Abstract – The Internet is rapidly growing in number of users, traffic levels, and topological complexity. At the same time it is increasingly driven by economic competition. These developments render the characterization of network usage and workloads more difficult, and yet more critical. Few recent studies have been published reporting Internet backbone traffic usage and characteristics. At MCI, we have implemented a high-performance, low-cost monitoring system that can capture traffic and perform analyses. We have deployed this monitoring tool on OC-3 trunks within internetMCI’s backbone and also within the NSF-sponsored vBNS. This paper presents observations on the patterns and characteristics of wide-area Internet traffic, as recorded by MCI’s OC-3 traffic monitors. We report on measurements from two OC-3 trunks in MCI’s commercial Internet backbone over two time ranges (24-hour and 7-day) in the presence of up to 240,000 flows. We reveal the characteristics of the traffic in terms of packet sizes, flow duration, volume, and percentage composition by protocol and application, as well as patterns seen over the two time scales. 1

(*Most of this work was carried out as a visiting researcher at NLANR/MOAT, Sept. 98 − Feb. 99.) Passive measurement data is collected without any impact on the network by the measurement itself. OCXmon/Coral is a passive standalone monitor that collects packet traces from a high capacity link by tapping a small fraction of the light with an optical splitter. SCinet’98 was the show floor network for Supercomputing’98 where the latest in systems, applications and services for all areas of high performance networking and computing were demonstrated. NLANR/MOAT 1 monitored the traffic on the OC3 link connecting the conference network to the vBNS. The measurement data collected consist of 79.7 million packets, 34.3 million packets sent from SCinet’98 to the vBNS and 45.5 million packets sent from the vBNS to the SCinet’98. Based on these measurement data, the traffic composition for IP protocols, packet length distributions and interarrival times are presented. Further, the NLANR/MOAT demonstration of distributed real−time 3D visualization of abstracted OC3mon/Coral data, presented at Supercomputing’98, is briefly described. 1.

Passive measurement data is collected without any impact on the network by the measurement itself. OCXmon/Coral is a passive standalone monitor that collects packet traces from a high capacity link by tapping a small fraction of the light with an optical splitter. SCinet'98 was the show floor network for Supercomputing'98 where the latest in systems, applications and services for all areas of high performance networking and computing was demonstrated. NLANR/MOAT 2 monitored the traffic on the OC3 link connecting the conference network to the vBNS. The measurement data collected consist of 79.7 million packets, 34.3 million packets sent from SCinet'98 to the vBNS and 45.5 million packets sent from the vBNS to the SCinet'98. Based on these measurement data, the traffic composition for IP protocols, packet length distributions and interarrival times are presented. Further, the NLANR/MOAT demonstration of distributed real-time 3D visualization of abstracted OC3mon/Coral data, presented at Supercomputing'98, is briefly described. Keywords: OCXmon/Coral, Internet traffic, Supercomputing'98