Network tomography based on flow level measurements

The primary aim of network tomography is to infer properties of networks from network traffic measurements. Internet traffic mainly consists of flows of packets that belong to World Wide Web accesses, file transfers, and e-mail, whose transmissions are mediated via the Transmission Control Protocol (TCP). TCP flow records, or non-intrusive, flow level measurements, can be collected by the state-of-the-art networking equipment. In this dissertation, I develop a methodology to process TCP flow records to analyze throughput correlations among TCP flow classes. Throughputs of TCP flows that share resources in the network are correlated. These correlations can be used to infer resource sharing in the Internet. My proposal for using flow level measurements to infer network properties differs signifi- cantly from previous network tomography research that has employed packet level measurements for making inferences. In this work, I develop a sampling strategy for random processes (flow class throughputs) whose samples are taken when the processes are active at the sampling instant. The samples are used to estimate a flow class throughput correlation matrix. Factor analysis is then employed to investigate the correlation structure of TCP flow throughputs and to explore which TCP flow classes might share congested resources. A number of empirical studies are conducted to evaluate the effect of filtering out small or large sized flows on correlation estimates. Bootstrap methods are coupled with exploratory factor analysis to make inferential statements about resource sharing. The applicability of the methods to real datasets is also validated. Possible applications of the methodology introduced in this dissertation include network monitoring and root cause analysis of poor performance. The methods will have a potential impact on service providers who wish to analyze network performance using flow level measurements. The methodology may also be integrated into the design of future network monitoring equipment and software to perform an off-line evaluation of the congestion status of networks.