UDP vs. TCP distribution [was: Re: [e2e] Can feedback be generated...]

[Simon Leinen]

>>>>> "gm" == George Michaelson <ggm at dstc.edu.au> writes:
> Wow. Completely proved me wrong.

Well... other networks may be different.  For example, we used to
charge the universities by volume (for transatlantic traffic we still
do), so that certainly has some influence on our usage.

>> 98 Also predates an explosion in IP-in-IP and other encapsulated
>> flows (VPNs, IPSEC, PPPoE) so I'd be willing to hazard there are
>> more fragmented flows than shown there.

> And I look to be wrong on IP-in-IP as well. 

That may also be different for other ISPs.  Our university users don't
do much VPN (yet?).

>   It also predates the explosion of applications such as Napster and
>   Gnutella (which both run over TCP), whose traffic volume dwarfs
>   that of all UDP traffic (at least on our network).

> The application mix that makes TCP predominate.. I didn't expect
> that. I had assumed like FSP these things used UDP layering.

You underestimate people's ability to learn from past mistakes
(-: although TCP is used for concerns other than TCP-friendliness).

> The UDP is going to be NTP and DNS?

Re-running my script with a tiny change:

protocol.............flows..............packets...............bytes.........
GRE               7071 ( 0.01 %)    268698 ( 0.02 %)     213346212 ( 0.04 %)
ICMP           3473563 ( 6.09 %)  10420689 ( 0.94 %)    1083751656 ( 0.20 %)
IGMP                 4 ( 0.00 %)         8 ( 0.00 %)          7264 ( 0.00 %)
IP-other         11604 ( 0.02 %)   3724884 ( 0.34 %)     763601220 ( 0.14 %)
IPINIP            4716 ( 0.01 %)     14148 ( 0.00 %)       2589084 ( 0.00 %)
TCP-BGP         154665 ( 0.27 %)    154665 ( 0.01 %)      10053225 ( 0.00 %)
TCP-FTP        1478600 ( 2.59 %)   7393000 ( 0.67 %)    2336188000 ( 0.42 %)
TCP-FTPD        161850 ( 0.28 %)  69433650 ( 6.26 %)   49783927050 ( 8.96 %)
TCP-Frag           285 ( 0.00 %)      3420 ( 0.00 %)        413820 ( 0.00 %)
TCP-NNTP         70222 ( 0.12 %) 113338308 (10.22 %)   21307601904 ( 3.83 %)
TCP-SMTP        968681 ( 1.70 %)  17436258 ( 1.57 %)    7689389778 ( 1.38 %)
TCP-Telnet       75043 ( 0.13 %)   1876075 ( 0.17 %)     324560975 ( 0.06 %)
TCP-WWW       24258155 (42.52 %) 315356015 (28.44 %)  235255587190 (42.34 %)
TCP-X             6509 ( 0.01 %)   2512474 ( 0.23 %)     293959458 ( 0.05 %)
TCP-other      7981277 (13.99 %) 415026404 (37.43 %)  215398703676 (38.76 %)
UDP-DNS        8185178 (14.35 %)  16370356 ( 1.48 %)    2111775924 ( 0.38 %)
UDP-Frag           444 ( 0.00 %)   1053168 ( 0.09 %)     767759472 ( 0.14 %)
UDP-NTP        3676906 ( 6.44 %)   3676906 ( 0.33 %)     279444856 ( 0.05 %)
UDP-TFTP            11 ( 0.00 %)        11 ( 0.00 %)           693 ( 0.00 %)
UDP-other      6537172 (11.46 %) 130743440 (11.79 %)   18042594720 ( 3.25 %)

So NTP is marginal in terms of traffic, DNS too (although not in terms
of number of flows).  The bulk of UDP *bytes* does in fact come from
"UDP-other" - I can think of audio/video streaming and gaming,
although the latter may be insignificant on a transatlantic link.

> Are the ssh tunnels looking like TCP and so IPSEC/ip-in-ip doesn't
> figure because grassroots, people use applications tunnels instead?

Maybe.  We definitely have customers who use IPSEC for VPN
applications (probably showing up in the "IP-other" category), but I
don't know whether they do this transatlantically, and our users may
do this less than users of commercial networks(?).
-- 
Simon.