On the duration and spatial characteristics of internet traffic measurement experiments

Often, Internet measurement-based studies have followed a three-step procedure: collection of network measurements; measurement- based model inference; and generalization of the results obtained to other scenarios. Indeed, it has been a general belief that certain internetwork traffic statistics, such as the most used IP addresses and port numbers, show a similar behavior in networks with similar features, and the conclusions derived from the measurements of a given network could be extrapolated to a similar scenario. This study makes no starting assumption concerning this issue and undertakes a "spatial" analysis of network measurements. The measurement set comprises a six-month trace collected by RedlRIS (the Spanish National Research and Education Network) at different monitored points across the country. Our experiment shows that, although the frequency statistics of IP addresses and port numbers follow a Zipf distribution (as expected), the distributions' characteristic parameter values vary significantly in a spatial dimension (i.e., across individual university networks), even when the profile of the networks' user bases are similar. In practical terms, this means network designers, analysts, and operators should not assume that statistics for Internet site and applications usage for one network may accurately characterize other networks, even when those networks have similar user bases and environments. Furthermore, we show that experiment durations of approximately 30 days are necessary for the traffic processes to display stationarity. Hence, in order to obtain accurate statistics on traffic characteristics of large internetworks using state-of-the-art measurement techniques, long and spatially diverse experiments may be necessary.