Inferring traffic burstiness by sampling the buffer occupancy

Common practice to determine the required bandwidth capacity for a network link is to measure the 5 minute average link load and then add a safety margin to cater for traffic bursts on small time-scales. Because of the substantial measurement effort required to appropriately determine the effect of these bursts, network managers often rely on rules of thumb to find the safety margin, e.g. 'the mean plus 50%'. In this paper we propose a novel method to accurately determine the burstiness of traffic on small time-scales, without requiring measurements on such small time-scales. Instead, our method is based on coarse-grained polling of the occupancy of a buffer in front of the network link, and 'inverting' the resulting statistical distribution of the buffer contents to find the burstiness of the offered traffic on small time-scales. We provide theoretical foundations of the inversion approach, relying on a large-deviations framework. Validation is done through both simulation using synthetic traffic, as well as extensive measurements in various operational networks, showing remarkably accurate estimates of the traffic¿s burstiness. In fact, we are able to accurately determine the burstiness on small time-scales (for instance 5 ms) by sampling the buffer occupancy (for instance) every second.