Description of Tables

This page describes the numerous analysis tables provided for each dataset. For illustrative purposes, we include the tables of the D04 [Backbone 1, 2002-08-14], bytes dataset on this page.

In the general design of the tables, a statistic is provided for all four possible combinations of link direction and source/destination endpoint (except for D08 [Backbone 1, 2003-05-07], which has only one direction). We use geographic orientation to label the direction of the backbone links rather than using the arbitrary (and not very informative) designations of 0 and 1. The northbound ("north") direction of both Backbone 1 and Backbone 2 travels from San Jose, CA to Seattle, WA. For the university link, we use inbound and outbound.

Object Diversity at Specific Traffic Percentiles

These tables show the percentage of objects that together contribute a given percentage of the total traffic. For example, we can see that 7.6% of the northbound source IP addresses contribute 99% of the total traffic. The values in the second column under each direction heading give the minimum volume of traffic (in either bytes or packets, depending on which set of tables is being viewed) contributed by each object. In the case of the previous example, each of the 7.6% of objects contribute at least 77k bytes.

See "Number of Objects Responsible for Specific Traffic Percentiles" for the object counts rather than object percentages. See "Traffic by IP/Prefix/Atom/AS" for the object diversity data grouped by object type rather than by traffic percentage.

north,srcnorth,dstsouth,srcsouth,dst
IP 7.6%77k7.3%112k5.5%426k7.2%53k
Prefix 7.1%7.5M29.4%14M7.3%60M17.2%7.4M
Atom 6.4%30M28.7%42M6.3%161M17.1%21M
AS 5.2%59M29.6%61M6.0%334M16.3%40M
Object Diversity of 99% of the Traffic

north,srcnorth,dstsouth,srcsouth,dst
IP 1.0%2.5M3.2%679k1.4%6.5M2.9%413k
Prefix 1.6%150M15.6%68M2.6%569M7.4%45M
Atom 1.9%416M11.8%228M2.0%1.7G6.2%171M
AS 1.6%800M11.5%362M1.7%3.5G4.8%341M
Object Diversity of 95% of the Traffic

north,srcnorth,dstsouth,srcsouth,dst
IP 0.4%10M1.7%1.7M0.6%22M1.5%985k
Prefix 0.7%474M10.2%161M1.1%1.4G4.1%116M
Atom 1.0%1.2G6.2%628M1.1%7.5G3.2%517M
AS 0.7%2.4G5.6%994M1.0%18G2.3%1.3G
Object Diversity of 90% of the Traffic

north,srcnorth,dstsouth,srcsouth,dst
IP 0.0%627M0.1%55M0.0%2.0G0.1%31M
Prefix 0.0%24G1.4%1.5G0.1%57G0.3%2.5G
Atom 0.1%37G0.5%18G0.2%74G0.2%16G
AS 0.1%69G0.3%78G0.2%96G0.1%40G
Object Diversity of 50% of the Traffic

Number of Objects Responsible for Specific Traffic Percentiles

These tables show the number of objects that together contribute a given percentage of the total traffic. For example, we can see that 21,816 of the northbound source IP addresses contribute 95% of the total traffic. See "Object Diversity at Specific Traffic Percentiles" for the object percentages rather than counts.

north,srcnorth,dstsouth,srcsouth,dst
IP 21,816129,24415,742369,433
Prefix 4491,7332163,329
Atom 18534470745
AS 8221135298
Number of Objects Responsible for 95% of the Traffic

north,srcnorth,dstsouth,srcsouth,dst
IP 2913,3901688,900
Prefix 91579142
Atom 514726
AS 4558
Number of Objects Responsible for 50% of the Traffic

Number of Objects that Individually Contribute 1% of the Traffic

This table shows the number of objects that individually contribute at least 1% of the total traffic. Note that some of these objects contribute far more than 1% of the traffic, which is made clear by the earlier table titled "Number of Objects Responsible for 50% of the Traffic." For instance, in that table, only 4 ASes are responsible for 50% of the traffic in the (north, src) column. Hence, there must be a single AS that contributes at least 12.5% of the traffic.

