Self-Similarity Through High-Variability:
Statistical Analysis of Ethernet LAN Traffic at the Source Level
Walter Willinger (Bellcore), Murad S. Taqqu (Boston University), Robert Sherman (Bellcore)
and Daniel V. Wilson (Bellcore)
Abstract— A number of recent empirical studies of traf-
fic measurements from a variety of working packet net-
works have convincingly demonstrated that actual net-
work traffic is
self-.szmdar or long-range dependent in na-
ture (i. e., bursty over a wide range of time scales) – in
sharp contrast to commonly made traffic modeling as-
sumptions. In this paper, we provide a plausible physical
explanation for the occurrence of self-similarity in high-
speed network traffic. Our explanation is based on con-
vergence results for processes that exhibit
hagh uariabihty
(i.e., infinite variance) and is supported by detailed sta-
tistical analyses of real-time traffic measurements from
Ethernet LAN’s at the level of individual sources.
Our key mathematical result states that the superpo-
sition of many ON/OFF sources (also known as
packet
trams)
whose ON-periods and OFF-periods exhibit the
Noah Effect (i. e., have high variability or infinite vari-
ance) produces aggregate network traffic that features
the Joseph E~ect (i.e., is self-similar or long-range de-
pendent).
There is, moreover, a simple relation be-
tween the parameters describing the intensities of the
Noah Effect (high variability) and the Joseph Effect (self-
similarity). An extensive statistical analysis of two sets
of high time-resolution traffic measurements from two
Ethernet LAN’s (involving a few hundred active source-
destination pairs) confirms that the data at the level of
individual sources or source-destination pairs are con-
sistent with the Noah Effect. We also discuss implica-
tions of this simple physical explanation for the presence
of self-similar traffic patterns in modern high-speed net-
work traffic for (i) parsimonious traffic modeling, (ii) effi-
cient synthetic generation of realistic traffic patterns, and
(iii) relevant network performance and protocol analysis.
1, INTRODUCTION
Starting with
the extensive analyses of traffic measure-
ments from Ethernet LAN’s over a 4-year period described
m [16], there have been a number of recent empirical stud-
ies that provide evidence of the prevalence of sel~-similar
or jractal traffic patterns m measured traffic from today’s
high-speed networks. Prominent among these studies are
the in-depth statistical analysls of large amounts of wide-
area traffic measurements reported in [24] and the detailed
investigation
of traffic data collected at the packet level from
multiple NSFNET core switches presented in [13]. One of
W
Willlnger and M S Taqqu were partially supported by the NSF
grant NCR-9404931. MS. Taqqu was also partially supported by tbe
NSF grant DMS-9404093
Permission to make digital/hard copies of all or part of this material with-
out fee is granted provided that the copies are not made or distributed
for profit or commercial advantage, the ACM copyrightiserver
notice, the title of the pubhcatlon and Its date appear, and notice is given
that copyright IS by permission of the Association for Computing Machinery,
Inc. (ACM). To copy otherwsej to republish, to post on servers or to
redistribute to lists, requires prior specific permission and/or a fee
SIGCOMM ’95 Cambridge, MA USA
01995 ACM 0-89791 -711-1 195/0008. $350
the most surprising findings from these and other studies
concerns the ease with which it is possible to statistically
distinguish between measured network traffic and traditional
traffic models: actual traffic exhibits correlations over a wide
range of time scales (i.e., has long-range dependence), while
traditional traffic models typically focus on a very limited
range of time scales and are thus short-range dependent in
nature. Although such findings can in general be expected
to favor the use of self-similar models over traditional mod-
els from a statistical perspective, there has been consider-
able resistance toward self-similar traffic modeling on prac-
tical grounds. One of the major reasons for this resistance
has been the absence of satisfactory answers to the follow-
ing 2 questions. (1) What is a physical “explanation” for
the observed self-similar nature of measured traffic from to-
day’s packet networks? and (2) What is the impact of self-
similarity on network and protocol design and performance
analysis?
