Subject: Re: [ippm] statistics techniques

From: "gab.seun jones.ewulomi" <[email-masked]>
Date: Thu, 20 Feb 2003 20:26:06 +0000

Hi Guys,

First of all my sincere apologies for any mis-understanding I could have 
caused. I didnt think it would matter to explain my goal because i thought 
it was a trivial question(thanks Kave for the wise words). I am by no means 
as clued up as you guys (just a beginner who isnt scared to do some 
mathematical crunching). Please bear with il just try and explain as my 
knowledg permits me.

This question was a cause of a little discussion/arguement with my boss and 
I in which I tried to explain that the median of the ping collection we took 
would make more sense than the mean.

first of all we have private network meaning we manage all our links and the 
isp's do all the switching at the exchange points. So in any case rtt should 
I say is fairly constant to nodes(sites - assuming taking into consideration 
transmission and propagation and also assuming no traffic) the only think 
that could probably bumps up the rtt are queueing or process delays at each 
hop.

What I expect from this test is to find out as Kave.S stated the rtt 
distribution within the 100 count. Although I definately welcome taking it 
further as Kave.S and Sandrine.V suggested by being able to predict rtt from 
past measurements e.g predict rtt in count 101. I will still greatly 
appreciate any pointers.

Taking this into consideration and as Stanislav stated you might get losses 
which will probably throw away trying to work out the average e.g loss could 
be > rtt_max.
Also I found out when I worked out both the mean and median and mode, they 
were always usually equal  which i think implies that the data are 
symmetrically distributed(im only assuming within this 100 count in which 
all the values are not far from the median. They aren't that dispersed). But 
taking the median took into consideration the skew which was very minimal.
Taking the Mean I found out doesnt tell you much about whether there is a 
fit within a particular range. Taking all this in I automatically assumed 
the median showed a more true picture.

I do agree that delay should be taken into consideration and if we know what 
delay_max is and if we get delay > delay_max as suggested will certainly be 
worthy information to know(I havent gone as using bayesian techniques yet to 
determine what the delay would be).

My goal was to find out the differences by comparing means or medians which 
I believe are both measures of the center of a distribution(please correct 
me if im wrong). If the data were totally symmetrical distributed(no skews), 
taking the mean would(i think) be a reliable measure of the center or 
average.

I wanted to graphically illustrate approximate location of the quartiles, 
including the median, and the extreme values. Basically have short term view 
of mean rtt as well as median rtt

I certainly need to enrich my model as Sandrine.V suggested because I havent 
taking into account packets that could be lost or delivered at a later time

