Internet traffic measurement and analysis in a high speed network environment: Workload and flow characteristics

A study on Internet traffic characterization is essential in designing the next generation Internet. In this paper we characterize the aggregated Internet traffic based on the traffic logs captured from a high speed Internet access network environment. First, we constructed an Internet traffic measurement and analysis system in high-speed Internet access network environment. Then, we analyzed the captured traffic in two ways. First, we analyze general Internet traffic characteristics. In this analysis, we present general workload characteristics of Internet traffic at each communication protocol layers. We also scrutinize how the behavior of upper layer protocols affects the characteristic of IP packet size. To be more precise in characterizing the aggregated Internet traffic, we analyze the captured traffic according to Internet flow model and show its general characteristics and derive analytic models describing the random variables associated with Internet flow size. In this analysis, we found that Internet flow consists of few packets, especially over 45% flows are composed of only one packet and its size is small and last only a few milliseconds. Even if Internet flows are small in size, most of Internet traffic is carried by small number of long-lived flows or big-sized flows. We also found that Internet flow size follows log-normal distribution which shows burstiness over a wide range of time scales. This is a sharp contrast to commonly made modeling choices that exponential assumptions dominate and show only short-range dependence and it has very close relationship with the self-similarity of the aggregated traffic.