I'm interested in seeing the distribution of packet sizes across a 1500-byte-constrained measurement point, with "real internet traffic" going past (for some reasonable interpretation of that phrase). Specifically, I'm looking for the number of IP datagrams of size M for all M encountered throughout a long, contiguous packet stream (say a few hours' worth around the residential surfing busy hour). I can do measurements myself, but I'd prefer not to reinvent the wheel. Could anybody point me at some recent data? Thanks, Joe
> I'm interested in seeing the distribution of packet sizes across a > 1500-byte-constrained measurement point, with "real internet traffic" > going past (for some reasonable interpretation of that phrase). Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow Total: 758613841 176.6 2 1170 440.8 6.1 14.6 -Bill
Bill Woodcock writes:
I'm interested in seeing the distribution of packet sizes across a 1500-byte-constrained measurement point, with "real internet traffic" going past (for some reasonable interpretation of that phrase).
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow Total: 758613841 176.6 2 1170 440.8 6.1 14.6
I.e., on cisco routers with "Flow switching" enabled on all interfaces you want data included from, the router will give you that ...
show ip cache flow IP packet size distribution (1242M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .436 .050 .018 .012 .008 .006 .005 .004 .005 .004 .006 .004 .003 .004
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .003 .071 .030 .318 .000 .000 .000 .000 .000 .000 [...] Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow [...] Total: 55814697 43.4 22 581 965.3 5.1 7.9 Indeed, if you use the export mechanism you can capture the details behind this summary and analyze it pretty much as you like. #ip flow-export destination cflowd-machine #ip flow-export version 5
On Thu, Jul 27, 2000 at 10:41:20AM -0700, Mark Milhollan wrote:
Bill Woodcock writes:
I'm interested in seeing the distribution of packet sizes across a 1500-byte-constrained measurement point, with "real internet traffic" going past (for some reasonable interpretation of that phrase).
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow Total: 758613841 176.6 2 1170 440.8 6.1 14.6
I.e., on cisco routers with "Flow switching" enabled on all interfaces you want data included from, the router will give you that ...
show ip cache flow IP packet size distribution (1242M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .436 .050 .018 .012 .008 .006 .005 .004 .005 .004 .006 .004 .003 .004
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .003 .071 .030 .318 .000 .000 .000 .000 .000 .000 [...]
Thanks (and to all others that replied). I'm actually looking for more granular data than this; I was hoping to map the precise overspill of AAL5 + SNAP + IP packet sizes modulo 48 bytes to help produce (with the cell header tax) an estimate of the cost of ATM vs POS on an expensive trans-pacific STM-1. Apparently hard data is easier for people to believe than my handwaving :) I don't _think_ that mean packet sizes will give me what I want (unless the spikes in the histogram at 552, 576 and 1500 bytes are large enough to render the rest of the distribution practically meaningless). However, my statistics skills lie somewhere on the poor side of crap, and if someone can point out the glaringly obvious way to derive the fixed-size-cell overhead from data such as that quoted, I'd be glad to hear it. Joe
----- Original Message ----- From: "Mark Milhollan" <mlm@ftel.net> To: <nanog@merit.edu> Sent: Friday, July 28, 2000 1:41 AM Subject: Re: recent internet packet size samples
Bill Woodcock writes:
I'm interested in seeing the distribution of packet sizes across a 1500-byte-constrained measurement point, with "real internet traffic" going past (for some reasonable interpretation of that phrase).
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow Total: 758613841 176.6 2 1170 440.8 6.1 14.6
I.e., on cisco routers with "Flow switching" enabled on all interfaces you want data included from, the router will give you that ...
show ip cache flow IP packet size distribution (1242M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .436 .050 .018 .012 .008 .006 .005 .004 .005 .004 .006 .004 .003 .004
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .003 .071 .030 .318 .000 .000 .000 .000 .000 .000 [...] Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow [...] Total: 55814697 43.4 22 581 965.3 5.1 7.9
Indeed, if you use the export mechanism you can capture the details behind this summary and analyze it pretty much as you like.
#ip flow-export destination cflowd-machine #ip flow-export version 5
It seems the packets size varied greatly, the first one is 1170, the second is 581, while I sample my core network, and get 290. You will find there is some discrepancy between the direct result 581, and if you calculate probability size from the packets distribution: distribution: 32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 0.001 0.436 0.05 0.018 0.012 0.008 0.006 0.005 0.004 0.005 0.004 0.006 0.004 0.003 0.004 0.003 0.003 0.071 0.03 0.318 0 0 0 0 0 0 respective size: (multiply the two roles above respectively) 0.032 27.904 4.8 2.304 1.92 1.536 1.344 1.28 1.152 1.6 1.408 2.304 1.664 1.344 1.92 1.536 1.632 40.896 30.72 488.448 0 0 0 0 0 0 probability size (sum the line above up): 615.744 the error is: 615.744-581 = 34 bytes I have a question, how to get the packets size stat from a GSR? We know dcef is enable default in GSR, can we use dcef to get the stat ? thanks! ------------------------------------------------------ (Mr.) Yu(2) Ning(2) Int'l/Domestic Routing/Resource Man. ChinaNET(AS4134) Backbone Operation Center Networking Dep.,Datacom Bureau, China Telecom. Beijing,P.R.C +86-10-66418105/66418121/66418123(fax) ------------------------------------------------------
"Yu Ning" <yuning@cndata.com> wrote:
You will find there is some discrepancy between the direct result 581, and if you calculate probability size from the packets distribution: [...] the error is: 615.744-581 = 34 bytes
I haven't checked, but this might be a case of different semantics. Where "packets" in the sample distribution is of the entire ip datagram, but the protocol flow summary is of only the payload data.
I have a question, how to get the packets size stat from a GSR? We know dcef is enable default in GSR, can we use dcef to get the stat ?
The flow cache should provide this information on the GSR as well, and is not otherwise dependent on the forwarding path (dCEF).
On Thu, 27 Jul 2000, Mark Milhollan wrote:
Bill Woodcock writes:
I'm interested in seeing the distribution of packet sizes across a 1500-byte-constrained measurement point, with "real internet traffic" going past (for some reasonable interpretation of that phrase).
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow Total: 758613841 176.6 2 1170 440.8 6.1 14.6
I.e., on cisco routers with "Flow switching" enabled on all interfaces you want data included from, the router will give you that ...
show ip cache flow IP packet size distribution (1242M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .001 .436 .050 .018 .012 .008 .006 .005 .004 .005 .004 .006 .004 .003 .004
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .003 .003 .071 .030 .318 .000 .000 .000 .000 .000 .000
These numbers may vary quite a bit depending on the nature of your "real internet traffic". IP packet size distribution (34510M total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .003 .316 .033 .024 .021 .018 .011 .010 .013 .013 .009 .010 .006 .006 .007 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .005 .005 .413 .017 .049 .000 .000 .000 .000 .000 .000 ---------------------------------------------------------------------- Jon Lewis *jlewis@lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
participants (5)
-
Bill Woodcock -
jlewis＠lewis.org -
Joe Abley -
Mark Milhollan -
Yu Ning