In this paper, we present an answer to question (1) by
providing the appropriate mathematical results and by vali-
dating our findings with detailed statistical analyses of two
representative sets of high time-resolution traffic measure-
ments from two different Ethernet LAN’s. In particular,
we provide a plausible and simple explanation for the ob-
served self-similarity of measured aggregate packet traffic in
terms of the nature of the traffic generated by the individ-
ual sources or source-destination pairs that contribute to the
aggregate packet stream. Developing an approach originally
suggested by Mandelbrot [19], we show that the superpo-
sition of many (idealized) ON/OFF sources, each of which
exhibits a phenomenon called the “Noah Effect”, results in
self-similar aggregate traffic.
By expressing the results in
the well-known framework of ON/OFF source models (also
known as “packet train models”), we identify the Noah Effect
as the essential point of departure from traditional to self-
similar traffic modeling. Intuitively, the Noah Effect for an
individual ON/OFF source model results in highly variable
ON- and OFF-periods, i.e.,
“train lengths” and ‘(intertrain
distances” that can be very large with non-negligible prob-
ability. In other words, the Noah Effect guarantees that
each ON/OFF source individually exhibits characteristics
that cover a wide range of time scales. The Noah Effect is
synonymous with the mjinzte war-lance syndrome – the em-
pirical observation that many naturally occurring phenom-
ena can be well described using distributions with infinite
variance. Mathematically, we use heavy -taded distributions
with infinite variance (e. g , certain Pareto and stable distri-
butions) to account for the Noah Effect, and the parameter
a describing the “heaviness” of the tail of such a distribu-
tion gives a measure of the intensity of the Noah Effect, We
also provide a simple relation between a and the Hurst pa-
rameter H, where the latter has been suggested in [16] as a
measure of the degree of self-similarity (or equivalently, of
the ‘[Joseph Effect” ) of the aggregate traffic stream.
100
In sharp contrast to our findings, traditional traffic mod-
eling, when cast in the framework of ON/OFF source mod-
els, without exception assumes finite variance distributions
for the ON- and OFF-periods (e.g., exponential distribution,
geometric distribution). These assumptions drastically limit
the ON/OFF activities of an individual source, and as a re-
sult, the superposition of many such sources behaves like
white noise in the sense that the aggregate traffic stream
is void of any significant correlations, except possibly some
in the short range. This behavior is in clear contrast with
measured network traffic (for details, see for example [17]).
Note that the results of the present study suggest yet an-
other, equally simple, statistical method for distinguishing
between traditional and self-similar traffic: an analysis of
network traffic that checks for the presence or absence of the
Noah Effect in the traffic generated by the individual sources
or source-destination pairs.
To demonstrate the effective-
ness of such an analysis, we used two sets of Ethernet LAN
traffic measurements, generated by about 100 and 3,200 in-
dividual sources (resulting in about 700 and 10,000 active
source-destination pairs), respectively. The data were col-
lected at the Bellcore Morristown Research and Engineering
Center (MRE). One of the data sets was collected in August
of 1989, has been studied extensively in the past (at the ag-
gregate packet level), and was, in fact, part of the analysis
presented in [16]. The second data set represents a very re-
cent (December 1994) collection of high time-resolution traf-
fic measurements, was obtained from a different Ethernet
LAN than the first set, and includes applications that were
non-existent in the first data set (e.g., WWW and Mbone).
Although the main objective of this paper is to provide an
answer to question (1) (physical “explanation”), our results
concerning individual source behavior are clearly significant
for answering question (2) (impact of self-similarity on net-
work and protocol design and performance analysis). Start-
ing with the work by Norros [22], there has been mounting
evidence that clearly shows that the performance of queue-
ing models with self-similar inputs can be radically different
from the performance predicted by traditional traffic models,
especially by Markovian models (e.g., see [5], [4], [7]). Here
we complement this evidence by illustrating the practical
relevance of our findings for (i) parsimonious traffic model-
ing for high-speed networks, (ii) efficient simulation of actual
network traffic, and (iii) analyzing queueing models and pro-
tocols under realistic traffic scenarios.
