The New Web: Characterizing AJAX Traffic

The New Web: Characterizing AJAX Traffic

Fabian [email protected]

Sachin Agarwal Tansu Alpcan Anja Feldmann

Technische Universtitat BerlinDeutsche Telekom Laboratories

Passive and Active Measurement Conference2008/04/29

Fabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 1 / 16

[email protected]

Introduction AJAX

AJAX vs. normal Web browsing

(a) Classic Web browsing

User

Browser

Output

Screen

(DOM) Web-

server

User responses

Get requests

over HTTP

Get reply

data over

HTTP

Web browser

(b) AJAX enabled Web browsing

User

Browser

Output

Screen

(DOM) Web-

server

Get requests

over HTTP

Get reply

data over

HTTP

JavaScript-enabled-browser

(e.g. Firefox, IE, Safari)

JavaScript

Engine

(Client side)

User

responses

Pre-fetch

Cache


Introduction Motivation

Motivation

• Network traffic generation has to be realistic for networkingexperiments

• Real-world traffic characteristics change with the applications used

• Need to check if traffic models are still applicable, on a regular basis

⇒ Do new Web applications change the characteristics?

• We picked four popular representative of AJAX apps and studied theirtraffic:

• Google Maps• Google Mail• gmx.de (popular German webmailer)• lokalisten.de (popular German social network)


Introduction Outline

Outline

1 How AJAX applications work

2 Analysis approach

3 Measurement results

4 Conclusions


How AJAX applications work Google Maps internals

A brief overview of Google Maps internals

Google Maps . . .

• Is an AJAX application

• Prefetches tiles

• Opens multiple TCPconnections to various differentservers

• Uses Cookies to identify users

• Transfers data via persistent andpipelined HTTP


How AJAX applications work Google Maps internals

Challenges of identifying Google Maps related traffic

Identifying Google Maps related traffic by:

• Server IP’s: not precise enough

• Server name: very costly

• URL prefix: good enough

" / " (general) " /kh " (satellite)" /maps " (meta) " /mt " (map)" /mapfiles " (meta) " /mld " (route planning)" /intl " (meta) " /mapstt " (traffic)" /favicon.ico " (general)

Table: URL prefixes used in Google Maps requests.

We found similar methodologies for the other three AJAX applications.


Analysis approach Traces

Trace-based analysis

• Three HTTP (Port 80) full packet traces:

MWN-051: Munich, 2.5 TB, 24 h, weekdayMWN-07: Munich, 2.4 TB, 32 h, weekendLBNL-07: Berkeley, 214 GB, 9h, weekday

• Two environments:• Large scientific user populations, including student housing• High bandwidth internet access

• Analysis Procedure:• Bro for TCP stream reassembly and HTTP protocol analysis• Extract one-line summaries per HTTP request/reply pair

1Google Maps started in 2005 nine month before the traceFabian Schneider (TU Berlin/DT Labs) The New Web: Characterizing AJAX Traffic PAM 2008 7 / 16

Analysis approach Selecting AJAX traffic

Selecting AJAX traffic

• Identifying the complete AJAX-based traffic is not possible by lookinga the request/response stream only

• Need to chose Web applications that are AJAX-enabled

• We chose the 4 most popular AJAX applications that we found in ourtraces:

• Google Maps• Google Mail• gmx.de (popular German webmailer)• lokalisten.de (popular German social network)

• Compare AJAX vs. All-HTTP traffic


All-HTTP

Our 4AJAX

apps

yload

Measurement results Results

Results

• Parameters studied (more in paper):• Number of bytes transfered (HTTP payload)• Number of HTTP requests• Inter-request-times

• Reported results are consistent over all data sets

• Results presented as CCDF and PDF

• Colors used:

red/pink All-HTTPgreen Google Maps


Measurement results Bytes per connection (HTTP payload)

Bytes per connection (HTTP payload)

MWN−07 All−HTTP

1 10 100 1K 10K 100K 1M 10M 100M

P[H

TT

Ppa

yloa

dda

ta[b

ytes

]>

u]

u [bytes]

100%

10%

1%0.

1%0.

01%

0.00

1%


All-HTTP:90% of the Connectionstransfer less than ~45k

Measurement results Bytes per connection (HTTP payload)

Bytes per connection (HTTP payload)

MWN−07 All−HTTPMWN−07 Google MapsMWN−07 Google MailMWN−07 GMXMWN−07 lokalisten

1 10 100 1K 10K 100K 1M 10M 100M

P[H

TT

Ppa

yloa

dda

ta[b

ytes

]>

u]

u [bytes]

100%

10%

1%0.

