![[CAIDA - Center for Applied Internet Data Analysis logo]](/images/caida_globe_faded.png "Go to CAIDA home page")
Motivation
Another NeTraMet project, "Flow Lifetimes and Implications for Routing Control", shows that TCP streams tend to be very small in size - 'mice' - and to be much more common on Internet links than large streams - FTP file transfer 'elephants'. This project asks whether this tendency is evident when examining only web sessions.
NeTraMet Ruleset
This ruleset build flows for traffic from web servers outside SDSC to hosts inside, and produces distributions of:
- FromTCPSize: Number of TCP data bytes transferred
- FromTCPTime: Time (milliseconds) to transfer the TCP data, for streams greater than 10 bytes and less than or equal to 1 kByte
- FromTCPRate: Rate (kByte/sec) TCP data was transferred for streams greater than 1 kByte
Graphs
 Web Stream Size Distributions This plot shows the size distribution of web streams for nearly four days from Monday 5 Jun to Friday 9 Jun. Five-minute distributions were collected, and their minimum (red), first quartile (green), median (dark blue), third quartile (magenta), and maximum (cyan) were plotted. There is some diurnal variation, but overall 75% of the web streams are about 1 kByte or less in size. This is true even though the distribution is heavy-tailed, with streams counted in the overflow bucket (50kBytes). Clearly the mice greatly outnumber the elephants! |
 Web Stream Transfer Rate This image contains two plots. The time to transfer small web streams is plotted using the left-hand y axis. These were usually transferred in about 5 msec (except for the spikes on Thursday 8 Jun). The transfer rate for large streams is plotted on the right-hand y axis. The transfer rate for large streams is usually about 500 kB/sec (though it dropped during the 8 Jun spike). |
Discussion
It would be interesting to repeat these measurements at other sites so as to build up our understanding of what ranges of transfer times provide users with the perception that "the network is performing well". This is the next challenge for this kind of analysis project.