On the superposition of heterogeneous traffic at large time scales

Various empirical and theoretical studies indicate that cumulative network traffic is a Gaussian process. However, depending on whether the intensity at which sessions are initiated is large or small relative to the session duration tail, Mikosch et al. (Ann Appl Probab, 12:23-68, 2002) and Kaj and Taqqu (Progress Probab, 60:383-427, 2008) have shown that traffic at large time scales can be approximated by either fractional Brownian motion (fBm) or stable Levy motion. We study distributional properties of cumulative traffic that consists of a finite number of independent streams and give an explanation of why Gaussian examples abound in practice but not stable Levy motion. We offer an explanation of how much vertical aggregation is needed for the Gaussian approximation to hold. Our results are expressed as limit theorems for a sequence of cumulative traffic processes whose session initiation intensities satisfy growth rates similar to those used in Mikosch et al. (Ann Appl Probab, 12:23-68, 2002).


Introduction
Collection of data network measurements often uses an algorithm for clustering packets with the same source and destination IP addresses. Various criteria for grouping packets yield different entities, e.g. connections, flows (or unidirectional connections), end-to-end streams, etc. (See e.g. Sarvotham et al, 2005, Section 4). These high-order constructs of packet clusters are sometimes termed sessions. For now, think of a session as a user downloading a file, streaming media, or accessing websites. For each session, summary measurements are computed for the size (the number of bytes transmitted in a session), the duration of the session and the average transfer rate. Data sets of these summaries show some distinctive properties, such as heavy tails for session size and duration (Arlittson and Williamson, 1996;Crovella and Bestavros, 1997;Willinger et al, 1998) and sometimes rate (Maulik et al, 2002;Resnick, 2003).
Typically, a time resolution or granularity is selected or imposed. Typical resolutions are 1, 10 or 100 milliseconds, 1 second, 1 minute, 1 hour, etc. Once a resolution is fixed, the number of bytes or number of packets per unit time can be recorded and cumulative network loads over stationary time intervals computed. These cumulative loads have been studied from empirical and theoretical perspectives with the objectives of satisfying performance criterion and offering adequate bandwidth provisioning (van de Meent and Mandjes, 2005) or predicting properties of congestion events (Jin et al, 2007).
Conventional wisdom based on empirical studies claims that a heavily loaded network link subject to aggregation over many users should see Gaussian traffic. This wisdom is considered a network invariant . Influential examples based on the Bellcore measurements (Leland et al, 1994) suggest that horizontal aggregation, that is, working with a single on/off stream at sufficiently large time scale justifies Gaussian modeling. See also Kurtz (1996) and Willinger et al (1997).
However, mathematically it is known that with heavy tailed session durations, cumulative load at large time scales can be approximated by either fractional Brownian motion (fBm) or stable Lévy motion, depending on whether the intensity at which sessions are initiated is large or small relative to the size of the duration tails. See Mikosch et al (2002); Kaj and Taqqu (2008); Taqqu et al (1997). The stable approximation has not been observed empirically (Guerin et al, 2003) and use of Gaussian cumulative loads has become dominant (Kilpi and Norros, 2002;Sarvotham et al, 2002;Jain and Dovrolis, 2005).
But why should traffic be Gaussian? According to the empirical study van de Meent et al (2006), in addition to horizontal aggregation, the superposition of independent traffic streams, that is, vertical aggregation, can justify a Gaussian model and, in fact, the number of traffic streams need not be large to make cumulative loads approximately Gaussian.
In this paper we • study the distribution of the cumulative load in the presence of a finite number of independent traffic streams; • give an explanation for why Gaussian examples abound in practice but not stable ones; • answer how much vertical aggregation is needed to justify the use of fBm.
Our findings suggest that cumulative load for aggregate traffic can be approximated by fBm at large time scales provided the initiation intensity of at least one of the traffic components is large. Network traffic in the wild has several distinct constituents and we claim that in practice there is one or more components with dominant large initiation intensities. For example, this should be the case with web traffic using port 80 and this suggests why Gaussian traffic should be pervasive (van de Meent et al, 2006).
