Longitudinal Study of Internet traffic in 1998-2003

M. Fomenkov, K. Keys, D. Moore, and k, claffy, "Longitudinal study of internet traffic in 1998-2003," in WISICT, 2004

Introduction
This research presents a longitudinal study of Internet traffic behavior at a number of institutions for the span of four and half years(1998-2003)
Cited previous works such as:
McCreary and Claffy. They analyzed IP traffic at NASA Ames Internet eXchange point (AIX) for 8 months.
Thompson, Miller, and Wilder discussed characteristics of MCI's commercial Internet backbone which ranged from one day to a week.
Fraleigh et al described IPMON traffic monitoring system and reported observations in the Sprint E-Solutions backbone network for a day.
WAND network research group in University of Waikato conducted measurements on OC3 links between the University of Auckland and the public internet.

Data
They obtained 4000 traffic samples from various sites connected to High Performance Computing networks.
At each site, packet headers were captured between one to eight times a day per month. Average duration of each measurement ranges from 60 to 120 seconds.

Four metrics of measure traffic:
1. number of bytes
2. number of packets where packets are actual quanta of traffic
3. number of flows
4. number of source-destination pairs (port numbers and protocols ignored)

Flow is determined in a sequence of packets if they have the same source IP address, source port, destination IP address, destination port and protocol flow key.

They discovered that traces captured with an FATM card often have problems with accuracy of time measurements such as apparent clock resets and delays. They solved this by checking timestamps, properly converting absolute counts to rates, and averaging rates.

Results and Conclusions

Variations in bit rate are large and mostly without trends which reflects the Internet's traffic bustiness. No observed cycle or consistent long-term growth

Quality of available data is often insufficient for other qualitative measurements. (e.g. traffic flunctuations can be caused by a number of reasons.

Assuming data is representative of overall traffic evolution, they conclude that the data do not support the claim of Internet traffic universally and rapidly increasing both before and after the Internet bubble burst

TCP is the predominant transport protocol.
TCP traffic is between 60% to 90% of the total load
UDP is between 10% to 40 % of the total load
and other protocols combined amount to less than 5 %.

By bytes, the proportion of TCP and UDP traffic on average is 5 to 1 or by packets which is 3 to 1.

Packet rate is sublinear function of bit rate. packet rate ~ bitrate^0.75 and count of flows and IP pairs behave as bitrate^0.5