Characteristics of Fragmented IP Traffic on Internet Links

Colleen Shannon, David Moore, and k claffy
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego

Fragmented IP traffic is a unique component of the overall mix of traffic on the Internet. Many assertions about the nature and extent of fragmented traffic are anecdotal rather than empirical. In this paper we examine the causes and attributes of measured fragment traffic and contrast those results with commonly cited beliefs. In particular, the effects of NFS, streaming media, networked video games, and tunneled traffic are quantified, and we estimate the prevalence of packet fragmentation due to improperly configured machines. To understand the prevalence, causes, and effects of fragmented IP traffic, we have collected and analyzed seven multi-day traces from three sources. These sources include a university commodity access link, a highly aggregated commercial exchange point, and a local NAP. Although there is no practical method of ascertaining whether any data provide a representative sample of all Internet traffic, we do include data sources that cover several different types of WANs with traffic from commercial entities, educational and research institutions, and large government facilities.