Before discussing mathematical details, we illustrate the phenomena of interest with a motivating example of a network trace captured at Cornell University main campus servers during 55 days between November 2, 2009, and January 15, 2010. Cornell's data set is a collection of netflow records, where all non-IP traffic has been discarded and only TCP and UPD traffic is present in the trace. A netflow is a collection of packets with the same source and destination IP addresses, source and destination ports, protocol, ingress interface and IP type of service (Cisco Systems, Inc., 2007). In our data, TCP traffic accounts for nearly 90% of the bytes, and over 80% of the total number of netflows, mostly port 80 (http traffic) netflows. We have taken the part of the trace corresponding to both outgoing and incoming traffic between 1 and 5 p.m. local time, adding up to 220 hours of traffic. The anonymization procedure used on the data obliterated the distinction between outgoing and incoming flows.
We analyze the distribution of A (T CP ) and A (UDP ) , namely the cumulative load generated by TCP and UDP bytes, respectively. For this purpose, we separate the trace into TCP and UDP netflows and for k = 1, . . . , 220 we count Due to the dates and times of collection, these counts exhibit both a trend and a daily seasonality. Here we detrend and remove daily seasonality (see e.g. Brockwell and Davis, 1991, Section 1.4), but our conclusions are the same without this massage. Figure 1 shows Gaussian QQ plots for A (T CP ) (left ) and A (UDP ) (right ). A straight line fit is evident for the TCP cumulative input. However, the UDP counterpart shows a significant departure from the straight line. Using the p-values of the Anderson-Darling two-sided test also shows no evidence against the normality of A (T CP ) (p = 0.1369), but strong evidence against a Gaussian model for A (UDP ) (p = 9.8 × 10 −16 ).
We also check whether A (UDP ) is a heavy-tailed random variable, in the sense of its distribution tail being regularly varying with tail index α (de Haan and Ferreira, 2006;Resnick, 2007). For instance, Figure  2 left shows a stable regime in the Hill plot of α (for Hill plots, see e.g. Hill, 1975;de Haan and Resnick, 1998;Resnick, 2007). Additionally, in Figure 2 right we present the exponential QQ plot of log(A (UDP ) ) with a straight line fit through the biggest 55 observations. This shows no evidence against approximating the distribution of thresholded values of A (UDP ) by a Pareto (Recall that the logarithm of Pareto random variable is exponential; see, for example, Mc Neil et al (2005); Resnick (2007); Coles (2001).) If we consider the aggregated cumulative load, A (T CP ) + A (UDP ) , the normal QQ plot in Figure 3 exhibits a straight line fit and the Anderson-Darling test p−value is 0.2117, showing no evidence to reject normality. Without accounting for centering and scaling, this result is rather counterintuitive due to the nature of the individual tails of A (T CP ) and A (UDP ) .
Our explanation to the above phenomenon starts by modeling the quantity of data in windows of length T in Section 2. Analogously to the slow and fast growths of Mikosch et al (2002), we define two different scenarios for the aggregated traffic. A third scenario is defined similarly to the boundary case considered in Kaj and Taqqu (2008). In Section 3 we obtain approximations and provide clarification of the asymptotic behavior at large time scales. We let T → ∞ and see what limits exist for the aggregated cumulative load.  In Section 4 we study extensions to our model and finally Section 5 contains some technical results used to prove our main theorems.
1.1. Notation. In order to simplify the later presentation, we introduce and collect some notation. References are provided for further reading.
Gaussian Quantiles Sample Quantiles Figure 3. Normal QQ plot of the aggregated cumulative input.

F
The right tail of the distribution function F , i.e.F = 1 − F . F ← The left continuous inverse of the distribution function F , i.e. F ← (y) = inf{x : Vague convergence of measures. See e.g. Kallenberg (1984); Resnick (1987).
A γ−stable random measure with control measure m(dv) and stable index 1 < γ < 2.
The standard fractional Brownian motion with Hurst exponent H.

Model Description and Basic Assumptions
Consider a network that has an infinite number of nodes. At certain times, a node begins a transmission session at a random rate that is fixed throughout the session. Suppose network traffic consists of p distinct types which we call streams. In practice, such a division of network traffic arises naturally; e.g. traffic can be segmented by application type (web, email, streaming media, file-sharing applications, etc.), by protocol (TCP, UDP, IMTP, etc.), and even by users. We suppose the p streams are independent and that each follows an M/G/∞ input model. The overall load is obtained by aggregating over the p streams. Thus, the basic assumptions are as follows: • Sessions corresponding to the jth stream are initiated at homogenous Poisson time points {Γ (j) k , −∞ < k < ∞} with arrival intensity λ (j) > 0. These points are labeled so that Γ (j) k , k = 0)} are iid exponential with parameter λ (j) . Thus, we have: We assume that these PRMs are independent. • All the sessions in the network transmit data at positive random rates that are iid with common distribution F R . Let {R (j) k } be the rate of the kth session of the jth stream. Assume that either • We also assume mutually independent durations across streams, and that durations and rates are independent.
