Characteristic analysis of internet traffic from the perspective of flows

The necessity of network traffic monitoring and analysis is growing dramatically with increasing network usage demands from individual users as well as business communities. Most network traffic monitoring and analysis systems are based on flows. One key asset with these systems is to compress a significant amount of packet data into flows. However, the compression ratio is highly variable in the recent network environments due to the increased use of peer-to-peer file sharing applications and the frequent appearances of abnormal traffic caused by Internet worms, which negatively influences the performance of traffic analysis systems. The performance of traffic monitoring and analysis systems highly depends on the number of flows as well as link utilization and the pattern of packet arrival. This paper examines the characteristics of recent Internet traffic from the perspective of flows. We found that the frequent occurrence of flash flows highly affects the performance of the existing flowbased traffic monitoring systems. Using various flow related metrics, we analyzed the IP traffic traces collected from the Internet junction at POSTECH, a university with over 6,000 end hosts and servers.