[Bloat] Traffic patterns for AQM testing.... Bursty behaviour of video players.

[Jim Gettys <jg@freedesktop.org>]

Since we're rapidly getting to the point of needing to test AQM
algorithms (as enough of the underbrush has been cleared away), I've
been thinking a bit about how to test the algorithms.

I've been inspired to think a bit about whether, given both the changes
in web browsers and the advent of "streaming" media to add to the
classic full speed "elephant" flow, what a test scenario for both
simulation and actual tests should look like.

I feel I have some idea of how HTTP works and web browsers given my
experience of the 1990's; if people have any real data (taken from the
edge please!) I'd like to update my knowledge; but it's going to be
bursty, and due to using so many connections, most of those packets will
not be under congestion avoidance (would that SPDY and HTTP/1.1
pipelining get deployed quickly...)

And classic elephant flows we know...

I finally thought today to just use CeroWrt/OpenWrt's nice traffic
plotting stuff to get a feel for a number of video players's behaviour
(I happened to use an iPad; I sampled Netflix, Hulu, and IMDB).

As I expected, there is a large amount of data transferred as fast as
possible at the beginning, to try to hide performance problems (much of
which are being caused by bufferbloat, of course).  These will clearly
drive latencies well up.  What's interesting is what happens after that:
rather than, having had a period to observe how fast they are able to
transfer data, both Netfix and Hulu appear to actually "burst" their
later transfers.  The data is not "streamed" at all, rather it is sent
in full rate bursts approximately every 10 seconds thereafter. (which
will induce bursts of latency).  IMDB seems to buffer yet more than
Netfix and Hulu (watching HD movie clips); I should experiment a bit
more with it.

The interesting question is what do current operating systems/standards
do to the TCP window when idle?  Anyone know?  I'm making a (possibly
poor) presumption that they are using single TCP connections; I should
probably take some traces....
                        - Jim