TMA workshop 2010
April 7 2010
T. Mori, R. Kawahara,H. Hasegawa, and S. Shimogawa
NTT Service Integration Laboratires

Background
Internet VideoP2P
Other Videos

Statistics cited from:
Cisco Systems, Visual Networking Index
Forecast and Methodology, 2008-2013
1

Goal of this work
! Understanding the new class of traffic – video

sharing services (Internet video)" For creating realistic traffic workload model" Addressing implications for network management

2What we did in this work:
!

Developed a simple and effective
technique that identifies flows
originating from video sharing services!

Revealed the basic characteristics ofnetwork traffic flows of video sharing
services from a network service
provider view

3Video sharing services we studied'(&)*(+,(-,.#($%/"#0)1)&%234-#""50)1)&%23
41#"6%765

0(+2"+2,231"'()*+,-./,
01,23.4

)1*+

567,89:7,2:;

=-:-.,;1>+

011>+

56

>?*@ABC?D

EF3.-GHIJ

011>+

K*+

56

C-3<L2"M".

NO-.P&

)123.4,"O,0K1>+

QQ

567,2:;,

!"#$%&"!"#$#%&
(23<&,63/&"4Identifying video flows! Constraint:" We take an approach that does not use DPI (Deep PacketInspection)" DPI does not scale (think of 100+Gbps world)" User privacy issues.
! Idea:" Use source IP addresses as a hint
" YouTube video traffic may be originating from AS 36561(YouTube)" But, we need more fine-grained information!
!

YouTube is also originating from Google AS
Some other objects are also originating from YouTube5

Web objects originating from YouTube! Various http/content-types" Application:!

atom+xml, javascript, octet-stream, x-shockwave-flash, etc.

" Image:! gif, jpeg, png, x-icon" Text:! html, css, javascript, plain, x-cross-domain-policy,xml" Video:! mp4, flv, x-flv! Observation:"each content type is served by different server groups in large
web farms
6

Separation of server roles inlarge-scale web farms
Video: v*.lscache*.c
Image: img
Text: www
Apps: www, gdata
These hostnames areassigned diﬀerent
set of IP addresses

7Extracting YouTube hosting servers (1)1. Analysis of massive web URLs
" web proxy server logs (100M records / month)" Extract hostname if it is serving content-type of“video” and its domain part matches /youtube\.com$/" Reverse engineering the naming rules of hostname:v*.cache*.c.youtube.com

2. Compile a hostname list
" Complement unobserved hostnames.

If we see v12 and v14! we may also have v13" If a domain has proper A record, add it in the list.

8Extracting YouTube hosting servers (2)3. Compile IP address list"""

A host name is assigned
multiple IP addresses (for thepurpose of efficient contentdelivery)
Lookup the hostnames frommultiple vantage points.
We used open recursive DNS
servers (ORDNS) that arelocated over the world (5000+servers in 68 countries).

YouTubeJapanUSEurope

ORDNS servers
DNS Lookup

We now have list of IPaddresses for YouTube
video hosting servers
9Extracted hostnames and IP addresses

hostnames

IP addresses

10Traffic dataset! Collected on GbE edge link of an Internet edge site
! Incoming traffic collected over 9 hours! Non-sampled flow records:" Start time, end time, server IP, client ID,

source port, destination port, #pkts, size
! # of total flows: 100 M

11

Statistics of collected flows

Flows whose sizes > 20KB

12

Flow size distribution

Capacity limitation affects the characteristics
13

Characterizing the distributions
Truncated Pareto

ParetoIt looks like a mixture distribution

14

Flow rate / Flow duration

Kbps

秒

Not much differences among services.
Duration obeys power-low-like distribution.
15

Comparison with conventional P2P flows
P2P: "=0.38

Impact of P2P growth

Web: "=1.12
Tatsuya Mori, Masato Uchida, Shigeki Goto,
Flow analysis of internet traﬃc: World Wide Web versus peer-to-peer.
Systems and Computers in Japan 36(11): 70-81 (2005)16

Summary and Implications! Presented a simple and effective way of identifying

traffic flows originating from video sharing services
Key idea: leverage naming convention of large-scale
web farms + globally distributed measurement! Capacity limitation of video sharing services affects

the characteristics of traffic flow sizes
Can be a control parameter both for content providerand ISPs
! If video sharing services do not have capacity

limitation, their traffic might be close to P2P traffic
today (assumption)17