1%0.

01%

0.00

1%


AJAX Apps:most connectionstransfer more bytesthan ALL-HTTP

All-HTTP:largest connectionstransfer an order of magnitudemore bytes

yload

Measurement results Session Tracking

Session Tracking

• Session: set of connections related to a user browsing on a webpage

• AJAX traffic:• Track the cookie of connections to the entry pages• Connections with the same user identification cookie are grouped into

a session

• All-HTTP traffic:• All connections where the 3-tuple (server IP, server Port, client IP) is

identical are group into a session

• For both All-HTTP and AJAX sessions, an inactivity timeout of 10minutes was applied


Measurement results Bytes per session (HTTP payload)

Bytes per session (HTTP payload)

HTTP payload data [bytes]

prob

abili

ty0.

00.

050.

100.

150.

200.

25 MWN−07 All−HTTPMWN−07 Google MapsMWN−07 Remaining 3

0.0

0.05

0.10

0.15

0.20

0.25

10kB

11 10 100 1K10 100 1K 10K10K 100K 1M 10M100K 1M 10M 100M 1G100M 1G


PDF with logarithmic x-axis:interprete as smoothed histogramwith logarithmic bin sizes

Measurement results Bytes per session (HTTP payload)

Bytes per session (HTTP payload)

HTTP payload data [bytes]

prob

abili

ty0.

00.

050.

100.

150.

200.

25 MWN−07 All−HTTPMWN−07 Google MapsMWN−07 Remaining 3

0.0

0.05

0.10

0.15

0.20

0.25

10kB

11 10 100 1K10 100 1K 10K10K 100K 1M 10M100K 1M 10M 100M 1G100M 1G


AJAX Apps:transfer more bytes per session

u

Measurement results Requests per session

Requests per session

CCDF

u [#requests]

MWN−07 All−HTTPMWN−07 Google MapsMWN−07 Google MailMWN−07 GMXMWN−07 lokalisten.de

1 10 100 1K 10K

P[#

HT

TP

requ

ests

>u]

100%

10%

1%0.

1%0.

01%

0.00

1%


All-HTTP:significantly lessrequests persession .01%

Measurement results Requests per session

Requests per session

CCDF

u [#requests]

MWN−07 All−HTTPMWN−07 Google MapsMWN−07 Google MailMWN−07 GMXMWN−07 lokalisten.de

1 10 100 1K 10K

P[#

HT

TP

requ

ests

>u]

100%

10%

1%0.

1%0.

01%

0.00

1%

PDF

#HTTP requests

prob

abili

ty0.

00.

20.

40.

6 MWN−07 All−HTTPMWN−07 Google MapsMWN−07 Remaining 3LBNL−07 Google Maps

0.0

0.2

0.4

0.6

11 1010 100100 1K1K 10K10K


All-HTTP: 50% of the sessions consist of only two requests

All-HTTP:significantly lessrequests persession .01%

Measurement results Inter-Request-Times

Inter-Request-Timespr

obab

ility

0.0

0.05

0.10

0.15

0.20

MWN−07 All−HTTPMWN−05 All−HTTPMWN−07 Google MapsLBNL−07 Google Maps

0.0

0.05

0.10

0.15

0.20

1sec

1µs 10µs1µs 10µs 100µs100µs 1ms 10ms 100ms1ms 10ms 100ms 1s1s 10s 100s 1000s10s 100s 1000s

inter request times


User induced Automated

Measurement results Inter-Request-Times

Inter-Request-Timespr

obab

ility

0.0

0.05

0.10

0.15

0.20

MWN−07 All−HTTPMWN−05 All−HTTPMWN−07 Google MapsLBNL−07 Google Maps

0.0

0.05

0.10

0.15

0.20

1sec

1µs 10µs1µs 10µs 100µs100µs 1ms 10ms 100ms1ms 10ms 100ms 1s1s 10s 100s 1000s10s 100s 1000s

inter request times


AJAX Apps:reduction ofuser inducedrequests

AJAX Apps:shift towardsautomatedrequests

User induced Automated

Conclusions Summary

Summary

• On average AJAX apps transfer more bytes per connection/session

• The number of requests per session is higher for AJAX apps

• Significantly shorter inter-request-times

⇒ Larger sessions and burstier traffic is upcoming with AJAXapplications

⇒ Existing traffic models are still applicable, but need newparameterization


Conclusions End

Questions?


Documents

The New Web: Characterizing AJAX Traffic