Abstract – The Internet is rapidly growing in number of users, traffic levels, and topological complexity. At the same time it is increasingly driven by economic competition. These developments render the characterization of network usage and workloads more difficult, and yet more critical. Few recent studies have been published reporting Internet backbone traffic usage and characteristics. At MCI, we have implemented a high-performance, low-cost monitoring system that can capture traffic and perform analyses. We have deployed this monitoring tool on OC-3 trunks within internetMCI’s backbone and also within the NSF-sponsored vBNS. This paper presents observations on the patterns and characteristics of wide-area Internet traffic, as recorded by MCI’s OC-3 traffic monitors. We report on measurements from two OC-3 trunks in MCI’s commercial Internet backbone over two time ranges (24-hour and 7-day) in the presence of up to 240,000 flows. We reveal the characteristics of the traffic in terms of packet sizes, flow duration, volume, and percentage composition by protocol and application, as well as patterns seen over the two time scales. 1

Abstract—This paper presents a detailed analysis of traces of domain name system (DNS) and associated TCP traffic collected

v LIST OF TABLES Table Page 1.1 1991 Application Breakdowns . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2 1995 Application Packet Counts . . . . . . . . . . . . . . . . . . . . . . 11 1.3 1997 Application Breakdowns . . . . . . . . . . . . . . . . . . . . . . . . 11 2.1 Global Configuration File Fields . . . . . . . . . . . . . . . . . . . . . . 54 2.2 TCPLib Configuration File Fields . . . . . . . . . . . . . . . . . . . . . . 54 2.3 TELNET Configuration File Fields . . . . . . . . . . . . . . . . . . . . . 54 2.4 FTP, NNTP and SMTP Configuration File Fields . . . . . . . . . . . . . 55 2.5 Command Line Arguments . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.1 Correlation Coefficient Verification . . . . . . . . . . . . . . . . . . . . . 67 3.2 Delayed Acknowledgment Results . . . . . . . . . . . . . . . . . . . . . . 77 3.3 TCPLib Interpolation Results . . . . . . . . . . . . . . . . . . . . . . . . 79 C.1 Abbreviations Used in Correlation Tables . . . . . . . . . . . . . . . . . 93 C.2 Correlation Values for NewWave Timed Data Series . . . . . . . . . . . 95 C.3 Correlation Values for Rio Grande Timed Data Series . . . . . . . . . . 96 C.4 Correlation Values for OU IRG Timed Data Series . . . . . . . . . . . . 97 C.5 Correlation Values for OU Engineering Timed Data Series . . . . . . . . 98 C.6 Correlation Values for NewWave Daily Data Series . . . . . . . . . . . . 99 vi Table Page C.7 Correlation Values for Rio Grande Daily Data Series . . . . . . . . . . . 100 C.8 Correlation Values for OU IRG Daily Data Series . . . . . . . . . . . . . 101 C.9 Correlation Values for OU Engineering Network Daily Data Series . . . . 102 C.10 Correlation Values for NewWave Artificial Ti...

This paper presents a detailed analysis of traces of DNS and associated TCP traffic collected on the Internet links of the MIT Laboratory for Computer Science and the Korea Advanced Institute of Science and Technology (KAIST). The first part of the analysis details how clients at these institutions interact with the wide-area DNS system, focusing on performance and prevalence of failures. The second part evaluates the effectiveness of DNS caching. In the most recent MIT trace, 23% of lookups receive no answer; these lookups account for more than half of all traced DNS packets since they are retransmitted multiple times. About 13% of all lookups result in an answer that indicates a failure. Many of these failures appear to be caused by missing inverse (IP-to-name) mappings or NS records that point to non-existent or inappropriate hosts. 27% of the queries sent to the root name servers result in such failures. The paper presents trace-driven simulations that explore the effect of varying TTLs and varying degrees of cache sharing on DNS cache hit rates. The results show that reducing the TTLs of address (A) records to as low as a few hundred seconds has little adverse effect on hit rates, and that little benefit is obtained from sharing a forwarding DNS cache among more than 10 or 20 clients. These results suggest that the performance of DNS is not as dependent on aggressive caching as is commonly believed, and that the widespread use of dynamic, low-TTL A-record bindings should not degrade DNS performance. I.

Abstract—This paper presents a detailed analysis of traces of DNS and associated TCP traffic collected on the Internet links of the MIT Laboratory for Computer Science and the Korea Advanced Institute of Science and Technology (KAIST). The first part of the analysis details how clients at these institutions interact with the wide-area domain name system, focusing on client-perceived performance and the prevalence of failures and errors. The second part evaluates the effectiveness of DNS caching. In the most recent MIT trace, 23 % of lookups receive no answer; these lookups account for more than half of all traced DNS packets since query packets are retransmitted overly persistently. About 13 % of all lookups result in an answer that indicates an error condition. Many of these errors appear to be caused by missing inverse (IP-to-name) mappings or NS records that point to non-existent or inappropriate hosts. 27 % of the queries sent to the root name servers result in such errors. The paper also presents the results of trace-driven simulations that explore the effect of varying TTLs and varying degrees of cache sharing on DNS cache hit rates. Due to the heavy-tailed nature of name accesses, reducing the TTLs of address (A) records to as low as a few hundred seconds has little adverse effect on hit rates, and little benefit is obtained from sharing a forwarding DNS cache among more than 10 or 20 clients. These results suggest that client latency is not as dependent on aggressive caching as is commonly believed, and that the widespread use of dynamic, low-TTL A-record bindings should not greatly increase DNS related wide-area network traffic.