There is empirical evidence justifying the choices of α (j) D s and α R : See e.g. Cunha et al (1995); Willinger et al (1995); Leland et al (1994); Resnick (2003); López-Oliveros and Resnick (2009). For now, we adopt a network-centric approach by assuming the rate of communication entirely depends on the state and speed of the network. Studies supporting this assumption include Shakkottai et al (2005) and Kortebi et al (2005).
In fact, F D is the distribution of the duration of the sessions of the aggregated stream, and λ (j) /λ is the proportion of the traffic that consists of sessions from the jth stream. We return to this interpretation later. Now consider (s, u, r) as a generic Poisson point representing a session that starts at time s, has duration u and rate r. By augmentation, the counting function of the session descriptors (Γ du)F R (dr)), j = 1, . . . , p.
(2.6) By independence, the counting function of the session descriptors of the aggregated stream is Thus, the mean measures of the N (j) and N are given by In addition, let be the length of the subinterval of [0, t] during which the session (s, u, r) transmits data. In Lemma 5.4, we summarize several required properties of L t (s, u).
For each j, define and similarly (2.10) (Kaj and Taqqu (2008) showed that these integrals are well defined using Campbell's theorem (Kingman, 1993, Section 3.2).) Also, where is the mean of the mixture model of the durations of the different streams.
Observe that we can write the cumulative inputs as linear drift plus compensated random Poisson fluctuation as follows: After scaling time by T , we think of A (j) . . , p and A T : = (A(T t), t > 0) for large T , as the cumulative inputs on large time scales. Thus, we consider a family of models indexed by the time scale parameter T and from now on we let the arrival intensities depend on T so that λ (j) := λ (j) (T ). If necessary, we let λ j (T ) → ∞ as T → ∞ (see (2.15)). Dependence of the arrival intensities on T means λ, F D , b (j) D and b D as defined in (2.1)-(2.4) depend on T as well; however, notice that the tail indices of the distribution of the duration, namely α (j) D , remain independent of T . In practice, the fact that we focus on the stream at a particular time period, say [0, T t], does not affect the tail index of the distribution of the sessions duration, which is in accordance with our assumptions. For convenience, we often suppress the subscript T .
Fix j, 1 ≤ j ≤ p and in the T th model, let A (j) cs (t) be the centered and scaled cumulative input of the jth stream in [0, T t], that is for a suitable a j (T ) to be made precise below. Assuming lim T →∞ λ (j) TF cs (t) as T → ∞, depends on whether the arrival rate is large, moderate, or small, relative to the tail of the duration.
For any 1 ≤ j ≤ p, consider the following three growth regimes of the arrival rate: where c j ∈ (0, ∞). (The form of the moderate-growth limit facilitates a simple expression of the corresponding limit process.) Assume that eitherF D , the limit process is the same for all three growth regimes and the distinction among the growth regimes is irrelevant (Kaj and Taqqu, 2008, Theorem 4).) (a) Under fast-growth, we distinguish two subcases:

and B H (j) is a fractional Brownian motion with Hurst exponent
D -stable Lévy motion totally skewed to the right, which we can write as Real network traffic consists of several distinct types and in this paper we are interested in the centered and scaled cumulative input of the superimposed streams in [0, T t], namely for a suitable a(T ). In order to study the limit distribution of A cs (t) as T → ∞, let F , M, S be the subsets of indices of streams whose arrival intensities behave under the fast-, moderate-, and slow-growth regimes, respectively. Assuming that all indices belong to one of these three classes, consider the following scenarios.
