Introduction

We are currently witnessing the explosive growth of Internet services such as the WWW. Indeed, recent analysis of Internet traffic traces [1,2] clearly show that the WWW is the most popular service in the Internet, followed by other services such as the FTP and the email (POP3, SMTP). All of the abovementioned services rely on TCP as the transport protocol and, therefore, it is of primary importance to understand the TCP behavior. Indeed, such protocol has been subject to extensive study in the recent literature [3,4,5,6,7,8,9,10,11,12]. The most part of the articles attempt to characterize TCP behavior. However, the TCP dynamics depend on a large number of issues such as the congestion on the path from the client to server [3], the transmission window negotiated at the connection establishment phase [6], the maximum segment size [7], the roundtrip time estimation and the protocol version (Reno, Tahoe, Vegas) [10,4], that provide different implementations of delayed ACK and window recovery mechanisms. Thus, due to the TCP daunting complexity we note that the current studies focus on specific aspects of TCP performance in restricted simulation scenarios [3,4,5,6,7,8,9], network links on experimental network configurations [10,11] and selected client to server links [12].

We note that the analysis presented in the abovementioned studies are constrained by the fact that a real Internet connection is penalized by interfering traffic, which is not captured by simulation models. On the other hand, users navigate the Internet in a random manner. Thus, experimental setups or selected client-server paths do not suffice for the analysis of TCP flows. It is only through unconstrained measurements of real Internet traffic that an accurate characterization of TCP can be achieved.

In [13] a real traffic trace is used to explore TCP dynamics in a real network. However, the analysis is restricted to the relation between ACK compression and segment loss, and their influence to TCP dynamics. On the other hand, trace-driven Internet service analysis is performed in [14] and [15]. The random variables describing per session statistics such as asymmetry, number of bytes and packet interarrival times are analyzed empirically but both studies provide no insight on QoS measurements such as transaction latency and use traces that do not include the most popular service in the Internet: the WWW. Regarding the latter service, most WWW studies are based on logs from servers or proxies [16,17]. In [18] a trace at client side is collected in order to study WWW session characteristics such as duration, size and user behavior aspects. Since all of the abovementioned WWW analysis rely on connection records obtained with logs produced by the client browser or by the server/proxy we note that only application level statistics can be obtained, and, thus, no emphasis is done on the TCP.

The analysis of real TCP connections is a trade-off between capturing the behavior of TCP flows with a stochastic model or studying a specific aspect of TCP performance in a simulation environment. We note that the characterization of TCP flows in an unrestricted network scenario implies the use of models which are necessarily stochastic, since it is not feasible to model the connection in a deterministic fashion, given the large number of factors that influence the TCP behavior. Ideally, such stochastic model should provide a TCP flows characterization in terms of network parameters, in order to allow for network dimensioning and control. Indeed, there is an increasing interest in IP switching solutions for Internet flows. Tag switching protocols assign a tag to the IP flow at the edge router, so that the routing tables at the backbone routers are simplified significantly, since per-flow and not per-packet routing is performed. The next step in this network evolution towards flow-switching is the allocation of separate resources per flow. In an ATM network such resources could be allocated by the use of Switched Virtual Circuits (SVC). In non-ATM networks it is also feasible to assign separate resources with per-flow queueing combined with scheduling algorithms such as the Distributed Weighted Fair Queueing (d-WFQ). For both cases, we note that a characterization of the TCP flow in terms of the actual network parameters is in order, so that resources can be allocated accordingly.

Precisely, in this paper we present a stochastic characterization of TCP flows obtained from the analysis of a large traffic sample recorded in a real network scenario consisting on an IP-over-ATM link . We derive a network-centric stochastic model for the TCP connection, which is based on a generic traffic flow with burstiness and throughput. At the packet level we consider that the TCP connection can be modeled as a packet arrival process, with $X_{i}$ bytes arriving in RTT $i$. While burstiness and throughput provide a TCP characterization amenable for network dimensioning in flow-switched environments the random variable $X_{i}$ provides information about the dynamic behavior of the flow, as we will see later. Prior to the analysis of the experimental data, let us present the network scenario and measurement tool.