A trace is a collection of packet records that contain a timestamp, HDLC information, and the first 40 bytes of the packet. Each trace only contains packets flowing in one direction of the link. The duration of the trace depends on the storage space in the monitoring machine and on the link load. Common values for the storage space are 50GB, 100GB, 202GB and 336GB.

In the following pages we present the results derived by a per-flow classification tool that has been designed and developed at Sprint ATL.

The results are organized in 5 sections:

• Link utilization
  Link load in bits per second and packets per second. The utilization is measured over 1 second intervals.
• Active flows
  A flow is defined as a set of packets with the same protocol number, destination and source IP addresses, and port numbers. A flow is terminated if it is idle (i.e. no packets for that flow are observed) for a period of 60 seconds. A flow is active from the time the first packet is observed to the time the last packet is observed, not the time the flow is terminated.
  Note that we don't use protocol specific information to define the start and end of a flow (e.g. SYN, FIN packets in TCP) in order to be as generic as possible.
  We also keep track of the number of used entries in the flow table, i.e. the number of flows the tool is keeping track of. This number clearly depends on the idle period, i.e. the longer we wait before terminating a flow, the larger the number of flow entry the tool needs to store.
• Traffic breakdown by protocol
  These pages present the breakdown of traffic in terms of packets and bytes by protocol number. The protocol number are defined according to http://www.iana.org/assignments/protocol-numbers.
• Traffic breakdown by application
  We define seven application categories: Web, File Sharing (i.e. P2P), FTP, Email and Newsgroups, Streaming (audio and video), DNS and Network Games. The classification in the categories is only based on the source and destination port numbers for UDP and TCP packets.
• Packet size distribution
  This page shows the packet size distribution for all IP packets, TCP only, UDP only and other protocols. It also identifies the five most common packet sizes.