On the characteristics and reasons of long-lived internet flows

Abstract

Prior studies of Internet traffic have considered traffic at different resolutions and time scales: packets and flows for hours or days, aggregate packet statistics for days or weeks, and hourly trends for months. However, little is known about the long-term behavior of individual flows. In this paper, we study individual flows (as defined by the 5-tuple of protocol, source and destination IP address and port) over days and weeks. While the vast majority of flows are short, and most bytes are in short flows, we find that about 20% of the overall bytes are carried in flows that last longer than 10 minutes, and flows lasting 100 minutes or longer make up 2% of traffic. We show that long-lived flows are qualitatively different from short flows: they are generally slower, less bursty, and are due to different applications and protocols. We investigate the causes of short-and long-lived flows, and show that the traffic mix varies significantly depending on duration time scale, with computer-to-computer traffic more and more dominating in larger time scales.

Prism

“…At the flow level, a GEANT router receives roughly 10 5 new flow records per second [26], and this is at a sampling rate of 1/1000. Previous studies also found that flows expire quickly ( [14] reports that 45% flows expire within two seconds, and 98% within 15 minutes), and that longer flows are more likely to be computer-tocomputer protocols that do not involve end users [54], which are presumably not as sensitive. At the user level, the IP-to-user mapping also changes over time, as users change ISPs or move to a different workplace.…”

Network traffic characterisation using flow-based statistics

“…The day-night pattern is best observed in flows per second since it expresses the number of connections. Using bytes or packets per second distorts the pattern since there are heavier flows during the day than at the night [12]. It is possible to use the number of hosts to show the day-night pattern but the results are very strongly correlated, therefore we decided to use flows per second.…”

Reducing Latency in African NRENS Using Performance-Based LISP/SDN Traffic Engineering

“…The length of data flows impacts the relative latency introduced at the controller and, furthermore, the number of active flows has implications for the size of the forwarding tables maintained at each Open Flow forwarding device. For example, a characterization of university campus network traffic [13] established that 21.4% of the traffic was carried by flows longer than 10 minutes, 12.6% by flows longer than 20 minutes, and nearly 2% was carried by flows longer than 100 minutes. Short flows are bursty and have flow speeds ranging from 1 Bps to over 10 kBps, while longer flows are slower, around 50 Bps for 40 min flows, [13].…”