Obfuscated Networking is just a place to store ideas and thoughts. It's not clear what, why or how, but they are all here. Hopefully you will find them entertaining, thought provoking or interesting and will be inspired to leave your thoughts.

I’m digging through a lot of statistics on self similar processes to understand network response time variance. It appears that response time is self similar, that is, the graph of the distribution looks similar regardless of scale, which presumes that response time is directly tied to traffic levels in terms of PPS which is in turn tied to the distribution of file sizes and how often requests are made, which are both self similar (though one article claims there’s no correlation between the rate of requests but I’m not sure it applies in my situation). In any case I’ve added another factor in my network, the state-full firewall. This appears to change the distribution for a given quantity of traffic such that the more states a packet needs to be compared with the larger the variance in response time. I’m not sure, however, about the average response time however from the data I have so far that doesn’t seem to be likely, and if it is it’s not nearly as much as the change in variance.

What does this mean? If my data holds up (anyone know how to calculate the margin of error for the difference between two standard deviations for dissimilar sample sizes?) it means that you can reduce variance in your network response time by increasing the aggressiveness with which you timeout connections in a state-full firewall. This is particularly interesting if the average response time does not change.

One problem I’m working with right now is that one of my firewalls seems to have two periodic hiccups which result in 19.7 and 57.8ms response times from a locally connected host at some interval regardless of other changes. That is, if you graphed the distribution of the response times you would see two “bumps” on the graph at those points. I’m not sure how to explain this but since those values appeared in my control they should be accounted for in my new samples. Despite this the results still seem to show lower standard deviations of response time.

If I can correlate total search distance, that is the number of searches time the length of the table to changes in the standard deviation and I can correlate the traffic quantity and the distribution to figure how long of a delay I can expect to see x% of the time I can estimate when I need to add a firewall to my cluster of firewalls to maintain a particular service level.

Here’s the kicker… …I think I know what I’m talking about but I know just enough statistics to be dangerous, oh so dangerous.