Trends and Differences in Connection-Behavior within Classes of Internet Backbone Traffic

  • Wolfgang John
  • Sven Tafvelin
  • Tomas Olovsson
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4979)


In order to reveal the influence of different traffic classes on the Internet, backbone traffic was collected within an eight month period on backbone links of the Swedish University Network (SUNET). The collected data was then classified according to network application. In this study, three traffic classes (P2P, Web and malicious) are compared in terms of traffic volumes and signaling behavior. Furthermore, longitudinal trends and diurnal differences are highlighted. It is shown that traffic volumes are increasing considerably, with P2P-traffic clearly dominating. In contrast, the amount of malicious and attack traffic remains constant, even not exhibiting diurnal patterns. Next, P2P and Web traffic are shown to differ significantly in connection establishment and termination behavior. Finally, an analysis of TCP option usage revealed that Selective Acknowledgment (SACK), even though deployed by most web-clients, is still neglected by a number of popular web-servers.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Moore, A.W., Papagiannaki, K.: Toward the Accurate Identification of Network Applications. In: Dovrolis, C. (ed.) PAM 2005. LNCS, vol. 3431, pp. 41–54. Springer, Heidelberg (2005)Google Scholar
  2. 2.
    Sen, S., Spatscheck, O., Wang, D.: Accurate, scalable in-network identification of p2p traffic using application signatures. In: WWW 2004: Proceedings of the 13th Int. World Wide Web Conference, New York, USA (2004)Google Scholar
  3. 3.
    Crotti, M., Dusi, M., Gringoli, F., Salgarelli, L.: Traffic classification through simple statistical fingerprinting. Computer Communication Review 37 (2007)Google Scholar
  4. 4.
    Karagiannis, T., Broido, A., Faloutsos, M., Claffy, K.: Transport layer identification of p2p traffic. In: IMC 2004: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, Taormina, Sicily, Italy (2004)Google Scholar
  5. 5.
    Gerber, A., Houle, J., Nguyen, H., Roughan, M., Sen, S.: P2p the gorilla in the cable. National Cable and Telecommunications Association (2003)Google Scholar
  6. 6.
    Sen, S., Jia, W.: Analyzing peer-to-peer traffic across large networks. IEEE/ACM Transactions on Networking 12 (2004)Google Scholar
  7. 7.
    Mori, T., Uchida, M., Goto, S.: Flow analysis of internet traffic: World wide web versus peer-to-peer. Systems and Computers in Japan 36 (2005)Google Scholar
  8. 8.
    Perenyi, M., Trang Dinh, D., Gefferth, A., Molnar, S.: Identification and analysis of peer-to-peer traffic. Journal of Communications 1 (2006)Google Scholar
  9. 9.
    John, W., Tafvelin, S.: Heuristics to classifiy internet backbone traffic based on connection patterns. In: ICOIN 2008: Proceedings of the 22nd International Conference on Information Networking, Busan, Korea (2008)Google Scholar
  10. 10.
    Plissonneau, L., Costeux, J.L., Brown, P.: Analysis of peer-to-peer traffic on adsl. In: Dovrolis, C. (ed.) PAM 2005. LNCS, vol. 3431, pp. 69–82. Springer, Heidelberg (2005)Google Scholar
  11. 11.
    John, W., Tafvelin, S.: (SUNET OC 192 Traces (collection)),
  12. 12.
    John, W., Tafvelin, S.: Analysis of internet backbone traffic and header anomalies observed. In: IMC 2007: Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, San Diego, CA, USA (2007)Google Scholar
  13. 13.
    Arlitt, M., Williamson, C.: An analysis of tcp reset behaviour on the internet. Computer Communication Review 35 (2005)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Wolfgang John
    • 1
  • Sven Tafvelin
    • 1
  • Tomas Olovsson
    • 1
  1. 1.Department of Computer Science and EngineeringChalmers University of TechnologyGöteborgSweden

Personalised recommendations