On Measurement and Analysis of Internet Backbone Traffic
Licentiatavhandling, 2008

In the last decade, the Internet emerged undoubtedly as the key component for commercial and personal communication. The success of the Internet is mainly based on its versatility and flexibility, allowing for the development of network applications ranging from simple text based utilities to complex systems for e-commerce and multi-media content. The ongoing expansion of the Internet is the cause of continuous unitlization and traffic behavior changes. Due to this diversity and the fast changing properties the Internet is a moving target. At present, the Internet is far from being well understood in its entirety. However, constantly changing Internet characteristics associated with both time and location make it imperative for the Internet community to understand the nature and behavior of current Internet traffic in order to support research and further development. Through the measurement and analysis of traffic the Internet can be better understood. This thesis presents a successful Internet measurement project, providing guidelines for conducting passive network measurements. Recent large-scale backbone traffic data is analyzed, revealing current deployment of protocol features on packet and flow level, including statistics about anomalies and misbehavior. A method to classify packet header data on transport level according to network application is proposed, resulting in a complete traffic decomposition. A comparison of the signaling behavior of the main traffic classes - Web, P2P, and malicious traffic - is presented. The results are significant because of the over-all impact of these traffic classes on Internet traffic behavior. The scale of the measurements allows to highlight longitudinal trends and changes in network application and protocol usage. Such findings support pro-active measures such as refinement of network design, provisioning, accounting and security measures. Finally, the analysis of data taken on vital Internet backbone links also provides valuable input for simulation models. By presenting a snapshot of current traffic composition and characteristics, this thesis contributes to a better understanding of how the Internet functions.

Packet Header

Internet Backbone

Header Anomaly

Malicious Traffic

Connection Behavior





Traffic Analysis

Room ES51, Rännvägen 6, Chalmers
Opponent: Prof. Mats Björkman


Wolfgang John

Chalmers, Data- och informationsteknik, Datorteknik

Heuristics to Classify Internet Backbone Traffic based on Connection Patterns

ICOIN '08: Proceedings of the 22nd International Conference on Information Networking,; (2008)

Paper i proceeding

Trends and Differences in Connection-behavior within Classes of Internet Backbone Traffic

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics),; Vol. 4979/2008(2008)p. 192-201

Paper i proceeding

Differences between In- and Outbound Internet Backbone Traffic

TERENA Networking Conference 2007, Copenhagen, DK,; (2007)

Paper i proceeding

Analysis of Internet Backbone Traffic and Header Anomalies Observed

IMC '07: Proceedings of the 7th ACM SIGCOMM conference on Internet measurement,; (2007)p. 111-116

Paper i proceeding



Technical report L - Department of Computer Science and Engineering, Chalmers University of Technology and Göteborg University

Room ES51, Rännvägen 6, Chalmers

Opponent: Prof. Mats Björkman

Mer information