Trends and Differences in Connection-behavior within Classes of Internet Backbone Traffic
Paper in proceedings, 2008
In order to reveal the influence of different traffic classes on
the Internet, backbone traffic was collected within an eight month period
on backbone links of the Swedish University Network (SUNET).
The collected data was then classified according to network application.
In this study, three traffic classes (P2P, Web and malicious) are compared
in terms of traffic volumes and signaling behavior. Furthermore,
longitudinal trends and diurnal differences are highlighted. It is shown
that traffic volumes are increasing considerably, with P2P-traffic clearly
dominating. In contrast, the amount of malicious and attack traffic remains
constant, even not exhibiting diurnal patterns. Next, P2P andWeb
traffic are shown to differ significantly in connection establishment and
termination behavior. Finally, an analysis of TCP option usage revealed
that Selective Acknowledgment (SACK), even though deployed by most
web-clients, is still neglected by a number of popular web-servers