Scenario F : There is at least one stream whose arrival intensity satisfies fast-growth; i.e. F = ∅. In this case, the aggregated stream's arrival intensity also satisfies fast-growth: Scenario M: No stream's arrival intensity satisfies fast-growth, but at least one stream satisfies moderate-growth; i.e. F = ∅ and M = ∅. Then, the aggregated stream's arrival intensity satisfies moderate growth, since . (2.20) Scenario S: All the stream's arrival intensities satisfy slow growth, that is S = {1, . . . , p}. In this case, the aggregated stream's arrival intensity also satisfies slow-growth: The different growth regimes in Theorem 2.1 are specified by the arrival intensity λ (j) , and the distribution F D does not vary with T . However, the growth regimes described in Scenarios F , M and S are given in terms of the arrival rate λ, and the distribution F D of the duration of the sessions of the aggregated stream and here both λ and F D vary with T , as seen in (2.2). Therefore, we cannot directly apply Theorem 2.1 for the aggregated stream when λ (j) /λ = proportion of the sessions that belong to the jth stream, j = 1, . . . , p, ( 2.22) are functions of T . Nevertheless, in the special case that these proportions are constant, F D does not vary with T , and a direct application of Theorem 2.1 yields the following result.
Corollary 2.2. Suppose that for all T (or at least for T large enough), the proportions λ (j) /λ remain constant, j = 1, . . . , p, so thatF where α D is given in (2.19). Let the Scenarios F , M and S take the place of the fast-, moderate-and slow-growth regimes.
D and c j are replaced by α D , F D and the constant c in (2.20), respectively.
IfF R ∈ RV −αR , α R ≤ α D , the distinction among Scenarios F , M and S is irrelevant, and limit results are discussed in Section 4.
Implications of Corollary 2.2. This result provides a partial answer to the question of how much aggregation is required for traffic to be Gaussian at large time scales: Suppose that at least one traffic stream falls in the fast-growth regime, thus generating a cumulative input that can be approximated by fractional Brownian motion. When applicable, Corollary 2.2 implies that the superimposed traffic load can also be approximated by fractional Brownian motion.
In the case that the traffic also contains streams that satisfy the slow-growth regime, Corollary 2.2 is somewhat counterintuitive due to the nature of the distribution tails of the two limit processes. Although these slow-growth streams produce cumulative inputs that are approximately stable Lévy-motion when considered individually, with the inclusion of one single stream that behaves under the fast-growth regime, the cumulative aggregated input is approximately Gaussian.
Moreover, a sufficient condition for the fast-growth regime of Scenario F is that a single stream, say the jth one, satisfies fast-growth, even if all the other streams' arrival intensities do not follow a growth regime at all. In this sense, Scenario F is a robust assumption. We will see that as long as one α (j) D < α R , the limit result of Corollary 2.2 is still valid.
In real networks, there are arguably streams with large initiation rates. For instance, the arrival rates of http traffic must be large, since there are a large number of users constantly accessing websites and this translates into Scenario F . Furthermore, even though some studies report or assume session transmission rates have infinite variance, the assumption E[(R (1) 1 ) 2 ] < ∞ may be justified by rate constraint mechanisms required for congestion control. Although assumptions always deserve rigorous scrutiny, Corollary 2.2 provides a compelling explanation for the data example in Section 1.
We now address more general assumptions which allow the conclusions of Corollary 2.2 to hold. While the assumption of constant proportions λ (j) /λ may sometimes be reasonable, in general the proportions of sessions corresponding to the p independent streams are not constant over time. We may have that lim λ (j) /λ exists or, more generally, that λ (j) /λ ∈ (a, b) ⊂ (0, 1) varies with no limit whatsoever. Extending the conclusions of Corollary 2.2 to under weaker assumptions is the focus of the next section.

Behavior of cumulative load of aggregated streams
We prove that the conclusion of Corollary 2.2 is still valid even when the proportion of the sessions corresponding to the p independent streams is not constant. Here is the result: Then, the conclusions of Corollary 2.2 regarding the limit distribution of the cumulative input of the aggregated stream A cs (·) are still valid.
Condition 3.1 implies that there exists d > 0 such that for all T sufficiently large, there is at least one k = k(T ) such that α (k) D = α D and λ (k) /λ > d. Roughly speaking, this means that the proportion of the traffic with the heaviest-tailed duration always remains greater than a positive quantity.
All the limits in Theorem 3.1 follow from the convergence of the characteristic function of the finitedimensional distributions (fidi chf ) of the processes. Thus, let m ≥ 1 represent the dimension, 0 ≤ t 1 , . . . , t m the times, and z 1 , . . . , z m arbitrary real numbers; we need as defined in Proposition 5.6.
