higher than in case of the byte throughput. In the *CAIDA Trace elephants* are responsible for only roughly 30%-40% of the total packets, while in case of the *BME Trace* this number is ratio is 50%-70%. Intensity of *elephants* are also following the packet burst of the original aggregte since the relative difference is smaller in traffic peaks.

<figure><img src="image_5.png" /><figcaption>Fig. 4: Packet size distributions of elephants</figcaption></figure>
<table><caption>Table 3: Packet proportions under different conditions</caption><thead><tr><th rowspan="2">Condition</th><th colspan="3">CAIDA Trace</th><th colspan="3">BME Trace</th></tr><tr><th>Original<br>Aggregate</th><th>Elephant<br>Users</th><th>Elephant<br>Flows</th><th>Original<br>Aggregate</th><th>Elephant<br>Users</th><th>Elephant<br>Flows</th></tr></thead><tbody><tr><td>PS &lt;= 54 Byte</td><td>18.9%</td><td>11.9%</td><td>7.4%</td><td>20.9%</td><td>21.0%</td><td>2.9%</td></tr><tr><td>PS &lt;= 66 Byte</td><td>44.3%</td><td>16.7%</td><td>9.9%</td><td>30.1%</td><td>29.4%</td><td>3.3%</td></tr><tr><td>PS &gt;= 1450 Byte</td><td>32.8%</td><td>66.3%</td><td>72.8%</td><td>44.8%</td><td>54.6%</td><td>79.1%</td></tr><tr><td>PS = 1514 Byte</td><td>27.6%</td><td>54.2%</td><td>61.4%</td><td>28.5%</td><td>33.9%</td><td>49.7%</td></tr></tbody></table>

## 4.3 Packet Sizes

Packet size distributions of the two measurements is given in Figure 4. The joint property in both traces is that ratio of maximum and minimum sized packets is larger in *elephants* than in the original aggregate. Packets with intermediate size share similar proportion. We collected a few numerical example to Table 3 to present this phenomenon.

Table 4 present the ratio of number of packet in *elephants* compared to the number in the original aggregate under different conditions. It is clear from the values that *elephants* contains the majority of maximum sized packet and *elephant flows* exclude the majority of minimum sized packets. The ratio of minimum sized packets in *elephant users* shows different behavior in the two measurements.

## 4.4 Inter Packet Times

Inter arrival time between consecutive packets corresponding the *elephant users* or *flows* are presented in Figure 5. The curves show similar characteristics for *elephant users* and *elephant flows*. The cdf curves of *elephants* are increasing slower than the original aggregate's which is an expected behavior since traffic of *elephants* are the rarefaction of the original packet stream.

<table><caption>Table 4: Ratio of number of packets in *elephants* compared to the original</caption><thead><tr><th rowspan="2">Condition</th><th colspan="2">CAIDA Trace</th><th colspan="2">BME Trace</th></tr><tr><th>Elephant<br>Users</th><th>Elephant<br>Flows</th><th>Elephant<br>Users</th><th>Elephant<br>Flows</th></tr></thead><tbody><tr><td>PS &lt;= 54 Byte</td><td>25.0%</td><td>12.3%</td><td>74.7%</td><td>6.8%</td></tr><tr><td>PS &lt;= 66 Byte</td><td>15.0%</td><td>7.0%</td><td>71.0%</td><td>5.3%</td></tr><tr><td>PS &gt;= 1450 Byte</td><td>80.6%</td><td>70.2%</td><td>90.2%</td><td>88.6%</td></tr><tr><td>PS = 1514 Byte</td><td>81.2%</td><td>70.3%</td><td>88.4%</td><td>87.8%</td></tr></tbody></table>
<figure><img src="image_6.png" /><figcaption>Fig. 5: Inter Packet Time distributions of *elephants*</figcaption></figure>

## 4.5 Elephant and Non-Elephant Flows in Elephant Users

In Figure 6 every dot represents an *elephant user* according to the generated number of *elephant flows* and *mice flows*. These results indicate that there is no correlation between the number of *elephant flows* and *mice flows* generated by an *elephant user*. Furthermore, a user can be an *elephant* without generating any *elephant flows*. There was 53 *elephant users* in the *CAIDA Trace* who did not generate any *elephant flow*. They account for 8% of all *elephant users* in the *CAIDA Trace*. In the *BME Trace* this number is only 3, but since there were only 56 *elephant users* in that measurement their share is 5%.

