On Measurement and Analysis of Internet Backbone Traffic

In the last decade, the Internet emerged undoubtedly as the key component for commercialand personal communication. The success of the Internet is mainly based on its versatilityand flexibility, allowing for the development of network applications ranging from simpletext based utilities to complex systems for e-commerce and multi-media content. The ongoingexpansion of the Internet is the cause of continuous unitlization and traffic behaviorchanges. Due to this diversity and the fast changing properties the Internet is a movingtarget. At present, the Internet is far from being well understood in its entirety. However,constantly changing Internet characteristics associated with both time and location makeit imperative for the Internet community to understand the nature and behavior of currentInternet traffic in order to support research and further development.Through the measurement and analysis of traffic the Internet can be better understood.This thesis presents a successful Internet measurement project, providing guidelines forconducting passive network measurements. Recent large-scale backbone traffic data is analyzed,revealing current deployment of protocol features on packet and flow level, includingstatistics about anomalies and misbehavior. A method to classify packet header data ontransport level according to network application is proposed, resulting in a complete trafficdecomposition. A comparison of the signaling behavior of the main traffic classes - Web,P2P, and malicious traffic - is presented. The results are significant because of the over-allimpact of these traffic classes on Internet traffic behavior. The scale of the measurementsallows to highlight longitudinal trends and changes in network application and protocolusage. Such findings support pro-active measures such as refinement of network design,provisioning, accounting and security measures. Finally, the analysis of data taken on vitalInternet backbone links also provides valuable input for simulation models. By presenting asnapshot of current traffic composition and characteristics, this thesis contributes to a betterunderstanding of how the Internet functions