This has gone well beyond me any more pointers will be greatly appreciated

regards,
seun

>From: stanislav shalunov <[email-masked]>
>To: Sandrine Vaton <[email-masked]>
>CC: [email-masked]
>Subject: Re: [ippm] statistics techniques
>Date: 20 Feb 2003 12:07:11 -0500
>
>Sandrine Vaton <[email-masked]> writes:
>
> > stanislav shalunov a écrit :
> >
> > > Sandrine Vaton <[email-masked]> writes:
> > >
> > > > SV -> Hum hum I did not get that point. That looks tricky. But,
> > > > unless you are in a model with only one parameter (an exponential
> > > > distribution for example) the median will not be sufficient to fully
> > > > determine the distribution.
> > >
> > > As would be the mean.
> > >
> > > But, I didn't even say I make any assumptions about the model.
> >
> > The problem is that most of the time you need more than one parameter to
> > characterize a distribution. For example for a Gaussian distribution you 
>need
> > the mean and the variance, unless you suppose that there is a 
>relationship
> > between mean and variance (for example variance=mean^c with c=...)
>
>How does this make mean relevant?  I am saying that it is a better
>practice to report median of delays than attempt to report mean of delays.
>
> > > > SV -> This is true when the noise is additive with a symetric 
>distribution
> > > > around the origin.
> > >
> > > Suppose 1% of measurements is distorted (by a very large margin).
> > > Median is unlikely to be affected.  Mean is.
> >
> > The median will be affected if you have more than 50% of "censored"
> > RTT. I agree with you for saying that with only 1% then the median
> > is not affected.
>
>If more than 50% of packets are lost, you ought to report median=infinity.
>If any packets are lost, you ought to report mean=infinity.
>
>Which one is better?
>
> > But once again the median is maybe not the only parameter of
> > interest. In particular, the distribution of the delays is clearly
> > not exponential, is it?
>
>It is unlikely that packet delay is a random quantity from a
>statistical point of view.  (There's no probability space, there's a
>feedback loop, etc.)  Certainly different measurements (taken close
>enough) are not independent.
>
>If one were to model delay as an i.i.d. random quantity, then shifted
>exponentially distributed delay (two parameters) might be appropriate
>for certain regimes, but polynomial distribution (perhaps
>1/(a*(x-b)^3), two parameters again) seems better supported by
>evidence.  Others suggested gamma-distribution and a host of
>heavy-tail distributions.
>
>There are certainly at least two independent quantities: the
>propagation delay and some measure of the queuing delay.  I like
>minimum and median to represent these two.
>
>--
>Stanislav Shalunov		http://www.internet2.edu/~shalunov/
>
>A fool's brain digests philosophy into folly, science into superstition,
>and art into pedantry.  Hence University education.       -- G. B. Shaw
>_______________________________________________
>ippm mailing list
>[email-masked]
>http://mailhost.advanced.org/mailman/listinfo/ippm

_________________________________________________________________
Chat online in real time with MSN Messenger http://messenger.msn.co.uk

_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm

---

From: "gab.seun jones.ewulomi" <[email-masked]>
Date: Fri, 21 Feb 2003 17:42:15 +0000

hi,

I presume thats why I chose to use the median because i was just using 100 
counts as by base measurement.

The time is a big factor because as you rightly stated even if the rtt 
reached a max at time t and reached a minimum at time t. I will certain like 
to know about the rtt at especially the max t time.
Assuming I will start doing counts=100 at 2hr intervals =1200 counts per 
day. So will taken the mean, median, max rtt, min rtt be a good starting 
point. Also will taking the variance for like chunks of the samples e.g for 
every daily sample of 1200 count take the variance sample size(count)<500 
daily(from the daily samples) give me the spread of a distribution about its 
average value within a set of sample data or is there a better way to 
approach this

regards,
gab

>From: Jing Shen Reply-To: [email-masked] To: stanislav shalunov CC: 
>Sandrine Vaton , [email-masked] Subject: Re: [ippm] statistics 
>techniques Date: Fri, 21 Feb 2003 10:43:45 +0800
>
>The RTT value is at least related to two factors: the time of measurement 
>and the status of network. To some of the measurement, RTT reaches its 
>bigest value at 9-10 o'clock and 15-16 o'clock, and the lowest value is 
>reached at 3-5 o'clock. So it's self-similar, and from viewpoint of statics 
>mathematical expectation should be value we need.
>
>In a 100 sample points measurement, it may be a better choice to take the 
>median value if the measurement time is fixed.
>
>
>
>
> >It is unlikely that packet delay is a random quantity from a >statistical 
>point of view. (There's no probability space, there's a >feedback loop, 
>etc.) Certainly different measurements (taken close >enough) are not 
>independent.
>
> >for certain regimes, but polynomial distribution (perhaps >1/(a*(x-b)^3), 
>two parameters again) seems better supported by >evidence. Others suggested 
>gamma-distribution and a host of >heavy-tail distributions.
>
> >There are certainly at least two independent quantities: the >propagation 
>delay and some measure of the queuing delay. I like >minimum and median to 
>represent these two.
>
>
>--
>Jing Shen
>
>
>
>
>********************************************************************** * 
>The SunShine of life is made up of very little beams which is * * bright 
>all the time * 
>********************************************************************** 
>_______________________________________________ ippm mailing list 
>[email-masked] http://mailhost.advanced.org/mailman/listinfo/ippm

_________________________________________________________________
It's fast, it's easy and it's free. Get MSN Messenger today! 
http://messenger.msn.co.uk

---

From: Kavé Salamatian <[email-masked]>
Date: Wed, 19 Feb 2003 19:41:09 +0100

>I can not speak for the original poster, but since you appear to be
>addressing me while (not?) answering his questions:
Not only, but the community. I think that the kind of trivial question I am
asking are not so trivial and they will shed some light on what we are doing
and on what is asked.