Another interesting result is that in case of the *CAIDA Trace* only the 9.13% of *elephant flows* were generated by *elephant users*. In case of the *BME Trace* this value is higher, namely 37.85%. These result clearly indicate that the overlap between the *elephant user* and *elephant flow* phenomenons could be much smaller in some cases that one would expect.

<figure><img src="image_7.png" /><figcaption>Fig. 6: The number of *elephant* and *non-elephant flows* generated by *elephant users*</figcaption></figure>
# 5 Conclusion

In this paper we investigated the *elephant and mice* phenomena of Internet users in recent broadband network measurements. We found that *elephant users* show similar packet-level characteristics to the well-investigated *elephant flow* phenomenon. However, we pointed out that only a small portion (10%-30%) of *elephant flows* were generated by *elephant users*. We also found that the generation of *elephant flows* by a user is not a necessary condition for being an *elephant user*.

As future work we would like to further analyze the *elephant user* phenomenon in the same way that *elephant flows* were analyzed in [5] [9]. Such study would aid us in the understanding of how particular users are affecting the second-order characteristics of network traffic.

**Acknowledgments.** The authors would like to thank CAIDA for granting access to the measurement data that was analyzed in this paper. The research was supported by OTKA-KTIA grant CNK77802.

# References

1. Thompson, K., Miller, G., Wilder, R.: Wide Area Internet Traffic Patterns and Characteristics. IEEE Network Magazine, Vol. 11, No. 6, pp. 10-23 (1997)

2. Papagiannaki, K., Taft, N., Bhattacharyya, S., Thiran, P., Salamatian, K., Diot, C.: A pragmatic definition of elephants in internet backbone traffic. In Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurement (IMW '02), pp. 175-176. Marseille, France (2002)

3. Estan, C., Varghese, G.: New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice. In ACM Transactions on Computer Systems, Vol. 21, No. 3, pp. 270-313. ACM, New York, NY, USA (2003)

4. Brownlee, N., Claffy, K.: Understanding Internet traffic streams: dragonflies and tortoises. IEEE Communications Magazine, Vol. 40, No. 10, pp. 110-117 (2002)

5. Lan, K., Heidemann, J.: A measurement study of correlations of Internet flow characteristics. In Computer Networks, Volume 50, Issue 1, pp. 46-62 (2006)

6. Markovich, N., Kilpi, J.: Bivariate statistical analysis of TCP-flow sizes and durations. In Annals of Operations Research, Vol. 170, No. 1, pp. 199-216. Springer US (2009)

7. Molnár, S., Móczar, Z.: Three-Dimensional Characterization of Internet Flows. In Proceedings of IEEE International Conference on Communications (ICC '11). Kyoto, Japan (2011)

8. Callado, A., Kamienski, C., Szabo, G., Gero, B., Kelner, J., Fernandes, S., Sadok, D.: A Survey on Internet Traffic Identification. IEEE Communications Surveys & Tutorials, Vol. 11, No. 3, pp. 37-52, IEEE (2009)

9. Sarvotham, S., Riedi, R., Baraniuk, R.: Connection-level analysis and modeling of network traffic. In Proceedings of the 1st ACM SIGCOMM Internet Measurement Workshop (IMW '01), pp. 99-103. San Francisco Bay Area, CA, USA (2001)

10. Liu, P., Liu, F., Lei, Z.: Model of Network Traffic Based on Network Applications and Network Users. In International Symposium on Computer Science and Computational Technology (ISC SCT '08), pp. 171-174. Shanghai, China (2008)
11. Pietrzyk, M., Plissonneau, L., Urvoy-Keller, G., En-Najjary, T.: On profiling res-
idential customers. In Proceedings of the Third International Workshop on Traffic
Monitoring and Analysis (TMA '11), pp. 1–14. Vienna, Austria (2011)

12. Molnár, S., Megyesi, P., Szabó, G.: How to Validate Traffic Generators? In Pro-
ceedings of the 1st IEEE Workshop on Traffic Identification and Classification for
Advanced Network Services and Scenarios (TRICANS 2013). Budapest, Hungary
(2013)

13. The Cooperative Association for Internet Data Analysis, http://www.caida.org