Letters

Real-time Application Traffic Monitoring
System for Streaming Data Quality Evaluation
Takahiro Murooka†, Masashi Hashimoto,and Toshiaki Miyazaki
Abstract
Our innovative traffic-monitoring system lets operators observe data-communication traffic as an
oscilloscope-style trace, which provides an efficient way of directly evaluating the quality of data
streaming services. The monitoring system has a high time-resolution (1 ms) sampling function and areal-time data representation/recording mechanism that operate in synchrony.

1. Introduction
The popularity of broadband network access services (FTTH and ADSL) will inevitably lead to thespread of data-streaming-based services. These nextgeneration network services include TV, movie, andradio streaming. They require real-time data transfer
as well as received data integrity, which means thatthe received data arrives on schedule and delayed data
is discarded. Unfortunately, the conventional data
retransmission mechanism that ensures data reliability fails to ensure received data integrity because it tolerates propagation delays in data transmission
between servers and clients.
If we are to develop a high-quality data streaming
environment, we need a new traffic monitoring systemthat can provide a more detailed view of the traffic
environment than is possible with conventional monitors. In particular, time resolution is a key factor for
observing the behavior of traffic in the network. We
chose a time resolution of 1 ms and examined someactual streaming applications. We found that this time
resolution is sufficient for streaming applications.
2. Conventional traffic monitoring system
Conventional network analyzers, which are widely† NTT Network Innovation Laboratories
Yokosuka-shi, 239-0847 Japan
E-mail: murooka.takahiro@lab.ntt.co.jp

Vol. 1 No. 4 July 2003

used for monitoring networks, generally have a traffic monitoring function and an in-depth telecom dataanalyzer. The traffic monitoring function periodicallymeasures the network line utilization ratio and plots it
on a chart similar to a stock price graph. The timeinterval is set to more than one second. The in-depth
data analysis function is essentially a protocol-regulation-based data correctness evaluation in which
each elementary telecom datagram is evaluated in apacket-by-packet manner.
The conventional traffic monitoring function isused to collect reference data for the design and maintenance of network facilities. The traffic is periodically sampled at intervals greater than one second,which is short enough for proper maintenance.
MRTG, which is a well-known traffic measurement
system, reports traffic values every five minutes [1].
Likewise, commercially available traffic monitoring systems do not have high enough time resolution
to be able to observe streaming data traffic in detail.
3. Our traffic monitoring system
We developed a high time resolution traffic shapemonitoring system that can evaluate data streaming
quality in real time. Our monitoring system can pickout a specific traffic flow from a network line carrying a tremendous number of data communications
and plot the flow’s traffic volume versus time on adisplay in real time, similar to an oscilloscope trace(Fig. 1). It has three main features:59Letters• High time resolution: The traffic is sampled every 1ms, which is sufficient for observing the characteristic shape of the traffic.
• Traffic-flow selection: A series of particular telecom packets can be selected from the line traffic
according to their attributes.
• Real-time data plotting and storage: The periodically sampled traffic is shown on a display andstored in a storage device in real time.
The high time resolution and real-time traffic plotting function of our system are unique features thathave never been implemented in any other trafficmonitoring system. Figure 2 compares our monitoring system with other forms of traffic measurement
and monitors. The time resolution is determined by
the balance between the streaming source media’s
behavior and networking line bandwidth. For example, NTSC-based video is equivalent to almost 30
still-frames per second. High-quality video streaming
services aim to support at least this frame rate. Every
still-frame must be transferred within 33 ms. Standard cinematographs use 24 still-frames per second
Real-time application trafficmonitoring system

Displays the traffic data with high time
resolution (1ms), as on an oscilloscope

Network line
Probe

Data flows of different applications

Fig. 1. Functionality of our traffic monitoring system.
Monitoring grain
Real-time streaming
Application
Data ExchangeVideo-streaming,
cinematograph,and others
Our monitoringsystem

Hostcomputer
Resourcemanagement
conventional
monitoring system

LAN

Traffic cannot
be measuredWANDay

Hour

SecondMillisecond

MicrosecondTime resolution

Fig. 2. Relationship between our monitoring system and others.

