Network traffic analysis identifying invariant features in Internet traffic

A measurement based analysis of Internet traffic generated by the UMass Lowell (UML) network is presented in this work. Several months of Transmission Protocol Control (TCP) traffic generated by UML subnets are analyzed to determine and characterize invariant traffic features. The traffic generated by the campus network is characterized at three hierarchical levels: (i) aggregate traffic, (ii) traffic at subnet level and (iii) traffic at the host level. Additionally, the impact of source and destination application ports on traffic variability is examined. The daily and weekly traffic trends are presented. The subnets and hosts that contribute dominantly to the network load are identified. The random traffic variation is found to exhibit non-stationary features in the average rate, even on the time scales of minutes and seconds. Statistical tests to identify time-scales over which the traffic may be aggregated, while maintaining stationary features are presented. Several invariant features are identified that can enable network management and upgrading functions. The number of subnets that contribute to 90% of the daily load, the number of hosts that contribute to 90% of the subnet load, the distribution of traffic in terms of HTTP clients and servers are found to exhibit consistent features over several months of traffic analysis.