URL: http://www.springerlink.com/index/5003xp1w35772084.pdf Entry Dates: 2009-02-11 Abstract: In order to reveal the influence of different traffic classes on the Internet, backbone traffic was collected within an eight month period on backbone links of the Swedish University Network (SUNET). The collected data was then classified according to network application. In this study, three traffic classes (P2P, Web and malicious) are compared in terms of traffic volumes and signaling behavior. Furthermore, longitudinal trends and diurnal differences are highlighted. It is shown that traffic volumes are increasing considerably, with P2P-traffic clearly dominating. In contrast, the amount of malicious and attack traffic remains constant, even not exhibiting diurnal patterns. Next, P2P andWeb traffic are shown to differ significantly in connection establishment and termination behavior. Finally, an analysis of TCP option usage revealed that Selective Acknowledgment (SACK), even though deployed by most web-clients, is still neglected by a number of popular web-servers. Results:

• datasets: collected in spring and fall 2006 on the OC192 backbone of the Swedish University Network (SUNET);
• flow level;
• overall traffic volumes are increasing for both TCP and UDP traffic, with highest activities at evenings;
• in terms of connection signaling behavior, there are major differences between the three traffic classes(P2P, Web, malicious traffic);
• TCP option deployment was shown to differ significantly between P2P and Web traffic.