In the blog world, I think correlation and causation has been covered pretty well. How about correlation across time scales?

Imagine a signal going from left to right across your computer screen. It squiggles up and down, up and down. Looking closely, the up and down motion of the squiggles might be quite violent. Zooming out a bit, the squiggles are still big, but now you can see that there’s a certain limit beyond which they tend not to exceed. Zooming out far enough, the squiggles get very hard to discern and at that scale you see a pretty steady line, almost flat.

Once upon a time, over twenty years ago, this is how network traffic was thought to behave. You could have conceivably looked for the limit that your traffic tended not to exceed, and then purchased a little more bandwidth than that. Theoretically, you could have even skipped the visual inspection and calculated the bandwidth you needed as long as you knew the average arrival rate of your packets. Everybody at work would be happy and you would win an Employee Excellence Award for being a very good capacity planner.

That statistical model was called a Poisson arrival process, whose application came with the important assumption that packets arrived independently of each other. The probability of a packet arriving at any moment should not have been influenced by whether another packet had or had not already arrived. In a fascinating case of reality diverging from theory, real network traffic misbehaved1.

Packets did not arrive independently at all. Instead, they came in groups, back to back to back, then a lull, and then another burst. A packet having just arrived implied another was soon to follow. Even the duration of these bursts was not consistent. Going back to our imaginary signal, zooming out would not smooth the squiggles. Zooming out to larger and larger time scales would only introduce new, big swings that were previously out of frame, resulting in a picture that looked very much as though you’d never zoomed out at all. This meant you would need much more bandwidth than you might have previously predicted.

This phenomenon of real network traffic is called “self-similarity.” It’s related to the correlation across scales seen in those jpegs of fractals that were a staple of 1990s era chain emails. Log in to your old email account (the one with the three-letter domain) and search for “Mandelbrot” to relive the glory days. In the couple of decades since self-similarity was identified in networks, scientists have not yet settled on an alternative statistical model. That’s actually why my previous blog post hedged by saying that service providers had only a “decent idea” of the distribution of a particular network statistic.

So what do you do when your network traffic is bursty and hard to model? You buy a lot more bandwidth. This is called “over-provisioning2,” and it’s a term you’ll hear when talking to service providers about how they maintain their networks. Further complicating the issue is the fact that you can’t really buy bandwidth in arbitrary increments. Your IT team is at the mercy of history, buying bandwidth in leaps from 155Mbps to 622Mbps to 2.5Gbps to 10Gbps and upward, or from 10Mbps to 100Mbps to 1Gbps to 10Gbps and upward. If you only want 250Mbps, enjoy your pricey and rate-limited 622Mbps or 1Gbps handoff!

The moral of the story is that capacity planners within your IT team are constantly balancing the expense of over-provisioning with the need for enough bandwidth. It’s not easy, so keep that in mind during the next round of Employee Excellence Award nominations.

The post Self-Similarity and Buying More Bandwidth appeared first on Beyond Bandwidth.