[e2e] packet size distribution of Internet traffic

[Nicolas Christin]

On Tue, 15 Apr 2003, Jianping Pan wrote:

> On Tuesday 15 April 2003 08:12 am, Nicolas Christin wrote:
>
> > The "typical" packet distribution is tri-modal, with the modes at or
> > around 40 bytes, 560 bytes, and 1500 bytes. A useful reference is
>
> These are the ``typical'' length for IP packets transporting TCP
> ACK, TCP data with the default MSS, and TCP data with the negotiated
> Ethernet MSS (and most Internet links support it now).

These were actually modelling what happens at backbone links with a mix
of TCP and UDP traffic. However, you are correct, in the sense that TCP
is predominant (over 90% in these traces).

I am not aware of any paper modelling packet sizes for UDP traffic only,
but these numbers should be pretty easy to infer. There is a public
repository of current traces available at <http://pma.nlanr.net/PMA/>.
>From there, you can access .tsh traces that contain (for each packet)
the protocol identifier of the IP header. By writing a very simple
script that filters out non-UDP packets, you should be able to get what
you want. Note that they already have decoding scripts available, so it
should be merely a matter of piping the decoded output through grep.

Best regards,
-- 
Nicolas