Trends and Differences in Connection-behavior within Classes of Internet Backbone Traffic
Paper in proceedings, 2008

In order to reveal the influence of different traffic classes on the Internet, backbone traffic was collected within an eight month period on backbone links of the Swedish University Network (SUNET). The collected data was then classified according to network application. In this study, three traffic classes (P2P, Web and malicious) are compared in terms of traffic volumes and signaling behavior. Furthermore, longitudinal trends and diurnal differences are highlighted. It is shown that traffic volumes are increasing considerably, with P2P-traffic clearly dominating. In contrast, the amount of malicious and attack traffic remains constant, even not exhibiting diurnal patterns. Next, P2P andWeb traffic are shown to differ significantly in connection establishment and termination behavior. Finally, an analysis of TCP option usage revealed that Selective Acknowledgment (SACK), even though deployed by most web-clients, is still neglected by a number of popular web-servers

Traffic Analysis

Traffic Classification

Internet Measurement


Wolfgang John

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Sven Tafvelin

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Tomas Olovsson

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

03029743 (ISSN) 16113349 (eISSN)

Vol. 4979/2008 192-201

Subject Categories

Computer Engineering



More information