Some Observations of Internet Stream Lifetimes
To be presented at PAM 2005

Nevil Brownlee
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego
and The University of Auckland, New Zealand

We present measurements of stream lifetimes in California and at Auckland. We suggest that one could ignore streams with less than six packets, since they usually account for 10% or less of the total bytes. However, we often observe large bursts of small 'attack' streams; we remark that a strategy of `focusing on the elephants' can be upset by such 'attack' streams.