From the second integral in (2.8), we can compute the partial derivative of L t (s, u) with respect to u, which yields where g u is the partial derivative of g(s, u, r) with respect to u. Moreover, putting together (5.4), (5.16), (5.18), the bounds in Lemmas 5.4 and 5.7, we get We will use three more relations in the proof of Theorem 3.1: For 0 < η < 1, there exists a number We can readily derive (3.4) from Lemma 5.3. Both (3.5) and (3.6) follow from Markov's Inequality and, for example, Resnick (1987, Proposition 0.8) or Bingham et al (1987, Proposition 1.3.6).
Proof of Theorem 3.1. First, we will prove parts (b) and (c). For both parts, set 0 < η < α D − 1 and 0 < ζ < 1 such that Part (b). Under Scenario M, use a(T ) = T and apply Proposition 5.6, yielding and if we can take the limit inside the integral as T → ∞, performing afterwards an integration by parts in u gives which is the log fidi chf of cY αD (·/c). Thus, it suffices to justify taking the limit inside the integral.
First observe there exists a number T 0 > 0 such that for T ≥ T 0 , by the moderate-growth assumption. Together with (3.3)-(3.5) and a possibly larger T 0 , the above implies that the integrand in the left side of (3.7) is bounded in  Now, apply Proposition 5.6, perform the change of variables r → ra(T )/T , u → uT /a(T ), and use the scaling property in Lemma 5.4 to get and assuming we can take the limit inside the integral, the limit as T → ∞ is . Therefore, we must justify passing the limit inside the integral. This is done as follows.
By (3.2), as T → ∞ g u (s − u, u, rT /a(T ))(a(T )/T ) Hence, assuming we can pass the limit inside the integral, we use Lemma 5.4 (iii) to write where the last line follows by rearranging of the terms in the sum, σ 2 BH (1) is given in (5.10) and H = (3 − α D )/2. It remains to prove that we can take the limit inside the integral.
Let 0 < η < α D − 1. We use (3.3)-(3.5) with ζ = 1 and a possibly larger T 0 , which imply that the integrand in Eq. 3.12 is bounded in {u ≥ T 0 /T } by The result now follows by the dominated convergence theorem, since and both bounds are finite by our choice of η.

Furthermore, by fast-growth and regular variation ofF
Similarly, integration by parts and (3.5) with T ≥ T 0 such that ǫ < T 0 /T yields where we used the bound (3.9). Thus lim sup (3.15) where the exponent of ǫ is positive if we additionally let (α R + α D + η)/2 < 1 + ζ.
For I (r<ǫ) , use again Lemmas 5.4 and 5.7 to get a d 1 > 0 such that Analogously to the bound for I (u<ǫ,r>ǫ) , it can be readily shown that there exists T 0 > 0 such that for T ≥ T 0 Also, by fast growth and the regular variation ofF R Finally, we can put together (3.13)-(3.17) to write:

Remaining choices of α D and α R
We first study what happens if α R < α D , namely, α R < α (j) D for j = 1, . . . , p. Consider the centered and scaled cumulative input of any of the streams, say the first one, for simplicity. Set the normalizing term to a (1) (T ) = b R (λT ) (and the same for all other streams). Write First, note from the definition of L t (s, u) in (2.8) that Thus, analogous to the proof of Proposition 5.6, it can be shown that the log fidi chf of A Now observe that, provided we can take the limit inside the integral Since |λ (1) /λ| ≤ 1, then which yields the following result.
In principle, it also is possible to have α D = α R . However, we cannot say much except in the special case α D = α R = 2, in which case the limit process is a Brownian motion provided (4.6) holds. We refer the reader to Kaj and Taqqu (2008, Theorem 4) for the formal statement of this case.

Technical proofs
This section contains a collection of technical results needed for our proofs. The first lemma establishes bounds for b D (·) = (1/F D ) ← (·) which yield b D (λT ) → ∞. This is not immediate since the function b D depends on T .
Thus, the left side of (5.1) follows. On the other hand, since F D is right continuous, we have for each j = 1, . . . , p: Therefore, the right side of (5.1) follows.
D of session durations of superimposed streams is a function of T since λ (j) and λ depend on T . Nevertheless,F D behaves as a regularly varying function.
Lemma 5.2. Under the assumption (3.1) (5.2) and therefore, in Proof. Note thatF D ∈ RV −αD for each fixed T . However, because F D varies with T , the limit is not straightforward.