60NTT Technical Review

Lettersfor which the frame interval is 40 ms. Therefore, wecan observe and evaluate their behaviors with a 1-ms
traffic sampling interval.
From the perspective of network bandwidth, on theother hand, we need a statistically meaningful number of packets to measure traffic volume. The Gigabit-Ethernet (GbE) can transfer a large datagram
within about 12 µs. If we sample a GbE line every 10µs, the datagram can be observed, but the traffic’s bit
rate cannot. This sampling period is too short toobserve the bit rate. Accordingly, we chose 1 ms forthe traffic sampling interval.
This time resolution can also handle higher-quality
and forthcoming movie streaming based on HDTV
(High definition TV) over the GbE network. An
MPEG2-encoded HDTV frame uses around 1.5 Mbit,
which occupies 1.5 ms on the GbE network line. Thiscan be observed with our time resolution.
4. Applications of the traffic monitoring system
Case 1: MPEG-2 streaming system evaluation
We evaluated two streaming systems using anMPEG-2 codec, which is widely employed for broadband video streaming over networks (Fig. 3). Eachsystem was evaluated in terms of its multi-channel
streaming ability on a shared media network. The

systems were connected to a network concentrator(hub) and the shape of the streaming traffic wasobserved with our monitoring system (Fig. 3(a)). The
shape of system A’s traffic shows that the streaming
data was sent consistently at under 10 Mbit/s. The
shape of system B’s traffic, on the other hand, wasdiscontinuous, with peaks exceeding 40 Mbit/s being
generated at 20-ms intervals.
This result shows that we can use system A for a
multi-channel streaming service and can connect fivesystems of type A to one 100-Mbps shared media network with a safety margin. However, if we do thesame with system B, we will lose data because of traffic overflow if three or more traffic peaks overlap on
a 100-Mbps shared media network. Thus, we conclude that system A is the better choice for multichannel streaming on a shared media network (Fig.
3(b)).
We measured the traffic shape with a conventionaltraffic monitoring system to compare it with our monitoring system. The results are shown in Fig. 4. The
conventional monitoring system could not observe
any difference between the two systems. We can conclude that our monitoring system is the only one thathas sufficient time resolution to evaluate a streamingsystem.

Each system operates at 6.5 Mbit/s
System A

System B

50 Mbit/s

Observed traffic
MByte/s
6.250
5.625 System A (10 Mbit/s) System B (40 Mbit/s)
5.000
4.375
3.750
3.125
2.500
1.875
1.250
0.6250.000
0 10 20 30 40 50 60 70 80 90 100
100 msTime

HubTo monitoring
system

Evaluation result
System A

Five systems can be connected in parallel on ashared 100-Mbit/s network line with a margin.
System B
The system loses packets if three peaks coincide.

Fig. 3. MPEG-2 streaming system evaluation.

Vol. 1 No. 4 July 2003

61

Letters

6.5 Mbit/s

Traffic value

to aid streaming system development.
The blue line in Fig. 5 shows the “untuned” traffic shape of the SHD movie in a
LAN environment measured with the newmonitoring system. The RTT was just afew microseconds in this case. The average
System B
System A
traffic volume, measured by a conventional monitoring system, was around 300
Mbit/s. However, the peak traffic value
The differences between the two systems
reached almost 1 Gbit/s, which can be seencannot be observed with the conventional
monitoring system.
if the peaks (groups of them) can beobserved every 40 ms.
We tried to distribute an SHD movie
through Internet2 using this “un-tuned”
traffic shape without any tuning up. This
60 second
trial failed because of the effect of the largeTimeRTT, which determined the data transferFig. 4. Measurement results for a conventional monitoring system.
performance of TCP. To solve this problem, we used multiple TCP connections
Case 2: Ultra-wideband streaming application
between the SHD server and client with a certain
development
bandwidth allocated to each connection. The TCP
We used the monitoring system in a ground-breakdata transfer behavior was observed with our moniing experiment that attempted to distribute a Super
toring system and its shape was smoothed by an engiHigh Definition (SHD) [2] movie from Chicago toneer using the monitoring system to tune the traffic’s
Los Angeles over a wideband experimental network
shape (red line in Fig. 5). Without our monitoring(called the Internet2 [3]) via TCP/IP. An SHD movie
system, this trial would also have failed. This clearlyrequires a bandwidth of at least 300 Mbit/s. The
demonstrates the advantage of our monitoring systemround-trip-time (RTT) between the cities was 60 ms.
for streaming application development.
Here, we describe how the monitoring system works
Traffic shape tuned-up with help of monitoring
SHD streaming clientand movie projector

SHD streaming
serverInternet2

3000 km (RTT=60 ms)
1000

Mbit/sTraffic shape in a LANenvironment

800
1 Gbit/s

600
400
Tuned traffic shape (smoothed)for distributing the SHD movie

200
0300 ms

Fig. 5. Ultra-wideband streaming experiment over Internet2.

