Abstract – The Internet is rapidly growing in number of users, traffic levels, and topological complexity. At the same time it is increasingly driven by economic competition. These developments render the characterization of network usage and workloads more difficult, and yet more critical. Few recent studies have been published reporting Internet backbone traffic usage and characteristics. At MCI, we have implemented a high-performance, low-cost monitoring system that can capture traffic and perform analyses. We have deployed this monitoring tool on OC-3 trunks within internetMCI’s backbone and also within the NSF-sponsored vBNS. This paper presents observations on the patterns and characteristics of wide-area Internet traffic, as recorded by MCI’s OC-3 traffic monitors. We report on measurements from two OC-3 trunks in MCI’s commercial Internet backbone over two time ranges (24-hour and 7-day) in the presence of up to 240,000 flows. We reveal the characteristics of the traffic in terms of packet sizes, flow duration, volume, and percentage composition by protocol and application, as well as patterns seen over the two time scales. 1

We report results from a longitudinal analysis of the IP traffic workload seen at a single measurement site inside a major Internet traffic exchange point. Using data collected by the NLANR/MOAT Network Analysis Infrastructure (NAI) project [NAI] and analysis software from CAIDA's CoralReef project [CoralReef], we present trends in application usage seen at the NASA Ames Internet Exchange over 10 months, from May 1999 through March 2000. We show changes in the fraction of traffic from streaming media and online gaming, as well as an increase in traffic from new applications such as Napster and IPSEC tunneling. We also show that our data does not indicate any overall change in the TCP/UDP traffic ratio at the Ames Internet Exchange during this period, or significant differences from the analyses by MCI Worldcom and CAIDA in 1998.

In this paper, we characterize wide-area network applications that use the TCP transport protocol. We also describe a new way to model the wide-area traffic generated by a stub network. We believe the traffic model presented here will be useful in studying congestion control, routing algorithms, and other resource management schemes for existing and future networks. Our model is based on trace analysis of TCP/IP widearea internetwork traffic. We collected the TCP/IP packet headers of USC, UCB, and Bellcore networks at the point they connect with their respective regional access networks. We then wrote a handful of programs to analyze the traces. Our model characterizes individual TCP conversations by the distributions of: number of bytes transferred, duration, number of packets transferred, packet size, and packet interarrival time. Our trace analysis shows that both interactive and bulk transfer traffic from all sites reflect a large number of short conversations. Similarly, it shows that a very large percentage of traffic is bidirectional, even for bulk transfer. We observed that interactive applications send significantly different amounts of data in each direction of a conversation, and that interarrival times for interactive applications closely follow a constant plus exponential model. Half of the conversations are directed to a handful of networks, but the other half are directed to hundreds of networks. Many of these observations contradict commonly held beliefs regarding wide-area traffic.

We present an artificial workload model of wide-area internetwork traffic. The model can be used to drive simulation experiments of communication protocols and flow and congestion control experiments. The model is based on analysis of wide-area TCP/IP traffic collected from one industrial and two academic networks. The artificial workload model uses both detailed knowledge and measured characteristics of the user application programs responsible for the traffic. Observations drawn from our measurements contradict some commonly held beliefs regarding wide-area TCP/IP network traffic.

The current Internet is based on a stateless (datagram) architecture. However, many recent proposals rely on the maintenance of state information within network routers, leading to our interest in the implications of a slateful network layer. We collected internetwork traffic traces at the border routers of stub and transit networks, and use this data to evaluate, or predict, the effects of design alternatives for stateful architectures. We present an estimate of the number of active conversations at a router, from this we derive the storage requirements for the associated conversation state table. Our analysis shows that at the network periphery fine grain control over the traffic may be possible. However, deeper within the network, it may be more efficient to manage the conversations at a coarser level. We use our network traffic traces to perform trace driven simulations of an LRU cache, for different conversation granularities. Our results show that locality exists for each of the conversation types investigated. Using the Normalized Access Time function, introduced in [13], we show that improvements in state lookup time are possible with a small cache, even without special hardware. 1

This paper investigates the design of resource usag e feedback mechanisms for packet switched internetworks. After a discussion of the motivations for feedback mechanisms, feedback channels and policies are described. We then outline issues raised by the design of mechanisms to realize these policies, including: network service disciplines, accounting granularity, metrics, authentication, and coordination among transit carriers. Usage-based charging is only one means of feedback. Our purpose is to begin a systematic discussion of th e technical issues associated with a range of usage feed-back alternatives. Therefore the paper should not b e read as a policy statement promoting usage sensitiv e charging in internets. In fact, one of the goals of th e feedback mechanisms explored in this paper is to allo w network service providers and users to avoid the introduction of usage sensitive charges if they so wish; while still realizing the benefits of statistical resource sharin g offered by packet switching and the benefits of efficien t resource utilization offered by usage feedback.

Applications to be supported on broadband networks ex-hibit a wide range of trafic statistics and many of them are sensitive to de~ay and loss violations. To accu-rately estimate admissible workload and bandwidth re-quirement, a detailed trafic model, HAP (Hierarchical Arrival Process) is proposed in this paper. Packets gen-erated from HAP are modulated by processes at user, ap-plication, and message levels. This model is a general-ization of on-o ~ trafic models and is shown to be equiv-alent to a special class of MMPP (Markov Modulated Poisson Process). Three algorithmic methods along with simulations are applied to evaluate the queueing perfor-mance under HAP trafic. Delay under HAP trafic can be well over tens of times higher than Poisson trafic, depending on parameters and load. Congestion may per-sist for minutes. HAP’s dramatic short-term behavior explains the occasional congestion m the real networks. Conventional tra&ic models, however, do not exhibit this behavior. With these results, we give implications for broadband network control. 1