Subject: Flowtime distribution and distribution-valued attributes

From: Kurt Tutschku <[email-masked]>
Date: Tue, 22 May 2001 11:12:27 -0100

Dear NeTraMet and RTFM community,

I'm looking for more information respectively for experience with the
new "distribution-valued" attributes as defined in RFC 2724.
Particular , I'd like to measure the "Flowtime distribution" of certain
applications.

In detail, I have the following questions:

a) Specifying Distributions:
---------------------------------------
     To clarify my view:  when using the logarithmic transformation, as defined
     in Section 3.2 of RFC 2724, the upper limits of each bucket are 
defined as:

     upper_limit_of_bucket_i  = lower_limit * m^(i-1)

     with

     m = (upper_limit/lower_limit)^(1/(number_of_buckets-1))

     where:
     "lower_limit": highest value for the first bucket
     "upper_limit": is the highest value for the last bucket
     "number_of_buckets": Number of buckets; does not include the 
'overflow' bucket.

     Is this correct?

b) Flows and Streams:
---------------------------------

    The new release of the NeTraMet  meter is able to identify "Streams" in 
"Flows" , see
    also  Nevil Brownlee's new paper "Streams, Flows and Torrents", cf. [1].

    I'm using NeTraMet Version 44b9
    My questions is, has any one experience in the determination of
    "StreamLastTime" and the tuning the variable "Interval" (which defines 
the end of a
    "Stream")?

    Where can I find the compile-time variables for "InactTime" and 
"TimeMultiplier" in NeTraMet?

    During my tests with the "Flowtime" distribution attribute, sometimes 
the distribution
    was empty (that means only a single "0" as output for the complete 
distribution) and
    sometime the distribution contained values.
    Thus, here my question is, when is the distribution updated by the 
meter? And when are
    the values printed/accessable?

     Literature:
     [1] Nevil Brownlee: "Streams, Flows and Torrents" in Proceedings of 
PAM'2001 available
          at: http://www.ripe.net/pam2001/program.html

Cheers
Kurt
----
Dr. Kurt Tutschku
Institute of Computer Science
Am Hubland
97074 Wuerzburg
Germany
Tel.: +49-931-8886641
FAX.: +49-931-8886632
mailto:[email-masked]
or
mailto:[email-masked]
http://www-info3.informatik.uni-wuerzburg.de/staff/tutschku

---

From: Nevil Brownlee <[email-masked]>
Date: Thu, 24 May 2001 17:22:16 -0700 (PDT)

Hello Kurt:

I've just produced a first - very preliminary - version of a
distribution file for those wishing to use distribution-valued
attributes.  Its on the distribution site as
  beta-versions/distrib-progs.tar.gz

It contains a .txt file with fairly lengthy notes, copies of the
.srl rulesets used for my PAM2001 papers, and my perl programs
for working with the distributions.

Do please try the rulesets - you'll have to change the IP netblocks
to suit your own network, of course.  I suggest you start with
data-rate.srl.  (Of course you may find it quicker/easier to write
your own scripts for processing flow data files which contain
distributions :-)

> a) Specifying Distributions:

Yes.  distrib-progs contains a script called scale_test.pl which
will compute and display the upper values for each bin for a given
set of distribution parameters.

> b) Flows and Streams:

I did quite a bit of testing of this, without coming to any definite
conclusions.  That's why all I could say at PAM was "using any dynamic
timeout scheme means making some assuption(s) about the time behaviour
of the streams!"

>           at: http://www.ripe.net/pam2001/program.html

Cheers, Nevil

-------------------------------------------------------------
   Nevil Brownlee                     Internet Researcher
   Phone: (858) 534 8338                 CAIDA, San Diego