Note that the counts in a particular column may decrease in the progression from IP addresses to prefixes to atoms to ASes. For example, in the first column (north, src), the prefix count is 15 while the AS count is 14. This can happen when two prefixes, each contributing at least 1% of the traffic, belong to the same AS. The atom count can be higher than the AS count for a similar reason; in this case, two prefixes belonging to the same AS are put into two different atoms (it is not abnormal for the prefixes belonging to a single AS to be assigned to different atoms).

north,srcnorth,dstsouth,srcsouth,dst
IP 3070
Prefix 1582112
Atom 14202316
AS 14191616
Number of Objects that Individually Contribute 1% of the Traffic

Traffic by IP/Prefix/Atom/AS

These tables show the object diversity at specific traffic percentiles in the same manner as "Object Diversity at Specific Traffic Percentiles", except with the tables grouped by object type rather than by traffic percentage.

north,srcnorth,dstsouth,srcsouth,dst
99% 7.6%77k7.3%112k5.5%426k7.2%53k
95% 1.0%2.5M3.2%679k1.4%6.5M2.9%413k
90% 0.4%10M1.7%1.7M0.6%22M1.5%985k
50% 0.0%627M0.1%55M0.0%2.0G0.1%31M
Traffic by IP

north,srcnorth,dstsouth,srcsouth,dst
99% 7.1%7.5M29.4%14M7.3%60M17.2%7.4M
95% 1.6%150M15.6%68M2.6%569M7.4%45M
90% 0.7%474M10.2%161M1.1%1.4G4.1%116M
50% 0.0%24G1.4%1.5G0.1%57G0.3%2.5G
Traffic by Prefix

north,srcnorth,dstsouth,srcsouth,dst
99% 6.4%30M28.7%42M6.3%161M17.1%21M
95% 1.9%416M11.8%228M2.0%1.7G6.2%171M
90% 1.0%1.2G6.2%628M1.1%7.5G3.2%517M
50% 0.1%37G0.5%18G0.2%74G0.2%16G
Traffic by Atom

north,srcnorth,dstsouth,srcsouth,dst
99% 5.2%59M29.6%61M6.0%334M16.3%40M
95% 1.6%800M11.5%362M1.7%3.5G4.8%341M
90% 0.7%2.4G5.6%994M1.0%18G2.3%1.3G
50% 0.1%69G0.3%78G0.2%96G0.1%40G
Traffic by AS

Crossover

These tables describe several properties of the crossovers present in the datasets. By definition, the crossover split (100 - C)%/C% occurs when C% of the largest objects (by traffic volume) contribute (100 - C)% of the total traffic. For example, a split of 90%/10% would mean just 10% of the objects contribute 90% of the traffic. Although the crossover must exist, it rarely happens that C% of objects contribute exactly (100 - C)% of the traffic. Because object counts are discrete values with a limited range, it is more typical for C% of objects to contribute (100 - C + delta)%, for some small delta. In our tables, we list the C% that produces the smallest absolute delta. For all our datasets, the sum of the chosen object percentage (C%) and the traffic volume percentage [approx. (100 - C)%] is within 1% of 100%.

For the crossover split (100 - C)%/C%, the C% of largest objects (by traffic volume) are the elephants, and the remaining (100 - C)% are the mice. The traffic cutoff at the crossover is the minimum volume of traffic (in either bytes or packets) contributed by each of the elephants. In the tables showing the aggregate traffic volume of elephants and mice, percentages are with respect to the total traffic volume.

