Introduction

The size of a fragment series is determined by the size of the original packet and and the headers that are added onto the fragments after the original packet is fragmented. The high number of 1540 byte series is caused by tunneled traffic, with thwarts path discovery and when the extra 40 byte header is added to the correctly-determined MTU of 1500 bytes. The sharp dropoff in the number of bytes per series on the aix traces can be attributed to the load balancing that takes place prior to that link.

Analysis

The link we monitor at the Ames Internet Exchange is load-balanced -- our monitor captures only a fraction of the traffic through AIX. Since individual packets can be routed through any of the links at AIX, and not necessarily the link our monitor can "see", we see far fewer complete fragment series. 93.0 percent of the fragments monitored on the UCSD-CERF link are members of a complete series, compared to between 9.6 and 10.8 percent of the fragments at AIX. The effect of load balancing mask any other phenomena, suppressing the normal distribution of series sizes.

frag_cerf_2000-05-17_12-11

This trace was taken on the UCSD-CERF link from Wed May 17 14:40:39 PDT 2000 to Fri Jun 2 20:42:48 PDT 2000. 50,375,114 packets containing 50,945,519,628 bytes of data composing 19,054,937 fragment series were captured in this interval. Of those, 17,718,285 (93.0%) were complete series.

Because the aix traces are taken on a load-balanced link, this UCSD-CERF graph shows a much wider distribution and greater prevalence of various byte counts per fragment series.

aix_frag_958848611

This trace was taken from the Ames Internet Exchange from Sat May 20 11:50:42 PDT 2000 to Tue May 23 23:04:01 PDT 2000. 9,781,240 packets containing 11,406,413,861 bytes of data composing 7,183,794 series fragment series were captured in this interval. Of those, 692,184 (9.6%) were complete series.

aix_frag_959148226

This trace was taken from the Ames Internet Exchange from Tue May 23 23:04:17 PDT 2000 to Fri May 26 11:00:28 PDT 2000. 8,599,458 packets containing 9,327,540,025 bytes of data composing 6,922,673 fragment series were captured in this interval. Of those, 747,401 (10.7%) were complete series.

aix_frag_959364017

This trace was taken from the Ames Internet Exchange from Fri May 26 11:00:48 PDT 2000 to Wed May 31 00:27:38 PDT 2000. 12,273,208 packets containing 13,645,419,937 bytes of data composing 9,832,899 fragment series were captured in this interval. Of those, 1,069,074 (10.8%) were complete series.