This paper provides an authoritative knowledge of through-router packet delays and therefore a better understanding of data network performance. Thanks to a unique experimental setup, we capture all packets crossing a router for 13 hours and present detailed statistics of their delays. These measurements allow us to build the following physical model for router performance: each packet experiences a minimum router processing time before entering a fluid output queue. Although simple, this model reproduces the router behaviour with excellent accuracy and avoids two common pitfalls. First we show that in-router packet processing time accounts for a significant portion of the overall packet delay and should not be neglected. Second we point out that one should fully understand both link and physical layer characteristics to use the appropriate bandwidth value.Focusing directly on router performance, we provide insights into system busy periods and show precisely how queues build up inside a router. We explain why current practices for inferring delays based on average utilization have fundamental problems, and propose an alternative solution to directly report router delay information based on busy period statistics.

Internet packet data is analysed to determine the relationship between the arrival process of packets, and of TCP flows of packets. Viewed as point processes, second order properties of the two processes are studied using wavelets, and each is found to have long range dependence. A new result is given directly linking flow durations to the onset scale of the long range dependence in the flow process. Using this result, a mechanism is described whereby the flow level structure could, in principle, influence the packet level structure, and it is shown and explained why this is not the case currently. The circumstances under which the flow structure could impact on the packet process, and therefore become important for the modeling of the packet level dynamics, are given.

Routers have the ability to output statistics about packets and flows of packets that traverse them. Since however the generation of detailed tra#c statistics does not scale well with link speed, increasingly routers and measurement boxes implement sampling strategies at the packet level. In this paper we study both theoretically and practically what information about the original tra#c can be inferred when sampling, or `thinning', is performed at the packet level. While basic packet level characteristics such as first order statistics can be fairly directly recovered, other aspects require more attention. We focus mainly on the spectral density, a second order statistic, and the distribution of the number of packets per flow, showing how both can be exactly recovered, in theory. We then show in detail why in practice this cannot be done using the traditional packet based sampling, even for high sampling rate. We introduce an alternative flow based thinning, where practical inversion is possible even at arbitrarily low sampling rate. We also investigate the theory and practice of fitting the parameters of a Poisson cluster process, modelling the full packet tra#c, from sampled data.

In addition to the well known long-range dependence in time series of IP bytes and packets, evidence for scaling behaviour has also been found at small scales for these series, separated by a characteristic transition timescale. It is less well known that two scaling regimes are also commonly found in time series describing the arrivals of TCP flows, again with long-range dependence, and with a broadly similar scaling exponent at small scales. The transition timescale is also roughly similar to that found in the IP level case. We investigate the dependencies between the scaling behaviours of the IP and TCP arrival levels at both small and large scales. We also study the origin of scaling at small scales at the IP level. The arrival level process is important to study both for its potential impact on the IP level, and in its own right, for example for web server performance. Our findings are based on gigabytes of high precision packet level data collected at multiple locations. The analysis methodology combines models with real data in a 'semi-experimental' approach which reduces the need for modeling assumptions. Flows and packets are individually manipulated to selectively isolate the components of scaling due to packet dynamics within a TCP flow, the dependencies between flows, their durations and packet counts, and the flow arrival process. The scaling behaviour is analysed using wavelet based methods.