Understanding Internet Traffic Streams: Dragonflies and Tortoises

We present the concept of network traffic streams, and the ways they aggregate into flows through Internet links. We describe a method of measuring the size and lifetime of Internet streams, and use this method to characterise traffic distributions at two different sites. We find that although most streams (about 45% of them) are dragonflies, lasting less than 2 seconds, a significant number of streams have lifetimes of hours to days, and can carry a high proportion (50% to 60%) of the total bytes on a given link. We define tortoises as streams that last longer than 15 minutes. We point out that streams can be classified not only by lifetime (dragonflies and tortoises) but also by size (mice and elephants), and note that stream size and lifetime are independent dimensions. We submit that Service Providers (ISPs) need to be aware of the distribution of Internet stream sizes, and the impact of the difference in behaviour between short and long streams. In particular any forwarding cache mechanisms in Internet routers must be able to cope with a high volume of short streams. In addition ISPs should realise that Long-Running (LR) streams can contribute a significant fraction of their packet and byte volumes – something they may not have allowed for when using traditional ‘flat rate user bandwidth consumption’ approaches to provisioning and engineering.