>1. The values of delay for lost packets are not ``missing''.  They are
>   potentially very large unknowable values.  That packet that I sent
>   last year and that appeared to be lost might still be delivered one
>   day.
Some of the inexisting values are indeed missing (relative to real packet
loss). Some of them are censored values. The two problems are well known and
well documented. It suffices to have a look to a good introductory level
statistical book.

>2. The necessity for aggregation is more about human consumption of
>   data than about using it to predict anything or to compute
>   parameters of a distribution (there's no distribution).
Correct. The Occam's razor, which is attributed to the mediaeval philosopher
William of Occam (living in 15th century in the oldish europe), underlies
that in all scientific modelling and theory building we should choose from a
set of otherwise equivalent models of a given phenomenon the simplest one.
However using this razor should be done with some cautions (as using any
razor). By aggregating are you not loosing something essential ?? Clearly
the statistical mean, mode, median, is not a universal aggregation tools. In
fact using the mean, mode or median as a aggregation tools pre suppose (even
if you are not aware of this, you are doing it) that you can describe the
compressed (aggregated observation) in only this value. Clearly there is
only one case that this is a valid assumption, the poisson pdf. Out of this
you need at least the variance, you will have a parametric a priori which is
the gaussian.

You are saying there is no distribution. But if you are in the real world
there is always distribution, and every computation is an estimation, and
for every estimation there is a statistical test. By using the mean, median
or mode as an aggregation parameter, what is the statistical test.... If you
think, you will see that the statistical test is "H0: The estimated mean,
median or mode is the parameter of a model describing the measurements". In
every test you have an associated risk. The risk is relative to the
application you are doing of the test results. Let's suppose that I
calculate the mean and I erase the measurement, now I use only the mean to
replace the erased values. Now if I use a quadratic risk function, my risk
is asymptotycally converging (under stationnarity and ergodicity conditions)
to the variance of the measured parameter. Is this risk acceptable?
Sometimes, yes, sometimes not. This is why the aggregation question has not
any universal answer (out of classical non lossy compression schemes as
Lempel Ziv and so).

If arbitrary answer is possible I would rather like and estimate the first
derivative of the Characteristic function calculated at s=0. It is a more
pedantic and funnier aggregation parameter :-)))

>   Minimum (or something close to it) is meaningful in itself: given enough
>   measurements, it's a reasonable guess of propagation delay.

Great. You have in mind a parametric model that the observed delay is the
summation of the propagation delay and a positive perturbation parameter
(let say it n). Your estimator is the minimal value oberved over N
observations and your associated risk with a quadratic risk function is
converging (under the same stationnarity and ergodicity constraints) to
E{Min{d_1, ..., D_N}}.

> Median is useful for several reasons:
>
>
>   a. It reflects the whole sample.
It reflects only the mean aspect of the sample, not the whole sample.

>   b. It is well-defined for samples where more than 50% of packets
>      arrived during the measurement (thus making it widely usable).
It is well defined whenever one measurment is avaiable, however the risk
induced by using this estimate of the mean can be large if a quadratic
criteria is used and less than 50% of packets arrived during the
measurements.

>   c. It is robust.
To what kind of problem. Let suppose that I have a network which have two
set of routing table. One for night and one for days. Routing  change every
night at 8 PM sharp and 8 AM Sharp. I have regularly measured the delay from
9 AM to 9 PM. Now is median robust to this? Clearly median, mode and mean
are not robust.

>   d. It is easy to understand.

A fanatic is one who can't change his mind and won't change the
subject.                                   -- Winston Churchill
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm