UDP vs. TCP distribution [was: Re: [e2e] Can feedback be generated...]

[Simon Leinen]

>>>>> "tf" == Ted Faber <faber at ISI.EDU> writes:
>> [...]
>> TCP           532400385076 95.81 %
>> UDP            21201575665  3.82 %

> Bytes or packets?  Does the other unit support your conclusion, too?

Those were bytes.  Here's a summary from the same transatlantic links
(Eastbound direction only) which counts flows and packets too (new
version of script appended):

protocol.......flows..............packets...............bytes.........
GRE         7071 ( 0.01 %)    268698 ( 0.02 %)     213346212 ( 0.04 %)
ICMP     3473563 ( 6.09 %)  10420689 ( 0.94 %)    1083751656 ( 0.20 %)
IGMP           4 ( 0.00 %)         8 ( 0.00 %)          7264 ( 0.00 %)
IP         11604 ( 0.02 %)   3724884 ( 0.34 %)     763601220 ( 0.14 %)
IPINIP      4716 ( 0.01 %)     14148 ( 0.00 %)       2589084 ( 0.00 %)
TCP     35155287 (61.62 %) 942530269 (85.00 %)  532400385076 (95.81 %)
UDP     18399711 (32.25 %) 151843881 (13.69 %)   21201575665 ( 3.82 %)

So in terms of number of flows and packets, this particular
transatlantic link does indeed have a higher share of UDP than what
the 1998 "beast" paper observed.  Wether this is a general trend, or
just due to different usage patterns between our link and the links
observed by CAIDA, I don't know.  Actually I'd be glad if people could
run the script on other routers which aggregate large numbers of users
(especially non-academic users) and tell me whether the results are
wildly different or wildly similar.

For a comparison, here are the totals from an access router at a
random university:

protocol.......flows..............packets...............bytes.........
GRE          383 ( 0.00 %)     17235 ( 0.00 %)       3602115 ( 0.00 %)
ICMP    101931237 ( 1.75 %) 305793711 ( 0.45 %)   37918420164 ( 0.11 %)
IGMP       34662 ( 0.00 %)    901212 ( 0.00 %)      58578780 ( 0.00 %)
IP       1406788 ( 0.02 %)  15474668 ( 0.02 %)    3528224304 ( 0.01 %)
IPINIP      1297 ( 0.00 %)      1297 ( 0.00 %)        583650 ( 0.00 %)
TCP     4361852662 (74.91 %) 63919315234 (93.39 %) 32455859980970 (96.82 %)
UDP     1357265629 (23.31 %) 4201556174 ( 6.14 %) 1025284993546 ( 3.06 %)

This matches the CAIDA values much better.  Maybe the transatlantic
figures are biased because we run authoritative name servers for some
ccTLDs - those can be expected to generate lots and lots of
single-packet UDP port 53 flows.

Note also that the "flow" concept used in the CAIDA work isn't exactly
the same as Cisco NetFlow's, although the numbers may still be
comparable.  In case someone wants to know, we use the default flow
timeout values (30 minutes maximum lifetime or 1 minute(??) maximum
inactivity).
-- 
Simon.

#!/usr/local/bin/perl -w

my (%tb,%tp,%tf); my ($tb,$tp,$tf) = (0,0,0);
while (<>) {
    my ($proto,$f,$fps,$ppf,$bbp) = split;
    next unless defined $bbp && $proto =~ /^[A-Z]/ && $f =~ /^[0-9]+$/;
    $proto =~ s/-.*//;
    my $p = $f * $ppf; my $b = $p * $bbp;
    $tf{$proto} += $f, $tf += $f,
    $tb{$proto} += $b, $tb += $b,
    $tp{$proto} += $p, $tp += $p
	unless $proto eq 'Total:';
}
printf "protocol.......flows..............packets...............bytes.........\n";
foreach (sort keys %tb) {
  printf "%-7s %8.0f (%5.2f %%) %9.0f (%5.2f %%) %13.0f (%5.2f %%)\n",
	  $_,
	  $tf{$_}, 100.0 * $tf{$_} / $tf,
	  $tp{$_}, 100.0 * $tp{$_} / $tp,
	  $tb{$_}, 100.0 * $tb{$_} / $tb;
}
1;