Internet traffic flow profiling

Claffy, K. C., Braun, Hans-Werner
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego

Polyzos, George C.
University of California, San Diego

The current Internet aggregates flows of traffic among many end systems, users, and applications. Characterizing the nature of these flows will be critical to accomodating the increasing number and diversity of the Internet traffic flows. We present a methodology for profiling Internet traffic flows at a variety of flow granularities. Our methodology for modeling flows differs from many previous studies that have concentrated on end-point definitions of flows defined by TCP connections using the SYN and FIN control mechanism. Instead, we focus on the IP layer and define flows based on traffic satisfying various temporal and spatial locality conditions, as observed at internal points of the network. This approach to the definition and characterization of network flows may help address some central problems for networking based on the Internet model. Among them are route caching, resource reservation at multiple service levels, usage based accounting, and the integration of IP traffic over an ATM fabric. In this paper we first define the parameter space and then concentrate on metrics characterizing individual flows, including flow duration and flow volume in both packets and bytes. We consider various granularities of the definition of a flow, such as by destination network, host pair, or host and port quadruple. Our measurements demonstrate (i) the brevity of a significant fraction of IP flows (ii) that the number of host-pair IP flows is not significantly larger than the destination network flows, and (iii) that schemes for caching traffic information could benefit by maching caching decisions taking into account higher layer information.