A paper reporting the measurement of internal traffic in LBNL from Oct 2005 to Mar 2006. The measurement is done on many individual switch ports instead of using a central measurement point, so that more traffic can be captured. The finding is with the incomplete connections erased.

What learned are:

  • The network is healthy, as a IMC 2008 paper (ref 3) claims. Namely, it has a bit more than 66% successfully established connections
  • The intra- and inter-subnet traffic are 56% and 44% respectively. Thus using a central point for measurement is not accurate because this only captures the inter-subnet
  • Most applications are either sending a lot of bytes or creating a lot of connections, but not both.
  • Media transfer size is $<$ 2KB, but a few connections are extremely large ($>$ 5GB)
  • nearly 60% connections have the responder sending more data than the originator (up to 1.2M times more)
  • over 30% connections have the originator send more than the responder (up to 1.2B times more)
  • Heavytail: Top 15 flows send 57% of bytes. Top 160 connections send 90% of traffic, amongst 532K connections. Moreover, median rates are 2 Kbps and 10 Kbps for originator and responder respectively but 50% of connections can send faster than 100 Kbps.
  • Amongst 292M packets, only 583 has checksum error
  • Reordering occur in 484 connections. Packet out of order at a rate of 0.0025%
  • Intra-subnet transfer is in an order of magnitude faster than inter-subnet.

Bibliographic data

   title = "A Preliminary Analysis of TCP Performance in an Enterprise Network",
   author = "Boris Nechaev and Mark Allman and Vern Paxson and Andrei Gurtov",
   howpublished = "INM",
   booktitle = "Proc. Internet Network Management Workshop/Workshop on Research on Enterprise Networking",
   month = "April",
   year = "2010",