AT&T Labs Research — Leading Invention, Driving Innovation

Walter Willinger, a member of the Information and Software Systems Research Center at AT&T Labs Research in Florham Park, NJ, has been a leading researcher into the self-similar ("fractal") nature of Internet traffic. His paper "On the Self-Similar Nature of Ethernet Traffic" is featured in "The Best of the Best - Fifty Years of Communications and Networking Research," a 2007 IEEE Communications Society book compiling the most outstanding papers published in the communications and networking field in the last half century. More recently, he has focused on investigating the topological structure of the Internet and on developing a theoretical foundation for the study of large-scale communication networks such as the Internet.

Awards
SIAM Fellow, 2009. For the study of network traffic and the internet.

AT&T Fellow, 2007. Large data network behavior: Honored for fundamental contributions to understanding the behavior of large data networks.

ACM Fellow, 2005. For contributions to the analysis of data networks and protocols.

IEEE Fellow, 2005. For the analysis and mathematical modeling of Internet traffic.

(c) ACM, 2010. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACM Internet Measurement Conference , 2010-11-01, http://conferences.sigcomm.org/imc/2010/papers/p192.pdf

This paper presents a new approach to determine the geographical footprint of individual eyeball Autonomous Systems (ASes). The key idea is to leverage the geo-location of end-users associated with an eyeball AS to identify its geographical footprint. We leverage the kernel density estimation method to estimate the density of users across individual eyeball ASes. This method enables us to cope with the error associated with the location of end-users while controlling the level of aggregation among data points to capture a geo-footprint at the desired resolution. We use the resulting geo-footprint of individual eyeball ASes to identify their likely Point-of-Presence (PoP) locations. To demonstrate our proposed technique, we use the inferred geo-locations of 48million users from three popular P2P applications and assess the geo- and PoP-level footprints of 1229 eyeball ASes. The validation of the identified PoP locations by our technique against online information and prior results by a commonly-used technique based on traceroute shows a very high accuracy. Leveraging the acquired PoP locations, we examine the implications of geo-footprint of eyeball ASes on their connectivity to the rest of the Internet. In particular, we present a case study that reveals a much more complex picture of AS-level connectivity as compared to what the more traditional but geography-agnostic BGP- or traceroute-based approaches show.

(c) ACM, 2009. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACM Internet Measurement Conference, 2009-11-04

{Since the last in-depth studies of measured TCP traffic some 6- 8 years ago, the Internet has experienced significant changes, including the rapid deployment of backbone links with 1-2 orders of magnitude more capacity, the emergence of bandwidth-intensive streaming applications, and the massive penetration of new TCP variants. These and other changes beg the question whether the characteristics of measured TCP traffic in today�s Internet reflect these changes or have largely remained the same. To answer this question, we collected and analyzed packet traces from a number of Internet backbone and access links, focused on the �heavy-hitter� flows responsible for the majority of traffic. Next we analyzed their within-flow packet dynamics, and observed the following features: (1) in one of our datasets, up to 15.8% of flows have an initial congestion window (ICW) size larger than the upper bound specified by RFC 3390. (2) Among flows that encounter retransmission rates of more than 10%, 5% of them exhibit irregular retransmission behavior where the sender does not slow down its sending rate during retransmissions. (3) TCP flow clocking (i.e., regular spacing between flights of packets) can be caused by both RTT and non-RTT factors such as application or link layer, and 60% of flows studied show no pronounced flow clocking. To arrive at these findings, we developed novel techniques for analyzing unidirectional TCP flows, including a technique for inferring ICW size, a method for detecting irregular retransmissions, and a new approach for accurately extracting flow clocks.}