[e2e] packet size distribution of Internet traffic

[Matthew J Zekauskas]

I believe Stanislav Shalunov has mentioned it in this forum,
but there are also summaries updated weekly from netflow data
taken from the Abilene network available from
http://netflow.internet2.edu/weekly/
including some rough bucketing of packet sizes...

--Matt


--On Tuesday, April 15, 2003 7:24 PM -0400 Nicolas Christin <nicolas at cs.virginia.edu> wrote:

> On Tue, 15 Apr 2003, Jianping Pan wrote:
>
>> On Tuesday 15 April 2003 08:12 am, Nicolas Christin wrote:
>>
>> > The "typical" packet distribution is tri-modal, with the modes at or
>> > around 40 bytes, 560 bytes, and 1500 bytes. A useful reference is
>>
>> These are the ``typical'' length for IP packets transporting TCP
>> ACK, TCP data with the default MSS, and TCP data with the negotiated
>> Ethernet MSS (and most Internet links support it now).
>
> These were actually modelling what happens at backbone links with a mix
> of TCP and UDP traffic. However, you are correct, in the sense that TCP
> is predominant (over 90% in these traces).
>
> I am not aware of any paper modelling packet sizes for UDP traffic only,
> but these numbers should be pretty easy to infer. There is a public
> repository of current traces available at <http://pma.nlanr.net/PMA/>.
>> From there, you can access .tsh traces that contain (for each packet)
> the protocol identifier of the IP header. By writing a very simple
> script that filters out non-UDP packets, you should be able to get what
> you want. Note that they already have decoding scripts available, so it
> should be merely a matter of piping the decoded output through grep.
>
> Best regards,
> --
> Nicolas
>
>