80 likes | 204 Views
Analysis of UDP Traffic Usage on Internet Backbone Links*. Min Zhang Maurizio Dusi Wolfgang John. * This study was performed while authors visited CAIDA at UCSD under supervision of kc claffy. Outline. Motivation Dataset description Analysis of UDP traffic usage UDP/TCP ratio
E N D
Analysis of UDP Traffic Usage on Internet Backbone Links* Min Zhang Maurizio Dusi Wolfgang John *This study was performed while authors visited CAIDA at UCSD under supervision of kc claffy
Outline • Motivation • Dataset description • Analysis of UDP traffic usage • UDP/TCP ratio • Per-port analysis • Conclusion
Motivation • Is there an increase in UDP traffic? • Internet fairness and stability concerns • Where does additional UDP traffic stem from? • P2P applications (e.g. uTP protocol)? • IPTV applications? • Other unexpected reasons? • Study variability in data sets • differences of geographical locations, times, networks?
Analysis (1) • Number of UDP flows has increased since 2002; • TCP still carries most of packets and bytes.
Analysis (2) • Before 2003: around 40% of UDP flows run on ports below 1024; • After 2003: usage of ephemeral ports (>1024) has become common; • Today: around 95% of the UDP flows run on ports >1024. • top-used ports (in terms of flows): • DNS, NTP and NetBios • P2P applications • 4672, 4665 (eDonkey) • 6881 (BitTorrent) • 6346 (Gnutella) • 6257 (WinMX)
Analysis (3) • Top-ten ports: fewer than 7 packets and less than 10KB on average. • Larger UDP flows appear mainly in the older traces, suggesting a drift in usage of UDP toward small (signaling) flows.
Summary • We investigate the trend of UDP traffic since 2002 across networks: from Tier1 and Tier2, different geographical locations • Number of UDP flows has increased • TCP is still the dominant transport protocol in terms of bytes and packets • Most UDP flows use ports > 1024 instead of traditional UDP service ports • Flows on ephemeral and P2P ports carry few packets and little data • Preliminary conclusion: • Current increases in UDP traffic are mainly due to signaling traffic of P2P applications. • Next steps? • Verifying the preliminary conclusion by more detailed analysis. • Continuing to monitor available data, to track trends of UDP usage. • Comparing to data from China (UDP-based IPTV is already common). • Investigating if UDP patterns can be used as a signature for traces, in order to infer usage patterns?