A queueing equivalent thresholding method for thinning traffic captures

In the development of accurate capacity planning and network resource dimensioning models, network operators must handle representative information about the traffic volumes traversing its network. However, the amount of traffic measurements available over which to perform such analysis, processing and storage is overwhelming. For this reason, the research community has understood the importance of finding an effective mechanism to reduce (or subsample) such huge amount of data, with minimum loss of information. More specifically, this work considers the traffic volume traversing a given router per unit of time, which can be obtained by periodically polling the counters of the interfaces table via SNMP. We further propose a mechanism to downsample such traffic time-series using multi-resolution analysis with wavelets, and evaluate the optimal subsampling level based on comparing the queueing behavior of the subsampled and original signals at the output of a router. This mechanism is more related to network performance than conventional comparison levels, since queueing delay is a very representative QoS metric. The method presented in this paper has been applied to an extensive set of real measurements collected from RedlRIS, the Spanish National Research Network. The results show that it is possible to reduce the data to one fourth of its original size for the traffic generated by most analyzed universities, and even to one eighth for data collected from routers with more aggregated traffic, both with a high level of confidence.