1. 1 WAN Measurements Carey Williamson Department of Computer Science University of Calgary

2. 2 Introduction u There have been several studies of wide area network traffic (i.e., Internet traffic) u We will look briefly at two of these: –Caceres, Danzig, Jamin, and Mitzel - 1991 –Paxson 1994

3. 3 Measurement Method u The wide area network measurements collected by Caceres et al. focus solely on TCP/IP traffic u Uses tcpdump u Collected data from several different sites (e.g., UC Berkeley site: 5.9 million pkts/day)

4. 4 Data Collection u Used Sun 3 workstation u Added special timer with 10 usec resolution u Collect 56 bytes of data from each packet, including data link, network, and transport layer information u Use well-known port ids to classify app’s u Packet loss: 0% (estimated)

5. 5 Data Analysis u Characterizes different network applications based on a number of criteria u Number of bytes transferred u Duration of connections u Number of packets sent u Packet sizes u Packet interarrival times

6. 6 Main Observations u Both interactive and bulk transfer traffic have a large number of short conversations u 75-90% of bulk transfer connections send less than 10 kilobytes u 90% of interactive conversations send less than 1000 packets, and 50% last less than 90 seconds in duration

7. 7 Main Observations (Cont’d) u Most conversations are bidirection (even the bulk transfer ones) u Bulk transfer accounts for over 50% of the packets and bytes transferred u Interactive traffic: small packets u Bulk transfer: big packets u Bimodal packet size distribution results

8. 8 Summary u One of the first detailed studies of wide area network TCP/IP traffic u Identified characteristics of the traffic for different network applications u Proposed models for packet size distribution, packet interarrival times, etc u Modeling package tcplib is available (free)

9. 9 More WAN Measurements u ‘‘Measurements and Models of Wide Area TCP Conversations”, Vern Paxson, 1993 u More wide area network measurements u All TCP conversations between Lawrence Berkeley Laboratory (LBL) and the rest of the Internet world

10. 10 Measurement Methodology u Uses tcpdump u Captures only SYN (start) and FIN (end) packets of TCP connections (conversations) u Provides all the information needed for conversation level characterization u Dramatically reduces storage space needed u Makes longer trace durations possible

11. 11 Measurement Tools u Sun 3/50 on a network between LBL and the Internet u Capture all packet headers with SYN or FIN u Saved to local disk for later analysis u Headers have port id info for identifying specific network applications

12. 12 Measurements u Results are reported for one month of data (first data set collected November 1990) u 123,703,757 packets seen u Average of 3.5 million per day (40 per sec) u 84 Mbyte of raw trace data u 210,868 conversations u Represents 5.6 Gbyte of user data

13. 13 Measurements (Cont’d) u Elevent different application protocols identified in the traces u Results reported separately for each, as well as in aggregate u Repeated measurements at later times (e.g., March 1991) to assess growth in traffic with time

14. 14 Data Analysis u Presents aggregate workload characteristics, as well as a per application breakdown u Volume of data transferred u Network bandwidth used u Conversation lifetime u Conversation interarrival times u Geographical distribution u Develops models for each application as well

15. 15 Summary u A nice detailed study of wide area network TCP/IP traffic u Novel aspects: trace collection methodology, geographic analysis, models, growth u Identified significant growth in Internet traffic over fairly short time span u Growth continues to this day (and beyond!)