Some Observations of Internet Stream Lifetimes

We present measurements of stream lifetimes for Internet traffic on a backbone link in California and a university link in Auckland. We investigate the consequences of sampling techniques such as ignoring streams with six or fewer packets, since they usually account for less than 10% of the total bytes. We find that we often observe large bursts of small ‘attack’ streams, which will diminish the integrity of strategies that ‘focus on the elephants’. Our observations further demonstrate the danger of traffic engineering approaches based on incorrect assumptions about the nature of the traffic.