Two previous studies of LAN traffic measurements are
of particular relevance in the present setting. Jain and
Routhier [12] used packet data collected at a ring network
at MIT and proposed a “packet train” (or ON/OFF) source
model in order to capture the observed burstiness in actual
packet streams. In this context, our results show that packet
train models are consistent with traffic data collected at the
level of individual source-destination pairs - once the Noah
Effect for the packet-train lengths and the inter-train dis-
tances has been accounted for. By doing so, some of the
shortcomings of the original packet train modeling approach
(e.g., lack of any physical interpretation, arbitrary choice of
crucial parameter values) are remedied. Of particular impor-
tance to our work are Gusella’s extensive studies [8], [9], [10]
of traffic measurements from a 10 Mb/s Ethernet LAN. In
view of the results discussed in the present paper, Gusella’s
work falls strictly within the traditional approach to traf-
fic modeling: phenomena like the Joseph and Noah Effects
are attributed to non-stationarity in the data and are ig-
nored in subsequent data modeling. Naturally, the resulting
models, based on burstiness characterizations using indices
of dispersion, are adequate only over a limited range of time
scales. Our approach suggests a viable alternative: by ex-
panding the range of traditional traffic models to account for
the Joseph and Noah Effects, it is possible to describe these
phenomena in a strictly stationary setting. The benefits for
doing so include new insights into the time dynamics of high-
speed network traffic, and the applicability of simple mod-
els for the very complex traffic patterns observed in today’s
networks. Finally, with regard to an intuitive physical ex-
planation at the application level of the empirically observed
self-similar nature of wide-area network traffic, we refer to
[24], as well as to [13]. Note that in these application-level
studies, the Noah Effect also plays a crucial role.
The rest of the paper is organized as follows. In Sec-
tion II, we introduce an idealized ON/OFF source model
and present the convergence theorems that form the basis of
our approach. In Section III, we discuss the available traffic
measurements and present our statistical analysis of these
data, concentrating on detecting the Noah Effect in traffic
generated by individual source-destination pairs. Finally, in
Section IV we illustrate the significance of the presence of
the Noah Effect at the source level and its implications for
aggregate traffic streams with a number of examples that are
relevant and of practical importance for the design and per-
formance analysis of modern communication networks and
protocols.
II. SELF-SIMILARITY THROUGH HIGH-VARIABILITY
The models presented here were first introduced by Man-
delbrot [19] and Taqqu and Levy [29] and were originally
cast in an economic setting involving commodity prices.
The models are based on renewal reward processes and
are rephrased here in the context of packet traffic model-
ing. Intuitively, they take into account the presence of long
packet trains ( ‘{ON-periods”, i.e., periods during which pack-
ets arrive at regular intervals) and long inter-train distances
( ‘(OFF-periods”, i.e.,
periods with no packet arrivals) in
traffic generated by individual sources or individual source-
destination pairs in a LAN. We will show in this section
that the superposition of many such packet trains exhibits,
on large time scales, the self-similar behavior that has been
observed in the Ethernet LAN traffic data in [16].
We consider here zdeulized ON/OFF models where an ON-
period can be followed by an ON-period and an OFF-period
can succeed another OFF-period. Although the ON/OFF
models commonly considered in the communications liter-
ature have strictly alternating ON- and OFF-periods and
hence differ from the idealized models considered here, we
chose the idealized setting because it allows for an immediate
application of some known results in [19], [29]. It also allows
for the distributions of the ON and OFF times to vary. The
study of the more traditional (i.e., alternating) ON/OFF
models, as well as a comparison between the idealized and
strictly alternating setting will appear in a subsequent pa-
per. Moreover, below we present only the simplest case of an
idealized ON/OFF model; generalizations (e. g., different dis-
tributions for the ON- and OFF-periods, non-homogeneous
sources) are possible, but the details are also deferred to a
101
later paper.
Following Mandelbrot’s original work, an tdealwed
ON/OFF source model, or simple packet train model, is
characterized by a reward sequence {W(l), 1 = O, 1, .}, i.e.,
a O/l-valued discrete time stochastic process {w’ (1)}, with
W(L) = 1 or O, depending on whether or not there is a
packet at time 1. Thus, the reward sequence {W(1)} con-
sists of a sequence of 1‘s ( “ON-periods”) and O’s (‘(OFF-
periods” ). Let p ~ P( a given period is an ON-period
) = 1/2, and assume that the lengths of the ON- and OFF-
periods are independent and identically distributed (i.i.d.)
positive random variables, denoted uk, k =
1,2,...(U de-
notes an arbitrary uk, with finite expectation
E(U)). Let
Sk = SO +
UI + U2 + + uk, k >0 be the corresponding
renewal times. We assume that {Sk, k > O}
is stationary.
This can be achieved by choosing the distribution of SO in
the following special way:
P(SO =u) = (E(U) )-l P(U~u+ l), u = 0,1,2,...
