Network Users Behavioral Pattern in an Uncontrolled Bandwidth Utilization Environment of a Campus Area Network (IBB University, Lapai, as a Case Study)

Network Users Behavioral Pattern in an Uncontrolled Bandwidth Utilization Environment of a Campus Area Network (IBB University, Lapai, as a Case Study)

Dangana Muhammad

PG Student

Department of Electrical and Computer Engineering Ahmadu Bello University

Zaria, Nigeria

1. D Usman

   Senior Lecturer

   S. M Sani

   Senior Lecturer

   Department of Electrical and Computer Engineering Ahmadu Bello University

   Zaria, Nigeria

   Department of Electrical and Computer Engineering Federal Polytechnic, Kaduna

   Kaduna, Nigeria

   Abstract – Universities with Campus Area Networks (CAN) are always faced with the challenges of bandwidth congestion. This is because of the volume of academic electronic files that are frequently being transferred coupled with lack of bandwidth management. This research therefore studied the behavioral pattern of the CAN users. The network data were collected over a period of 60 days and were analyzed. The analysis include: peer-to-peer activities, traffic analyses and the domain hit by the users. These were carried out per individual node and the time-of-day they occurred. The analyses confirm the congestion of the available bandwidth and gave an insight on how best to manage the available scarce bandwidth. Bandwidth management techniques were recommended for further work.

   Keywords Campus Area Network, Bandwidth Management, Behavioral Pattern, Traffic Analysis

   1. INTRODUCTION

      Campus area network (CAN) interconnects networks in a limited geographical area such as university campus or organizational campuses. CAN is a computer network interconnecting a few to several local area networks (LANs) within a university campus or corporate campus. Campus area network may link a variety of campus buildings including colleges departments, the university library and student halls of residence [9]. CAN support the academic needs of the University and as such the University community are hungry for the services provided by CAN. However, the effectiveness of CAN mostly depend on the bandwidth size subscribed to by the Institution management as well as its management for judicious use by the community. Bandwidth can simply be thought of as a representation of the capacity of the communication media (especially network devices:

      switches, routers, Ethernet cables, fiber optic cables, etc.) to transfer data from source to destination [2]. A CAN that do not control it bandwidth utilization rate is frequently faced with bandwidth congestion leading to poor browsing experience by users and not meeting its primary aim of supporting the academic needs of its users. Hence, it has become the responsibility of the network managers to effective manage the available bandwidth in order to meet the needs of the University community.

   2. RELATED WORK

      Abdullahi [1] developed a policy-based bandwidth scheme for ABU, Zaria, Nigeria. With the use of IP sniffer, the work collected and analyze traffic data over a period of 90- days. A policy-based bandwidth optimization was then developed and this was simulated on a segment of the network. The practical implementation of the developed policies indicated that about 1.0Mbps in bandwidth was saved. However, the thesis did not work on bandwidth optimization at the levels of Access Layer Switches and routers.

      Devajit, et al [5] developed an application based bandwidth management tool. This development tool is used to combat the challenges that are facing the easy flow of data transmission in network designs. PHP, MySQL, Notepad++ and Apache where the application system design tools that where used to simulates a simple wireless based intranet network environment which calculates the size of any file that is to be sent over the network. When the file size exceeds the allotted bandwidth by the administrator, the transfer process is terminated. The system also enables an administrator to change the allowed network bandwidth based on preferences. Clients systems

      are allowed to share and transfer files as long as they are within the allowed bandwidth range. This research work did not cover to large scale organizations such as Universities (which have both Intranet and Internet connectivities) in the management and control of their network bandwidth.

      Lockias [7] investigated the issue of bandwidth maximization in some universities. The research surveyed a sample of five universities and catalogued their experiences. A mixed methods approach was used to gather relevant data. The first was information (data) gathering on ICT governance and policy issues. The targeted respondents were personnel from the Information Technology Services department, Computer Centers or other related departments. Principal authorities, including Vice Chancellors, Librarians and Registrars. The second was an administration of emailed questionnaire and phone interviews. The questionnaire incorporated a series of questions about campus infrastructure, including the number of computers that were networked or connected to the Internet, bandwidth management strategies used and the challenges faced. The results found showed that most of the Universities sampled do not have an official Acceptance Use Policy (AUP) to assist with bandwidth management. However, the research did not sample the universities that implement bandwidth management at Access Layer levels.