north,srcnorth,dstsouth,srcsouth,dst
IP 97.5/2.5%96.2/3.8%97.4/2.6%96.4/3.6%
Prefix 97.2/2.8%89.9/10.1%96.6/3.4%93.7/6.3%
Atom 97.1/2.9%92.1/7.9%97.0/3.0%94.4/5.6%
AS 97.4/2.6%92.3/7.7%97.0/2.9%95.1/4.9%
Crossover Split (volume%/object%)

north,srcnorth,dstsouth,srcsouth,dst
IP 443k486k2.3M263k
Prefix 47M164M364M60M
Atom 184M460M820M201M
AS 353M626M1.3G336M
Traffic Cutoff at the Crossover (i.e., Minimum Size of Elephants)

north,srcnorth,dstsouth,srcsouth,dst
IP 52,5492.5%155,4133.8%28,8352.6%458,5113.6%
Prefix 7802.8%1,12810.1%2873.4%2,8066.3%
Atom 2792.9%2307.9%1053.0%6765.6%
AS 1362.6%1417.7%592.9%3034.9%
Number of Elephants

north,srcnorth,dstsouth,srcsouth,dst
IP 1.2T97.5%1.2T96.2%2.1T97.4%2.1T96.4%
Prefix 1.2T97.2%1.1T89.9%2.1T96.6%2.0T93.7%
Atom 1.2T97.1%1.2T92.1%2.1T97.0%2.0T94.4%
AS 1.2T97.4%1.2T92.3%2.1T97.0%2.0T95.1%
Total Traffic Volume of Elephants

north,srcnorth,dstsouth,srcsouth,dst
IP 31G2.5%48G3.8%55G2.6%78G3.6%
Prefix 35G2.8%128G10.1%73G3.4%134G6.3%
Atom 37G2.9%100G7.9%65G3.0%118G5.6%
AS 33G2.6%98G7.7%63G3.0%105G4.9%
Total Traffic Volume of Mice (computed from volume of elephants, and thus may be slightly imprecise)

Geographic Distribution of Traffic

These tables show the breakdown of the traffic by continent. The percentages add up to 100% in each column. The actual volume of traffic (in bytes or packets) appears in the second column below each direction heading.

Traffic is aggregated by continent with the following procedure:

  1. Match a source or destination IP address to an address block issued by the Regional Internet Registeries (namely, ARIN, RIPE, APNIC, and LACNIC).
  2. Extract the country recorded in the registration record of the address block.
  3. Map the country to continent.
  4. Add up all traffic volumes by continent.

The above procedure has known limitations. The most important being that the registration record merely provides the contact address of the organization that has obtained an address block. This contact address could simply be the headquarters of a multi-national organization (e.g., a Tier-1 ISP) while the actual hosts are spread worldwide, leading to improper placement of hosts. Registration records are also sometimes out-of-date.

Registry data collected on the 1st and 26th of June, 2003, are used to compute the geographic breakdown for all datasets, including those from 2002. For the country-to-continent mapping, we use data from NetGeo along with a few manual additions.

north,srcnorth,dstsouth,srcsouth,dst
North America 77.6%984G88.8%1.1T91.4%2.0T65.5%1.4T
Asia 22.3%283G10.3%131G7.4%159G29.5%631G
Europe 0.0%194M0.1%1.8G0.1%1.2G3.9%83G
Oceania 0.1%941M0.2%2.7G1.2%25G0.3%7.0G
South America 0.0%149M0.5%6.3G0.0%1.0M0.6%13G
Africa 0.0%34M0.0%136k0.0%320k0.2%3.8G
unknown 0.0%370M0.0%100M0.0%148M0.0%173M
Geographic Distribution of Traffic

north,srcnorth,dstsouth,srcsouth,dst
North America 77.6%984G88.8%1.1T91.4%2.0T65.5%1.4T
Asia 22.3%283G10.3%131G7.4%159G29.5%631G
Europe 0.0%194M0.1%1.8G0.1%1.2G3.9%83G
other 0.1%1.5G0.7%9.1G1.2%25G1.1%24G
Geographic Distribution of Traffic (brief)

north,srcnorth,dstsouth,srcsouth,dst
North America 77.6%984G88.8%1.1T91.4%2.0T65.5%1.4T
Asia 22.3%283G10.3%131G7.4%159G29.5%631G
other 0.1%1.7G0.9%11G1.2%26G5.0%107G
Geographic Distribution of Traffic (briefer)

Related Objects

See https://catalog.caida.org/paper/2004_diversity/ to explore related objects to this document in the CAIDA Resource Catalog.