To ensure the stationarity of the reward sequence {W(l), 12
O}, let 1 = O be in an ON-period with probability 1/2.
Next suppose that there are M i.i.d. sources, where the
‘h source (m = 1, ...,
ill) has it own reward sequence
TM’(m) (1), 1 ~ 0}, Then the superposition or cumulative
reward (“packet load” ) at time 1 is ~~=1 W’(m)(1). Aggre-
gating this load through (non-overlapping) time blocks of
size b, we get
b(j+l) M
W;fjb(j) = ~ ~ w(m)(~)) j ‘ 0,1,2 )...,
l=bj+l m=l
where j denotes the aggregation block number. We are inter-
ested in the statistical behavior of the sequence {W&, b} for
large M and b. This behavior can only depend on the distri-
bution of U, the one element we have not yet specified. Mo-
tivated by the empirically derived fractional Gaussian noise
model for aggregate packet traffic in [16], we want to choose
the distribution of U in such a way that, as M -+ m and
b ~ co, {WJ,b } adequately normalized is fractional Gaus-
szan nozse {GH,u(t), t z O}, the only Gaussian sequence
which 1s self-similar (with Hurst varameter ~ <
H < 1)
at all scales. By this we mean that the fmit~-d~mensional
distributions of b-~ ~&~~)l G~,~(l), j = O, 1,2,... are
ithe same whatever the va ue of the block aggregation size
b. (For more information about fractional Gaussian noise
and the corresponding cumulative process, called jractzonal
Brownzan motzon, we refer for example to [27, Chapter 7].)
In our setting, to obtain fractional Gaussian noise we sup-
pose that U has a hyperbolic tail distribution, that is, it
satisfies
P(u > u) - Cu-”
asu-+m, l<a <2, (1)
where c is a positive fimte constant, independent of u,
Mandelbrot refers to property (1) as the infintte varz.ante
syndrome or the Noah Effect Note that CY < 2 Implies
E(U2 ) = m, while the choice a >1 ensures that E(U) < m
and hence that SO is not infinite. For example,
U may have
a discrete Pareto-type distribution or be some discrete ver-
sion of a one-sided stable distribution (e.g. ,see [27]). One
can show, as in [29], that under the conditions stated above
the following holds.
Theorem 1. For large enough source number M and block
aggregation sw.e b, the cumulaihve load {W~,b(j), J > O}
behaves statastacally as
1
bi?l~ + bH~l’2GH,o(j)
where
H = %jQ and U2 =
4E(~)2(a–l; (2–a)(3–a)
More pre-
czsely,
where .C lam means convergence an the sense
of the fintte-
dtmenszonal dtstributzons (convergence m law).
Heuristically, Theorem 1 states that the mean level bM/2
provides the main contribution for large M and b; fluctu-
ations from that level are given by the fractional Gaussian
noise GH,a (j) scaled by a lower order factor bH M 1’2. Note
that it is essential that the limits be performed in the order
indicated. Also note that 1 < a < 2 lrnphes 1/2 <
H < 1.
Thus, the main ingredient that is needed for the limiting re-
sult to hold is the hyperbolic tail behavior (1), which guar-
antees the infinite variance property (i.e., high variability) of
the ON- and/or OFF-periods of a “typical” source; whether
the ON/OFF periods form a strictly alternating renewal pro-
cess or an i.i. d sequence is not essential.
Theorem 1 can be generalized in a number of different di-
rections. In particular, we mention here the possibility for
(i) allowing rewards in an ON-period to be given by positive
i.i. d. random variable with finite variance (e. g., the rewards
can equal the number of bytes in a packet), and (ii) consider-
ing heterogeneous sources (i.e., each source type satisfies the
hyperbolic tail property of the form (1), where the index a is
type-dependent). In the case of heterogeneous sources, the
limit is a superposition of independent fractional Gaussian
noises with different (type-specific) H’s, As far as the fluc-
tuations are concerned, however, the term with the highest
H (or equivalently, the term corresponding to the smallest
a for which the corresponding proportion of source types to
total number of sources does not converge to O) ultimately
dominates as b ~ co. When the distribution of the length of
packet trains has finite variance, the corresponding source
types will contribute to the limit an ordinary white noise
component. Details about the proofs of these generaliza-
tions of Theorem 1, as well as a statement for the case of the
superposition of strictly alternating ON/OFF models will
appear in a later paper.