      John. et al., [6] wrote a research paper that examined the management of a network with respect to congestion in both the Local Area Network (LAN) and on the Internet backhaul. In this research work, three approaches were used: (i) NetCracker Professional Software® was used to simulate a WAN scenario in which files of various sizes were copied across the WAN links from a serverto a remote desktop. The latency for the different file sizes was noted; (ii) an IBM Trivoli, whats-up-gold and PRTG® software were used to obtain readings of bandwidth, latency, throughput, and CPU utilization as well as user voice and video experience on a life, corporate network running on fiber links; (iii) the testing of users perception when copying big files, watching videos, playing interactive games and making concurrent calls across WAN links. From the analyzed results obtained, the research concluded that as the offered load in a network increases, the throughput decreases. It also recommended that since choice of protocol to be used in any file transfer depends on the type of packet to be routed, then protocol optimization can be used to improve the efficiency of traffic that uses CIFS, FTP, HTTP, MAPI and TCP protocols. However, this paper did not discuss how

      bandwidth management and policy can be used to continually optimize this scarce resource.

      III METHODOLOGY

      The method used in the collection of data and monitoring is explained in this section. The CAN was monitored over a period of 60 days and user traffic were been collected and analysed as they traverse through the network.

      1. Method of Data Collection

         The Network monitoring was carried out by logging a selection of activities that where of interest to bandwidth utilization on the network. This was carried out over a period of 60 days (from 1st September, 2014 to 30th October, 2014) and between 8am to 11pm daily. The collection of these logs where done using a packet capturing software (Juniper Network Monitor) across some selected nodes in the main campus. Since these research nodes are setup on a Tier -2 standards, the challenge of stable electric power supply to these nodes where eliminated. At the end of the monitored period, the collected logs were the analyzed to see its relationship with bandwidth utilization.

         The logging of selected network activities or events for this work includes those activities of the network users that are considered to consume a large part of the bandwidth. The following event logs were carried out and then further analyzed: Peer-to-Peer (p2p) events and analysis. This was carried out to simply know the amount of bandwidth utilized by p2p events. Webproxy events and analysis. This was used to understand the web resources that are of interest and frequently used by users. Finally, the hotspot events and analysis, which was used to discover patterns in network use within the University.

         A packet capturing based log repository (Juniper Network Monitor) is capable of collecting log messages from distant devices on a network and cataloging them based on message type and source. A twelve (12) number access layer switch were being monitor. These Access Layer Switches (Node A, B L) have an in-built utility for packet based logging. This facility enables the forwarding of log messages from each node to a remote server. The type of messages been forwarded include: firewall logs generated when p2p traffic is detected; web-proxy logs (URLs visited by users); and user session statistics (hotspot messages).

      2. Data Monitoring

      Figure 1 is a simple illustration of the network monitoring setup.

      Fig. 1. A schematic of the network monitoring setup

      IV RESULTS AND DISCUSSION

      his section analyzed the event groups with respect to bandwidth utilization. It explained the firewall rule that was used to indicate any p2p activity, the user traffic analysis and the web analysis.

      1. Peer to Peer (p2p) Analysis

         Since firewalls or packet filter exist both as a software solution and as a hardware appliance and is considered as a network security system that controls the incoming and outgoing network traffic based on an applied rule set [10],

         a firewall rule was then set up to indicate a p2p traffic across each monitored node. In order to derive the intensity of p2p activity in each node at any given time of the day, these p2p events were analyzed. In the results obtained, nodes with prominent p2p activities were identified and the corresponding time of the day in which they were more pronounced.

         Figure 2 shows the average number of p2p activities at the selected node in the network.

         P2P Activities across Nodes

         2000

         1500

         1000

         500

         0

         Node Node Node Node Node Node Node Node Node Node Node Node A B C D E F G H I J K L

         Fig. 2. The distribution of p2p activities across the selected nodes

         usually consumes significant amount of bandwidth, it is

         From Fig. 2, the p2p activities is most pronounce at node J and L. This is because node J provides hotspot services to the users while node L is the hostel hotspot. In other words, node J usually has significant number of users connected to it. Node I is located in the Mathematics department and records the lowest p2p activities. Since p2p activities

         therefore paramount to understand the p2p activities of the network users. This analysis therefore gives an insight on how to manage the bandwidth with respect to p2p activities.

         Figure 3 illustrates the trend in p2p activities of users on a time-of-day bases.

         P2P Activities on Hourly Bases as Totalled Over the Period

         2000

         1800

         1600

         1400

         1200

         1000

         800

         600

         400

         200

         0

         12.00am

         1.00am 2.00am 3.00am 4.00am 5.00am 6.00am 7.00am 8.00am 9.00am 10.00am

         11.00am

         12.00pm

         1.00pm 2.00pm 3.00pm 4.00pm 5.00pm 6.00pm 7.00pm 8.00pm 9.00pm 10.00pm

         11.00pm

         Fig. 3. p2p activities on hourly bases of the day

         The p2p activities is at the lowest from 7am -10am daily. The activities gradually pick up and reach the highest at about 10pm-11pm. P2P applications run 24 hours in the background, constantly downloading content and are left unattended for days at a time [4]. It is to this end that it has become important to understand the time-of-day p2p activities of the users in order to factor this constant bandwidth consumption rate into the bandwidth management policy.

