Trends and Differences in Connection-behavior within Classes of Internet Backbone Traffic

In order to reveal the influence of different traffic classes onthe Internet, backbone traffic was collected within an eight month periodon backbone links of the Swedish University Network (SUNET).The collected data was then classified according to network application.In this study, three traffic classes (P2P, Web and malicious) are comparedin terms of traffic volumes and signaling behavior. Furthermore,longitudinal trends and diurnal differences are highlighted. It is shownthat traffic volumes are increasing considerably, with P2P-traffic clearlydominating. In contrast, the amount of malicious and attack traffic remainsconstant, even not exhibiting diurnal patterns. Next, P2P andWebtraffic are shown to differ significantly in connection establishment andtermination behavior. Finally, an analysis of TCP option usage revealedthat Selective Acknowledgment (SACK), even though deployed by mostweb-clients, is still neglected by a number of popular web-server