Packet Length Distributions

The packet length distribution seen at NASA Ames Internet Exchange (AIX) is fairly constant, with no substantial trend observed between May 1999 and February 2000.

The following graphs show the distribution of IP packet sizes seen at the NASA Ames Internet Exchange (AIX). These packet length distributions are generated from multiple short traces collected at various times of day over two approximately one-week periods. Because these distributions contain contributions from the different workloads carried by the network at different times of day, they should represent more of an `average' picture of the packet size distribution than any individual trace. However, no attempt has been made to normalize the contributions of individual traces. The distributions presented here are simply those of the concatenated traces.

Additionally, these distributions have been plotted for packet sizes less than 1600 bytes only. This allows the structure of the distributions to be presented in greater detail, but ignores the very small fraction of large packets that appear in these traces (typically less than 0.005% of packets).

Fig 1: IP packet length distribution from 39 trace files captured between Thursday, May 13th 1999 at 19:14:36 PDT and Wednesday, May 19th 1999 at 13:02:20 PDT.

Statistics for the underlying packet length distribution:

Mean: 413 bytes, Standard Deviation: 509 bytes
Median: 93 bytes, Percentiles: 5th 40 bytes, 25th 40 bytes, 75th 576 bytes, 95th 1500 bytes
Number of Observations: 127 million packets [127710031 packets]

These numbers correspond to the red curve in the figure above.

Fig 2: IP packet length distribution from 43 trace files captured between Sunday, February 20th 2000 at 16:01:51 PST and Sunday, February 27th 2000 at 13:59:18 PST.

Statistics for the underlying packet length distribution:

Mean: 420 bytes, Standard Deviation: 521 bytes
Median: 78 bytes, Percentiles: 5th 40 bytes, 25th 40 bytes, 75th 576 bytes, 95th 1500 bytes
Number of Observations: 84 million packets [84415871]

These numbers correspond to the red curve in the figure above.

The primary features of this distribution are all due to the way common TCP implementations divide a data stream into packets. Approximately 85% of the traffic in these traces is TCP, and a large proportion of this TCP traffic is generated by bulk transfer applications such as HTTP and FTP. Consequently, the majority of the packets seen are one of three sizes: 40 byte packets (the minimum packet size for TCP) which carry TCP acknowledgements but no payload, 1500 byte packets (the maximum ethernet payload size) from TCP implementations that use path MTU discovery, and 552 byte and 576 byte packets from TCP implementations that don't use path MTU discovery.

These two distributions are strikingly similar despite the fact that the second is based on data collected more than 9 months after the first. The second distribution has a slightly larger contribution from packets smaller than 100 bytes, but the difference is quite small. The following graph shows how the mean and median values vary over the entire duration of our study.

Fig 3: Mean and median packet length values for each packet trace collected between Thursday, May 13th 1999 at 19:14:36 PDT and Sat Mar 11 13:57:38 PST 2000. Values have been binned by week, and the median for each bin is plotted with first and third quartile error bars.

Thanks to Hans-Werner Braun and NLANR/MOAT for supplying the packet trace data used for this analysis.