III. ETHERNET LAN TRAFFIC MEASUREMENTS AT THE
SOURCE LEVEL
In this section, we first describe two sets of Ethernet LAN
traffic measurements that will be used in our subsequent
analysis. The two sets result in about 500 and 10,000 ac-
tive source-destination pairs, respectively. This wealth of
data presents a considerable challenge when trying to inves-
tigate in a statistically rigorous manner the presence of the
Noah Effect in the traffic streams generated by all or part
of these individual active source-destination pairs.
Thus,
one of the main objectives of this section is to illustrate the
use of exploratory data analysis tools that can assist in ex-
tracting essential information out of an abundance of traffic
measurements, While some of the tools applied below are
102
well-known, others are less familiar and will be explained in
more detail as they are used. Finally, note that we are not
interested in precise point estimates for the index a appear-
ing in equation (1) nor in measuring the exact intensity of
the Noah Effect for a given source or source-destination pair,
but are instead concerned about the range of a-values that
is consistent with the data representing individual source-
destination pairs,
A. Tra@c Measurements
The first set of traffic measurements is the busy hour of
the August 1989 Ethernet LAN measurements presented and
analyzed (and denoted by AUG89.HB and AUG89.HP in
Table 1) in [16]. (Source-level analyses of the other data sets
considered in [16] result in similar conclusions – for further
details about these data sets, see also [17]. ) In addition to
the information about time stamp and size (in bytes) of every
packet seen during this hour, this first data set also contains
the source and destination address of each recorded packet.
During this busy hour, 105 hosts sent or received packets
over the network (out of 121 hosts that were active during
the whole 27 hour long monitoring session), Upon further
inspection, out of 11,025 possible source-destination pairs,
only 748 or about 6.8~0 were actually sending or receiving
packets (this effect has also been observed in previous traffic
studies, e.g., [3], [23]), The most active hosts were sources
1, 7, 11, 27, 32, 58 (6 Sun-3 fileservers), sources 2 and 47 (2
DEC 3100 fileservers), source 34 (a Sun-4 server), sources 6,
15, 20, 25, 30, 63 (6 diskless Sun-3 clients), source 8 (a DEC
3100 client), and sources 10 and 17 which served as routers.
Only about 5% of the traffic on this network was external,
i.e., destined for machines on other networks or outside the
company.
The second data set is new and represents a “typical”
hour of Ethernet LAN traffic collected during a 9 day-long
measurement period in December 1994 (additional hour-long
periods of this traffic trace have also been analysed and show
similar results, despite differences in the traffic mix). The
traffic was gathered from the stub Ethernet between the
router provided by Bellcore’s Internet service provider and a
second Bellcore-controlled router that enforces security. The
measurements are made up entirely of remote traffic, i.e., of
packets destined for points on the Internet outside of Bell-
core or for Bellcore from the outside (all via a 1.5 Mb/s T-1
link). Our motivation for including a very recent set of traffic
measurements in our study was to demonstrate the robust-
ness of traffic characteristics such as the Joseph and Noah
Effects under a variety of changes that working LANs ex-
perience in practice over time. LAN environments undergo
considerable changes with regard to network configuration,
host population, hardware and software upgrades, user ap-
plications, etc. For this data set, the number of active hosts
(based on 1P addresses) turns out to be about 3,500, while
the percentage of active to possible source-destination pairs
is about 0.25Y0, The most active host in this data set was
the machine outside of Bellcore that sent Mbone packets (see
below and Section 111.F for more details regarding Mbone).
AISO included in the most active machines were four ma-
chines outside of Bellcore supplying data in response to file
transfer (FTP) sessions, along with one Bellcore host sup-
plying file transfer, E-mail, and Domain name service to the
outside world. Other active hosts included one Bellcore host
supplying Network News to the outside and three machines
supplying news to Bellcore.
Of the two Bellcore machines
mentioned above, one is a Sun Sparcserver 690MP and the
other (the network news supplier) is a Spare-l. Note that all
remote traffic is bandwidth limited by Bellcore’s 1.5 Mb/s
link to the outside world.