62

NTT Technical Review

Letters

5. Architecture

remote site, as it communicates with the monitoring
system through the TCP/IP-based network.

The architecture of the monitoring system isschematically illustrated in Fig. 6. The system consists of two GbE line interfaces, a packet classifier,and two packet length accumulators for each GbEinterface, a real-time data read module, a measureddata transfer interface, and a data plotting display.
The network line is connected to the monitor’s line
interface using an optical coupler or a network hubthat splits the line signal into two line signals. Theline interfaces can be used as optical cable when thesystem is in pass-through mode. In this case, the monitor can be inserted into a network line directly. Oneof the split optical signals is inserted into the monitor’s line interface. The communication packets areextracted on the line interface and classified according to pre-configured packet classification rules in thepacket classifier. The classification rules use 128-bitwide data which can contain existing protocol packets header formats. The packet classifier can have tworules for selecting the packet length accumulator. The
packet length is measured and the value is added tothe corresponding packet length accumulator. These
functions are done in hardware and work in a packetby-packet manner without any packet loss. The realtime data read module reads the accumulated value ineach accumulator every millisecond. The interface
module sends bundles of these measured values to thedisplay module. The display can be located at a

6. New standard in network measurement
Our new monitoring system sets a new standard for
network quality measurements. Monitoring network
usage based on a service level agreement (SLA) is
one of its new applications (Fig. 7). Usable bandwidth is an important element of the SLA contract,
and users generally run a best-effort-based network
application over network lines that are shared withother users. This means that when an application
sends traffic that momentarily violates its SLA, thebandwidth available to other users will be reduced.
These momentary SLA violations cannot be detectedby conventional monitoring systems. Our monitoring
system can detect them and provide information
about how to solve the problem. This ability will bevery useful for network management and traffic engineering.
References
[1]
[2]

[3]

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
T. Fujii, M. Nomura, D. Shirai, T. Yamaguchi, T. Fujii, K. Hagimoto,and S. Ono, “IP transmission system for digital cinema using 2048
scanning line resolution,” IEEE Global Telecommunications Conference 2002 (GLOBECOM2002), Taipei, Taiwan, Vol. 2, pp. 16431647, 2002.
http://www.internet2.edu/

Remote display
System display

Interface module

Network

Real-time data read module

Accumulator 1

Accumulator 2Classifier

Line-interface
Target network line

Target network line
Opticalcoupler

Fig. 6. Architecture of our monitoring system.

Vol. 1 No. 4 July 2003

63Letters

Network operation
center
Detecting momentary SLA
violations and notifying thecorresponding user

Service network

MonitorMonitorMonitor
SLA violation

User server or terminal
User server or terminal
User server or terminal

Fig. 7. Application for monitoring SLA violations.

Takahiro Murooka
Senior research engineer, NTT Network Innovation Laboratories.
He received the B.S degree in physics from
Saga University, Saga, in 1989. Since joining
NTT in 1989, he has been engaged in research onsystem design methodology and the FPGA CAD
system. His research interests lie in the architecture of programmable telecom-nodes and highlevel system design methods. He is a member ofIEEE, the Association for Computing Machinery, and the Institute of Electronics, Informationand Communication Engineers (IEICE) of Japan.

Masashi Hashimoto
Senior research engineer, NTT Network Innovation Laboratories.
He received the B.S. and M.S. degrees in electrical engineering from Waseda University,
Tokyo and Kyoto University, Kyoto, respectively. Since joining NTT in 1984, he has been
engaged in the study and development of opticalsubscriber transmission system, and has conducted research in optical parallel signal processing
since 1987. He received the Dr. Eng. degree fromWaseda University in 1995. His present researchinterests involve applications of hardware-based
functional nodes, high-speed transport protocols,and network architectures for the broadband
Internet age. He is a member of IEICE of Japan.

64Toshiaki Miyazaki
Senior research engineer, supervisor, andresearch group leader, NTT Network Innovation
Laboratories.
He received the B.E. and M.E. degrees inapplied electronic engineering from the University of Electro-Communications, Tokyo, in 1981
and 1983, and the Ph.D. degree from Tokyo
Institute of Technology in 1994. Since joining
NTT in 1983, he has been engaged in research on
VLSI CAD systems including high-level synthesis, logic design tools, and CAD frameworks.
Since 1993, he has been involved in developing
telecommunications-oriented FPGAs and theirapplications, and next-generation networking
protocols. His research interests lie in programmable hardware systems, adaptive networking
technologies, and autonomous systems. He is amember of IEEE, IEICE of Japan, and the Information Processing Society of Japan.

NTT Technical Review