Logicam QuickCam Express Over Yahoo! Messenger Traffic Characteristics
CAIA Technical Report 040625B
Ana M. Pavlicic
June 25th, 2004
Introduction
This investigation looks at packet inter-arrival time and length characteristics from web camera chats over a LAN with Yahoo! Messenger. It begins by investigating traffic characteristics of a single web camera transmitting to another user's computer. Next, we look at two users both transmitting web camera video to each other in both Basic (< 1 fps) and Super (up to 20fps) Webcam mode. Lastly, a user on one computer transmits and receives video with two, three, four, five and six other Yahoo! Messenger users.Generating and Capturing Web Camera Traffic
Traffic generated between computers running the web camera software was captured by Tcpdump running on the CAIA Bridge Machine. All web cameras in the investigation were Logitech QuickCam Express, able to generate up to 30fps and with a video resolution of up to 640x480 pixels. Web camera transmission was firstly initiated by the user on Computer 1 and was then reciprocated by a user on another computer. These results, however, are only representative of web camera transmission after all connections take place so as to only represent pure web camera video transmission.Yahoo! Messenger was set to transmit web camera video at the fastest speed possible (0.77fps) rather than the highest quality possible (0.26fps) to ensure more packets were captured given the short test time of 10 minutes per test. The only form of communication between the users on Computer 1 and Computer 2 was via video with naturally 'bobbing' heads as for a typical sitting-down and typing environment.
Web Camera Computer Configurations
Equipment Used for Generating/Capturing Web Camera Traffic
Figure 1.1: Web Camera Equipment Setup
We can see from Figure 1.1 that the Bridge Machine running Tcpdump was placed between Computer 1 and the Swinburne ITS network. The user sitting at Computer 1 exchanged video between up to six other users (Computers 2 to 7). These users only sent and received video to and from the user on Computer 1.
Bridge/Packet Sniffing Computer (136.186.299.64)
UnitronWeb Cameras
CPU: Pentium 3 800MHz
RAM: 256Mb
OS: FreeBSD 4.10
Brand: LogitechTcpdump was running on the Bridge Machine and Pkthisto 0.3.3 was used to generate packet traffic histograms. Pkthisto recorded a traffic flow once it saw 10 packets and packets were required to arrive more frequently than 10000ms for the flow to be considered active. This configuration was used to ensure no packets were lost for analysis. Each inter-packet arrival time and packet length histogram produced by Pkthisto represents a maximum of 200 packets.
Model: QuickCam Express
Application: Yahoo! Messenger v 5.6.0
USB Port
Results/Discussion
The data set used for analysis was collected in sessions lasting over 10 minutes. The final set of results was collected in order to investigate traffic characteristics to/from Computer 1 and three, four, five and six web cameras. These are called Connection A, B, C and D respecitvely. The following table outlines these connections:(Web Camera 1) |
||
When there is a one-to-one video conversation, video data is sent directly between the two participants, Computer 1 and Computer 2, as seen in Figure 1.2. In the case where the Computer 1 user conducts a video conference with more than one person, the video data and ACK packets are no longer sent directly between the user and video receivers, but are sent between the user and the Yahoo! server wc{X}.msg.dcn.yahoo.com. This can be seen in Figure 1.3. Since the video data that is being sent to the multiple users (on Computers 2-7) will be exactly the same, this data is sent only once to the Yahoo! server, from where it is distributed to all users that are to receive this identicial data.
Video data from each computer is still sent directly to Computer 1 and acknowledgements are sent to these users indivdually (peer-to-peer).
 |
 |
||||||||||||||
The following are the web camera traffic results obtained:
One Web Camera, One-Way Video Transmission - Sample time: 11min 9sec
Two Web Cameras, Two-Way Video Transmission - Sample time: 12min 47sec
Two Web Cameras, Two-Way Video Super Transmission - Sample time: 13min 45sec
Three Web Cameras, Two-Way Video Transmission - Sample time: 10min 19sec
Multiple Web Cameras Video Transmission - Sample time Connection A: 11min 55sec; Connection B: 10min 29sec; Connection C: 11min 1sec; Connection D: 13min 16sec
Summary and Further Analysis
The table below is a summary of the general inter-packet arrival times and packet size distributions observed from the two-way video transmission web camera network traffic.Activity between 60msec and 130msec |
38.7 to 47.6% = 1500bytes |
|
Activity between 60msec and 130msec |
||
(outliers: 42.7% and 73.6%) |
(outlier: 26.4%) 32.8 to 39.1% = 1500bytes (outliers: 22.4% and 47.3%) |
|
(outliers: 22.2% and 38.6%) Activity between 100msec and 200msec |
||
42.6 to 45.6% = 1420bytes |
||
Activity between 76msec and 118msec |
As we can see form the table above packets from a computer transmitting web camera video were mostly either 52bytes, 1420bytes or 1500bytes long. These packets would be replied to with 46byte TCP ACK packets. There was a wide distribution in packet inter-arrival times, most commonly below 1msec and between 100msec to 200msec.
Further investigation will include analysing and comparing data from other web camera software, such as Microsoft Netmeeting, for the purpose of modelling web camera traffic. It will aid in the development of software that uses packet statistics to identify and differentiate between applications producing traffic across a network.
Acknowledgements
Thuy Nguyen for her editorial assistance.CAIA research staff for their patience and participation during the data gathering period.
| ||||||||||||||||
|