      2. Traffic Analysis

         With the Junos Pulse Access Control monitoring software, the traffic utilization statistics of all user sessions were logged throughout the period been monitored. This statistics enabled the calculation of the amount of total bandwidth (upload and download) that was consumed. The total traffic usage at each monitored node was also calculated. More so, at various time-of-days the overall traffic distribution across the entire network was determined.

         Figure 4 illustrate graphically the total traffic (in mega bytes) of users by time of day.

         User Traffic by Time of Day

         35000

         30000

         25000

         20000

         15000

         10000

         5000

         0

         12.00am

         1.00am 2.00am 3.00am 4.00am 5.00am 6.00am 7.00am 8.00am 9.00am 10.00am

         11.00am

         12.00pm

         1.00pm 2.00pm 3.00pm 4.00pm 5.00pm 6.00pm 7.00pm 8.00pm 9.00pm 10.00pm

         11.00pm

         Fig. 4. Total User Traffic (In Megabytes) by Time of Day.

         The number of traffic on the vertical axis is plotted against the time of day (hourly) on the horizontal axis. The traffic was found to be at the lowest within the period of 11pm- 12am. While the traffic is at its peak between the period of 9pm-11pm daily. Knowing the rate at which traffics traverse the network at time-of-day gives an idea on how to properly manage the available bandwidth on daily bases.

         More so, understanding the traffic rate in the network easily helped in the implementation of the required bandwidth management strategy and policies.

         Figure 5 is a schematic representation of the number of traffic across individual node.

         Traffic Across Nodes

         35000

         30000

         25000

         20000

         15000

         10000

         5000

         0

         Node Node Node Node Node Node Node Node Node Node Node Node A B C D E F G H I J K L

         Fig. 5. User traffic (In Megabytes) across individual node.

         The Vertical axis shows the amount of traffic (in mega bytes) against the nodes at the horizontal axis. Nodes J and L (Biological Sciences switch and Hostel Switch) carry the most traffic. This can be associated with the fact that these switches provides hotspots to network users which in turn provides more connectivity and hence the volume of traffic. Node K and G (Physics and Deanage Faculty of Natural Sciences switches) have the lowest amount of traffic traversing them. This is because access to the network using these switches is basically through cable and limited number of these is available.

         It is obvious that users connect to the network through the access layers (nodes), therefore, analyzing these nodes in

         order to understand the traffic rate across them is important. This is because a view of the traffic per node enables the implementation of bandwidth regulation using the traffic shaping technique. This is also implies that a bandwidth regulation can be implemented on a per node bases.

      3. User Behavioral Pattern

         In order to justify the amount of traffic that traverse through the network at the various nodes, it became necessary to analyze the user sessions in the network (the behavioral pattern). Figure 6 is a simple representation of the number of active user session with respect to the nodes.

         Active Users by Nodes

         500

         400

         300

         200

         100

         0

         Node Node Node Node Node Node Node Node Node Node Node Node A B C D E F G H I J K L

         Fig. 6. User Session by Node.

         The vertical axis is the number of users and is plotted against the horizontal axis which represent the nodes. Node L (Hostel Switch) records the highest user session while node H (Faculty of Agriculture) records the lowest user session.

         Figure 7 is a simple graphical representationof the average hourly peak load of users in the network. It shows the behavioral pattern of the users on a daily bases.

         Hourly peak load of users

         600

         400

         200

         0

         Fig. 7. Average Hourly peak load of users.

         The vertical axis (number of users) is plotted against the horizontal axis (time of day).

         The load is at its peak at about 9pm-11pm while at its lowest at about 6am-9am daily. Understanding the user behavioral pattern is important as this affects the amount of traffic in a network which also helps to shape the implementation of bandwidth regulation in the network.

      4. Web Analysis

      During the monitoring period, the Unified Resource Locator (URLs) visited by users on the network were also tracked. These URLs were analyzed and the popular online utilities on campus and domains were revealed.

      Table 2 shows among the network users, a list of some of the most popular or visited utilities.

      Table 1. MOST POPULAR SITES VISIT BY USERS ON THE NETWORK

      S/N	Most Popular:	Utility
      1	Mail servers	Yahoo Mail, and Gmail
      2	News site	Naijapals,
      3	Search engine	Google, Yahoo
      4	Social Network Site	Facebook, Twitter
      5	Educational	Wikipidia
      6	Peer-to-peer sites	Bit Torrent, KazaA, iMesh, DirrectConnect
      7	Streaming Site	YouTube

      The understanding of the most frequently hit website is necessary in web analysis because it enable a proper web filtering. In other words, knowing the frequently visited websites enables the classification of these sites for web filtering which is an important tool for bandwidth management.

