1. Analysis of UDP Traffic Usage on Internet Backbone Links* Min Zhang Maurizio Dusi Wolfgang John *This study was performed while authors visited CAIDA at UCSD under supervision of kc claffy

2. Outline  Motivation  Dataset description  Analysis of UDP traffic usage  UDP/TCP ratio  Per-port analysis  Conclusion

3. Motivation  Is there an increase in UDP traffic?  Internet fairness and stability concerns  Where does additional UDP traffic stem from?  P2P applications (e.g. uTP protocol)?  IPTV applications?  Other unexpected reasons?  Study variability in data sets  differences of geographical locations, times, networks?

4. Datasets TimeLengthNetwork location Geogr. location CAIDA-OC48 2002-08 2003-01 1 hourTier1 backboneUS CAIDA-OC192 2008-06 2009-02 1 hourTier1 backboneUS GigaSUNET 2006-04 2006-11 20 minTier2 backboneSweden OptoSUNET 2009-01 2009-02 20 minTier2-Tier1 connection Sweden

5. Analysis (1)  Number of UDP flows has increased since 2002;  TCP still carries most of packets and bytes.

6. Analysis (2)  Before 2003: around 40% of UDP flows run on ports below 1024;  After 2003:usage of ephemeral ports (>1024) has become common;  Today:around 95% of the UDP flows run on ports >1024.  top-used ports (in terms of flows):  DNS, NTP and NetBios  P2P applications  4672, 4665 (eDonkey)  6881 (BitTorrent)  6346 (Gnutella)  6257 (WinMX)

7. Analysis (3)  Top-ten ports: fewer than 7 packets and less than 10KB on average.  Larger UDP flows appear mainly in the older traces, suggesting a drift in usage of UDP toward small (signaling) flows.

8. Summary  We investigate the trend of UDP traffic since 2002 a cross networks: from Tier1 and Tier2, different geographical locations  Number of UDP flows has increased  TCP is still the dominant transport protocol in terms of bytes and packets  Most UDP flows use ports > 1024 instead of traditional UDP service ports  Flows on ephemeral and P2P ports carry few packets and little data  Preliminary conclusion:  Current increases in UDP traffic are mainly due to signaling traffic of P2P applications.  Next steps?  Verifying the preliminary conclusion by more detailed analysis.  Continuing to monitor available data, to track trends of UDP usage.  Comparing to data from China (UDP-based IPTV is already common).  Investigating if UDP patterns can be used as a signature for traces, in order to infer usage patterns?