WideArea Internet Fa fic Pafterns and Characterist/cs
Kevin Thompson, Gregory J. Miller, Rick Wilder Mci · 1997
The Internet is rapidly growing in number of users, traffic levels, and topological complexity. At the same time it is increasingly driven by economic competition. These developments render the characterization of network usage and workloads more difficult, and yet more critical. Few recent studies have been published reporting Internet backbone traffic usage and characteristics. At MCI, we have implemented a high- erformance, low-cost monitoring system that can capture traffic and perform ana ses. We have deployed this monitoring tool on OC-3 trunks cle resents observations on the patterns and characteristics of wide-area Internet from two OC-3 trunks in MCl’s commercial Internet backbone over two time ranges (24-hour and 7-day) in the presence of up to 240,000 flows. We reveal the characteristics of the traffic in terms of packet sizes, flow duration, volume, and percentage composition by protocol and application, as well as patterns seen over the two time scales. within internetMCl’s 1 ackbone and also within the NSF-sponsored vBNS. This artitraf P ic, as recorded by MCl‘s OC-3 traffic monitors. We report on measurements ustained, rapid growth, increased economic competition, and proliferation of new applications have combined to change the character of the Internet in recent years. The sheer volume of traffic and high capacity of the trunks have rendered traffic monitoring and analysis a more challenging endeavor. In its role as the network service provider for the National Science Foundation’s (NSF’s) very-high-speed Backbone Network Service (vBNS) project, MCI has developed an OC3-based traffic monitor, known as OC3MON [l]. This publicly-available tool facilitates measurement and analysis of high-speed OC3 trunks that carry hundreds of thousands of simultaneous flows. In this article, we report on traffic measurements taken from two locations on internetMCI’s commercial backbone. We characterize the traffic over two time scales, 24 hours and 7 days, in terms of traffic volume, flow volume, flow duration, and traffic composition in terms of Internet Protocol (IP) protocols, Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) applications, and packet sizes. We also present an analysis of the trunk capacity consumed by asynchronous transfer mode (ATM) protocol overhead. Finally,