      1. IMPLEMENTATION

         In this section we discussed the traffic filtering. This explains the web filtering for bandwidth management.

         A Traffic Filtering (Web Filtering)

         Web filtering allows the management of bandwidth and Internet usage by preventing access to inappropriate Web content. However, from the user behavioral pattern and the number of sites been visited by these users, a classification of traffic was made. This include: Academic Sites and Non-academic Sites. These classifications were made based on the fact that IBBUL is an academic institution.

         To enhance traffic filtering, the classification of traffic based on the most visited sites is presented in Table 2 below.

         Table 2 CLASSIFICATION OF SITES

         .

         S/N	Academic sites	Non-academic sites
         1	Yahoomail	Nude
         2	Gmail	Exclusive
         3	Institution mail	Windows update
         4	Institution portal	Olufamous
         5	Wikipidia	Twitter
         6	MSN	Naijapals
         7	News

         Table 2 shows some of the web sites classification. Although, some sites cannot be easily classified as academic or non-academic because they can be use for both. Example of these web sites include Facebook and Youtube. While it is obvious that these sites consume much bandwidth, they cannot be filtered or blocked completely. In order to manage the available bandwidth without blocking these sites, certain policies can be attached to these sites such as allowing the traffic of these specific URL at certain time-of-day coupled with the regulated traffic shaping technique in place.

      2. CONCLUSION

         Bandwidth management can be approached in different forms; however, this cannot be implemented without placing restriction on some of the web contents being accessed by the users. Also, it is important to monitor and manage the amount of bandwidth being accessed by the

         REFERENCE:

         1. Abdullahi, M. (2014). The Study of The Policy Based Bandwidth Management in The Core Network: A Case Study of ABU Network. Zaria. . Zaria: Department of Electrical and Computer Engineering. Ahmadu Bello University, Zaria, Nigeria.

         2. Águeda, S. T. (2011). Network Architecture for University Campus Network. Chongqing, China: College of Communication Engineering of Chongqing University.

         3. Athicha, M., Benjie, C., & M, D. (2010). A Low – Bandwidth Network File System. San Diego: Defense Advance Research Project Agency.

         4. Brat, N. (2010, August 21). Managing Peer-To-Peer Traffic With Cisco Service Control Technology. Retrieved September 11, 2014, from Cisco SCE 1000 Series Service Control Engine:

            http://www.cisco.com/c/en/us/products/collateral/service- exchange/sce-1000-series-service-control- engine/prod_white_paper0900aecd8023500d.html

         5. Devajit, M. M. ((2013).). A Study of Bandwidth Management in Computer Networks. . International Journal

            users and understanding the network access behavioral pattern of the users usually provide information about the elements that can be regulated in order to provide a better bandwidth usage. It is in-line with this that this research studied the behavioral pattern of network users. This is aimed at having a look at the items that need to be restricted on the network for better bandwidth utilization among users.

      3. RECOMMENDATION FOR FURTHER WORK

Having explored a campus area network with its peculiarity in users behavioral pattern, we recommend the implementation of one or more of the numerous bandwidth techniques on CAN for its effective management. Although depending on the need of the Institution, techniques such as congestion avoidance, Wide Area Network Optimization, Quality of Service and Traffic Shaping can be employed for bandwidth management.

of Innovative Technology and Exploring Engineering (IJITEE) , 70-73.

1. John, S. O. (2011). Managing and Improving Upon Bandwidth Challenges in Computer Network. Journal of Emerging Trends in Engineering and Applied Sciences (JETEAS) , 482-486.

2. Lockias, C. (2012). Bandwidth management in universities in Zimbabwe: Towards a responsible user base through effective policy implementation. International Journal of Education and Development using Information and Communication Technology , 62-76.

3. Pearson, K. (2014, March 13). Hierarchical Network Design

   . Retrieved July 31, 2015, from Connecting Networks Companion Guide:

   http://ptgmedia.pearsoncmg.com/images/9781587133329/do wnloads/ch01.pdf

4. R, S. H., & S., M. L. (2006). Computer Networking. Tsinghua: Pearson Education Asia and Tsinghua University Press.

5. Rouse, M. (2000, June 15). Enterprise Firewall Protection. Retrieved August 20, 2014, from TechTarget: http://searchsecurity.techtarget.com/definition/firewall

6. Sharpened, P. (2012, May 16). Bandwidth. Retrieved July 31, 2015, from Tech Terms: http://techterms.com/definition/bandwidth