A First Look at Mobile Hand-Held Device Traffic

Abstract

Abstract. Although mobile hand-held devices (MHDs) are ubiquitous today, little is know about how they are used-especially at home. In this paper, we cast a first look on mobile hand-held device usage from a network perspective. We base our study on anonymized packet level data representing more than 20,000 residential DSL customers. Our characterization of the traffic shows that MHDs are active on up to 3 % of the monitored DSL lines. Mobile devices from Apple (i. e., iPhones and iPods) are, by a huge margin, the most commonly used MHDs and account for most of the traffic. We find that MHD traffic is dominated by multimedia content and downloads of mobile applications.

A Comparative Study of Handheld and Non-handheld Traffic in Campus Wi-Fi Networks

“…In 2010, logs from 43 smartphones were analyzed to find commonly used application ports and properties of TCP transfers over a combination of 3G and Wi-Fi networks [6]. A second 2010 study analyzes the protocol usage and HTTP content size and types of handheld traffic extracted from DSL traces [11]. The 2010 studies are most similar to our work, but one focuses primarily on 3G traffic and neither looks in-depth at the multimedia content served to handhelds nor the redundancy in handheld traffic.…”

Building up knowledge through passive WiFi probes

“…Therefore such analysis must be repeated from time to time with the objective of identifying potential important changes in how the two classes of devices differ [27][28][29][30]. Clearly, this operation calls for automatic methods able to classify traffic flows as belonging to one or the other class.…”

“…Unfortunately, most of the devices used nowadays are produced by manufacturers which produce both types of devices (e.g., Samsung, Apple): therefore such a method can be used only on a very small percentage of devices. To overcome this issue, two alternative methods are generally used in the literature, both resorting to traffic inspection tools which "read inside" application-layer traffic: DHCP fingerprinting [34] and inspection of the User Agent field of HTTP headers [27,30,33,35,36]. Unfortunately, both methods have two major drawbacks: first, they require the use of dedicated hardware (e.g., Deep Packet Inspectors) or software licenses (e.g., Cisco Identity Services Engine) on the existing network architecture, which might not be always possible due to high costs and administrative, management or privacy issues.…”

Workload Modeling for Computer Systems Performance Evaluation

“…For example, a study of hand-held devices found that their Internet activity was dominated by playing multimedia files and application downloads [459].…”