It is also known that LAN environments can experience
drastic changes at the user application level within relatively
short periods of time (for a similar finding regarding WAN
traffic, see [23]). A brief investigation of what services gener-
ated this second hour-long data set revealed that a new Inter-
net service called Mbone (see for example, [18]) was respon-
sible for over 50% of the recorded traffic (in bytes). Another
new service, the World Wide Web (WWW) information re-
trieval service (e.g., see [I]), made up 9.4% of the total traf-
fic. Neither Mbone nor WWW traffic was present in the first
data set, nor in any of the earlier data sets studied in [16].
Services such as file transfer (14.5%), telnet/rlogin (2.8%),
electronic mail (SMTP) (3.2Yo) and Network News transfer
(NNTP) (12.2%) still present significant components of the
total traffic but no longer dominate it.
B. Textured Plots and the Packet Tram Assumption
We consider here the first data set that has been shown in
[16] to be consistent with second-order self-similarity, with a
Hurst parameter of H x 0.90 for the time series represent-
ing the packet counts per 10 milliseconds. This conclusion
was reached by treating the Ethernet packets as black boxes,
i.e., without using any information contained in the packet
header fields. In contrast, for the present study, we extracted
from the header field of each packet monitored during this
hour the corresponding pair of source-destination addresses.
This process resulted in 105 individual time series represent-
ing the packet arrivals on the Ethernet from the 105 hosts
that were active (i.e., sent or received packets) during this
hour. Furthermore, separating the packets generated by a
given source depending on the packet’s destination address
yields a total of 748 time series corresponding to the num-
ber of active source-destination pairs. In view of the results
presented in Section II, we are thus faced with the chal-
lenging task of analyzing 748 time series with sufficient sta-
tistical rigor and accuracy to conclude whether or not these
data support our physical explanation for self-similarity, i.e.,
whether or not the data are consistent (i) with the ON/OFF
traffic model assumption for individual sources or source-
destination pairs and (ii) with the crucially important as-
sumption of the Noah Effect for the corresponding ON- and
OFF-periods. To this end, our goal is not to provide a single
point estimate for the intensity a of the Noah Effect, but to
examine if there is evidence for the Noah Effect in the data
and if so, to determine the “typical” range of a-values. Note
that because of the basic relation
H = (3 – a)/2 (see Theo-
rem 1), the earlier findings in [16] of
H w 0.90 for the time
series of (aggregate) packet counts suggests the presence of
the Noah Effect with a low a-value of about 1.20.
For the purpose of checking the appropriateness of the
ON/OFF traffic modeling assumption for individual sources
or source-destination pairs, we first make use of a simple
exploratory data analysis tool called textured dot strap plot
or simply teztured plot, originally proposed in [30] (see also
[28]). Intuitively, the idea of textured plots is to display one-
dimensional data points in a strip in an attempt to show all
103
0
600 1200 1800 2400
3000 3600
Ttme (in 5..)
So.r.e-Dest!nat,on 10-t
0 600
1200
1800 2400 3000
3600
Time (in see)
Source-Destination i O-i 8
0
600 1200
1800 2400 3000 3600
Time @ see)
Source-Destination i 0-13
0 600 1200
3800
2400 3000 3600
Tme (in see)
Source-Destination i O-i 7
Fig, 1. Textured plots of packet arrival times for source 10 and source-destination pairs 10-1, 10-18, 10-70, 10-13 and 10-17.
data points individually. Thus, if necessary, the points are
displaced vertically by small amounts that are partly ran-
dom, partly constrained. The resulting textured dot strip
facilitates a visual assessment of changing patterns of data
intensities in a way other better-known techniques such as
histogram plots, one-dimensional scatterplots, or box-plots
are unable to provide, especially in the presence of extreme
values. To illustrate the effectiveness of textured plots for
assessing the bursty or ON/OFF nature of traffic generated
by an individual saurce or source-destination pair, we dis-
play in Figure 1 six textured plots associated with source
10 (other sources result in similar plots). Each point in the
plots represents the time of a packet arrival. Serving as a
router, source 10 contributed 1.85% to the overall number
of packets and sent data to 25 different destinations. The
top plot in Figure 1 represents the textured dot strip corre-
sponding to the arrival times of all packets originating from
source 10 (there are 26,330 packets), and the subsequent 5
panels result from applying the textured plot technique to
the arrival times of all packets originating from source 10 and
104