Why Video Monitoring Matters

By Roger Boivin

Network infrastructure and Internet services have dramatically changed in recent years.  As the industry evolves, video streaming traffic will continue to increase.  Market Research predicts the global market size, which was pegged at USD 42.6 billion in 2019, is expected to register a CAGR of 20.4% from 2020 to 2027.  Demand for more bandwidth and high speed are increasing and customers expect high Quality of Service (QoS) and Quality of Experience (QoE) as the norm.   Cloud computing has brought these infrastructure and services into public domain, increasing privacy requirements and greatly impacting how services are delivered. Encrypted user traffic is now used in all Internet services, from finance to entertainment and personal communication.   As infrastructure and services have evolved, monitoring and operations have needed to follow suit. Using invasive techniques are no longer enough, or in some layers, these techniques are completely ineffective. Deep Packet Inspection is becoming more difficult to use because of increased  bandwidth and the use of encryption. While looking inside the packets can provide useful information, shifting focus over to learning from the traffic behavior will provide a new perspective, supplemented by early anomaly detection and finding KPIs for QoS and QoE.   For cloud infrastructure, the standard monitoring metrics are not enough to provide visibility of the service mesh that interconnects the hundreds of micro-services instances deployed.  In order to provide visibility into the performance and efficiency of these new services, it is required to look into the sublayer that they support.   Encrypted Video Stream Services   For example, monitoring user’s QoE of video streaming and on-demand video has become a big challenge for ISPs and enterprises. Encryption of video traffic has made DPI techniques obsolete for detecting key quality parameters of a video stream or for detecting changes in the quality of the stream as it moves through a network before it reaches the end user.   To track important KPIs that provide meaningful information to the network administrators, advance machine learning (ML) techniques are needed to detect and correlate traffic patterns of the video streams and identify if there is an impact to the end users’ QoE and QoS.   QoS KPIs, such asjitter, packet loss, and latency, can be measured by DPI and/or traffic metrics that are found by Layer3 and Layer 4 inspection and correlation. QoE KPIs like the Initial Buffering time, stream rebuffering frequency (stalls), Average Bit rate (video resolution), and frequency of bit rate change (video resolution change) can be measured by applying ML techniques that identify those KPIs from the traffic patterns and QoS KPIs   ML Predictive analysis and Analytics   By using ML techniques,  network administrators can find traffic patterns that are normally overlooked when analyzing traffic data. These patterns could be missed when using only predefined thresholds on common network metrics, or when they are patterns specific to a network or an Internet service. Finding these patterns,  simplifies detection of anomalies that could affect the end user experience or could cause problems in the network.   This anomalous pattern can be correlated with metrics from different points of the network (packet data, flow data, SNMP utilization metrics and even syslog) to provide a complete view of the network.  This  anomaly can be explored with an analytics engine that helps  quickly find the source of a problem while minimizing the investigation time.   Linear Video   Multi-System Operator cable companies (MSOs) have migrated their entire subscriber video transmission to digital.  This has allowed MSOs to completely digitize and centralize their video distribution networks.  They have standardized on using IP/MPLS multicast distribution networks for the underlying transport of live video with the video programming being distributed as MPEG Transport Streams (MP-TS) carried over the Real-time Transfer Protocol (RTP) of IP. (See standard ST-2022 for detail).  Since these MSOs still deliver a large quantity of live video content in broadcast mode, they have implemented IP multicast distribution networks in a tree structure to accomplish this.

The figure above shows a 3-level multicast distribution tree that is typical of MSO linear video networks.  Content is acquired at a national head end and multicast to a number of regional head ends.  Each regional head end in turn multicasts the content to a number of local head ends where it is placed on a local cable multi-drop network that connects to subscribers.  The same video over RTP streams traverses the entire tree and branch structure. 


At each step of the journey impairments can be introduced.  Each step can increase jitter magnitude due to packet delays and can also drop packets due to congestion, restarts, or failures.  To help MSOs monitor the performance of the multicast trees, Cirries recommends placing PacketPoint TAPs at the NHE outputs, at the RHE inputs, and at the LHE inputs.  Optionally, PacketPoint TAPs can be added at the content RTP stream sources in the NHE as well. 


For each tapped interface, Cirries software will create flow records and output them for collection.  These records are sent to our DART Streaming Analytics Center where they placed in the time-series database and examined individually for rule-based alerting.  The objectives of this feature are to provide additional reports to help analyze the flow data to see how RTP flow impairments accumulate along the multicast tree and to help localize the source of these impairments.  Because the routing path of multicast RTP streams is generally the same, the packet loss data for all these streams at a given monitoring point can be aggregated to provide additional augmented insight into network trends.  Peer level comparison reporting exposes if only one peer shows an anomaly and another if all peers show the same anomaly.  Vertical level comparison along the tree allows us to create a view of the contribution to jitter and packet loss at each level.  For example, if jitter is high at the top of the tree it will be high or higher at the bottom of the tree too.  


Cirries ingests multiple data points and processes in real time to ensure network teams are empowered to maximize QoE and QoS for video.  Each session is evaluated and any behavior which does not meet the expectations of the networks teams and customers sets off an automated alert and associated workflow to begin the resolution process.  This granularity ensures the delivery of quality video to each customer of the network.