# From Brown-Field to Future Industrial Networks, a Case Study
## 4 Brown-Field Traffic Analysis
### Performance Dynamics Characterization  
It is evident that the existing characterization and profiling methods are not well suited for performance and configuration management of the IT-OT converged network for two main reasons. Firstly, the detailed tomography in flow monitoring and characterization do not scale well, which can result in the high complexity and lack of flexibility that is required for performance management of IT-OT converged networks. Secondly, the assumption of uniformity in flow patterns based on traffic classes does not apply when brown-field traffic is considered. Furthermore, the existing methods and approaches are either addressing IT or OT since the majority of the exiting networks manage IT and OT traffic by the division of time to isolate the two traffic types. In the converged network, both traffic types ought to be generated from devices in the network, which troubles the flow and traffic isolation. The unexplored performance criteria of IT-OT networks cannot be identified by studying the two traffic types separately, nor can it be derived by summing up the two sets of requirements. However, a reasonable starting point can be a traffic-type-agnostic characterization approach. In other words, it sets a broad monitoring perspective that unveils the overall network behavior and performance bottlenecks for performance and configuration management, i.e., resource allocation and provisioning. Hence, we propose a new measurement and characterization approach to provide additional insight into the network behavior with respect to bandwidth consumption and network throughput, and measure the dynamics of available resources, i.e., utilization and dynamic mixture. As mentioned in Section 2, data are collected from a production network, and consist of both IT and OT traffics. The underlying traffic consists of both control network traffic for carrying out regular processes and server network traffic for communication with file servers or similar. Since the production networks follow regular workflow cycles to maintain the manufacturing process, it is credible to assume periodic patterns being generated by the sum of communication flows. This assumption is also partially supported in literature for IT and OT traffics, but separately. Self-similarity in Ethernet IT traffic and the Internet traffic was studied for many years [20; 21; 22]. Recently, similarity in inter-arrival time and the correlation between traffic flows in SCADA systems are also being studied and illustrated on simulated and emulated industrial data [8; 9; 10]. We expect that the network dynamic with respect to network utilization, i.e., accumulated throughput of all traffic, should also show a cyclic pattern, which in itself can show the performance level of operational states of the network with respect to the utilization parameter. Dynamics of the network with respect to network utilization can be formulated as a time-series \(X=x_{1},x_{2},x_{3},...,x_{i}\) where each \(x_{i}\) is the transmitted data of recorded packets at time \(i\). The resolution of the collected data is in microseconds, and the number of transmitted packets and their length varies at each unit time interval. Accordingly, \(X=x_{i}\) for \(x_{i}=\sum_{j=1}^{n}l_{j}\), where \(l_{j}\) is the length of the \(j-th\) packet, with resolution of \(x\) set to seconds, gives the dynamics of throughput for the network. The fluctuated pattern of throughput is the result of diversity observed in the network transmissions in terms of protocols, packet size and the number of transmissions. Downsampling the data and applying moving average filter with _window_size_ = 60\(\sim\)1 min smooths the signal and mitigates the effect of random and short term fluctuations and anomalies. Figure 7 illustrates the results of this process on the brown-field traffic. The smoothed OT throughput dynamics, Figure 7a shown in red, reveals a repeating cyclic pattern in each 20 min time window.