Fix an arbitrary u > 0. We start by writinḡ and additionally write Thus, the first limit in (5.2) will follow by proving B 1 → u αD , B 2,j → 0 and C j → 0 as T → ∞, for all j such that α Choose an arbitrarily large z > min{u −α (j) D , u α (j) D }. By regular variation, for T sufficiently large:F (k) Furthermore, the assumption (3.1) means there exists d > 0 such that for all T sufficiently large, there is some k ′ := k ′ (T ) such that α (k ′ ) D = α D and λ (k ′ ) /λ > d. Hence for T sufficiently large: This shows that B −1 2,j can be made arbitrarily large for T sufficiently large, whence B 2,j → 0 as T → ∞.
Similarly, consider C j , and This shows that C −1 j can be made arbitrarily large for T sufficiently large, which completes the first part of the Lemma.
For the second limit in (5.2), recall that z < b D (λT ) iff 1/F D (z) < λT for each T . For ǫ > 0, setting Letting T → ∞ and using Lemma 5.1 and the first limit gives Because ǫ is arbitrary, then lim The final statement about vague convergence follows the proof of Resnick (2007, Theorem 3.6).
Even though F D depends on T , a version of Potter's bounds holds.
We now study L t (s, u), as defined in (2.8).
Lemma 5.4. The length of the subinterval of [0, t] during which the session (s, u, r) transmits data, namely L t (s, u) in (2.8), satisfies the following properties: (i) Scaling property: For C > 0, CL t (s, u) = L Ct (Cs, Cu).
(5.4) (iii) Integrals: For 1 < γ < 2 and nonnegative t 1 , t 2 , Proof. The scaling property and the bounds follow directly from (2.8). Now, the first part of Property (iii) is readily checked by using the first integral in (2.8) after reversing the order of integration. Finally, the second part of Property (iii) can be derived by writing and integrating accordingly. Observe that the four regions in which L t1 (s − u, u) is nonzero correspond to those of the basic decomposition in Mikosch et al (2002, Eq. 4.1).
The next lemma helps obtain approximations to the cumulative input of the aggregated streams. Proof. All the relations here follow from several ways to change variables in (2.13) and using the scaling property of L t (s, u). See Lemma 5.4.
Our limit theorems are proved by verifying convergence of finite dimensional distributions for various processes. The following is required.
Proposition 5.6. For arbitrary m ≥ 1, 0 ≤ t 1 , . . . , t m , and real z 1 , . . . , z m , define where g u is the partial derivative of g with respect to u. (b) The fidi chf of the limit processes in Corollary 2.2 are given as follows.
(i) The fidi chf of the limit process under Scenario F and E[(R where B H is fractional Brownian motion with , (5.10) and H = (3 − α D )/2. (ii) The fidi chf of the limit process under Scenario F andF R ∈ RV −αR , 1 < α R < 2, is given by iii) The fidi chf of the limit process under Scenario M is given by (iv) Finally, the fidi chf of the limit process under Scenario S is given by h(s, u, r)dsduF R (dr). (5.13) Proof. Given (5.7), (5.8) is readily derived using integration by parts and the change of variables s → s + u. Moreover, (5.9) follows from the fact that B H is fractional Brownian motion. The remaining parts are a consequence of the following property of Poisson random measures (See e.g. Rosiński and Rajput, 1989): For now, let us focus on (5.7), (5.11) and (5.12). By Lemma 5.5, the exponent in the left side of (5.7) and (5.11) is of the form for a PRM ξ, while the exponent in the left side of (5.12) is c αD −1 times (5.14), using Lemma 5.4 and the change of variables s → s/c, u → u/c. Thus, it suffices to check that and whence (5.11) holds. Similarily, split the integral (5.15) corresponding to the process (5.12) into two parts J (<) and J (>) , according to the two domains of integration D (<) and D (>) , which yields Analogous to the proof of (5.12), it is readily shown that The result now follows after an integration by parts in the variable u.
Finally, the following result is used to get upper bounds for some integrands throughout the proof of Theorem 3.1.
Multiplying both sides by |x 2 | ζ proves (5.18) for m = 2 and the proof for general m follows by induction.
6. Acknowledgements S. I. Resnick was partially supported by ARO Contract W911NF-10-1-0289 at Cornell University. Dan Eckstrom and Ed Kiefer (CIT-Network Communication Services, Cornell University) and Eric Johnson (ORIE, Cornell) were very helpful with arrangements and collection of the Cornell flow data.