Common packet sizes on the Internet ?
Hakan Hellman
size(s) on the Internet ?
Thanks
Hakan
Walter Roberson
Hakan Hellman <hakan....@era.ericsson.se> wrote:
:Can someone point me to a site with data showing the most common packet
:size(s) on the Internet ?
That depends on what you mean by 'common', and also depends on what
level of resolution you want.
Every possible legal packet size is "common" in the same sense that
"traffic accidents are common on US highways". In other words, it
might be days or weeks in between any particular size being handled
by any particular router, but there is so much traffic going on
in the Internet that every size occurs somewhere. You need to
know, then, about absolute frequency and relative frequency.
The *average* packet size handled at any particular router varies
with details of the router use. Histograms of the packet size usually
peak in the 512-1023 byte range [including all headers and routing
information], with a secondary peak at 256 - 511 byte range.
Small packets occur a lot (ICMP, telnet), but being small they don't
tend to carry much of the data. Large packets carry a lot of the ftp
and http data, but telnet and nntp and NETBIOS and so on are so common
on the 'Net that usually it's the mid-sized packets that end up carrying
the bulk of the data.
It's like thinking about the cargo carrying capacity in the US. You use
trucks and trains when you want to ship large cargo, but there are
so *many* cars in the US that the total capacity of the cars is
greater than the truck + train capacity. [Or think about the number
of people transported by bus, plane, and train compared to by car; cars
do not carry much per car, but they are much more numerous.]
Aaron Leonard
In TCP/IP Illus Vol 3, in "Packets Found on an HTTP Server", there's
a table showing the distribution of MSSes advertised by HTTP clients.
About 1/3 used 1460B, 1/5 used 536B, 1/7 advertised none (hence 536
would normally be assumed), and 256 and 512 each accounted for about
1/10.
Note that this was true for a sample of 12 HTTP server sites in 1995,
and only covers HTTP. 5 years later, with a different mix of client
software, and with different applications (VPDNs, VoIP, MP3s, interactive
games), things will no doubt look quite different.
Aaron
---
~ Can someone point me to a site with data showing the most common packet
~ size(s) on the Internet ?
~
~ Thanks
~
~ Hakan
~
Hans Engberg
/Hans
Hakan Hellman wrote:
> Can someone point me to a site with data showing the most common packet
> size(s) on the Internet ?
>
> Thanks
>
> Hakan
Hakan Hellman
Hakan Hellman
Hakan Hellman
Hakan Hellman
Simon Leinen
> The *average* packet size handled at any particular router varies
> with details of the router use. Histograms of the packet size
> usually peak in the 512-1023 byte range [including all headers and
> routing information], with a secondary peak at 256 - 511 byte range.
Hm, that doesn't match my experience or the histogram on the CAIDA
site mentioned by Hans and Hakan. There days you are more likely to
see a distribution with a peak near 64 bytes (about 50% pkts but less
than 10% of the bytes on the CAIDA AIX histogram) and one near 1500
bytes (corresponding to the Ethernet MTU, about 14% pkts/50% bytes on
the CAIDA AIX histogram).
The small packets are either ACKs with no data (think of the ACK
streams of large FTP/HTTP data transfers), TCP signaling (SYN/FIN), or
messages from "chatty" applications that send data in very small
units. The large packets are mostly from TCP streams where the
sending endpoint successfully used Path MTU Discovery (RFC 1191) to
set the segment size according to the Path MTU (which currently is
1500 bytes for the majority of paths through the Internet).
Before Path MTU Discovery was widely used, TCP often had to fall back
to the minimum Internet MTU of 576 bytes. That's why histograms from
a few years ago had a peak in that range.
> Small packets occur a lot (ICMP, telnet), but being small they don't
> tend to carry much of the data. Large packets carry a lot of the ftp
> and http data, but telnet and nntp and NETBIOS and so on are so
> common on the 'Net that usually it's the mid-sized packets that end
> up carrying the bulk of the data.
At least for the traffic that crosses the NASA Ames IX our our
transatlantic link, about half of the traffic is actually carried in
1500-byte (Path-MTU-sized) packets. Note that NNTP and Netbios/SMB
are TCP-based protocols, and move most of their traffic in fairly
large chunks (inter-server USENET "feed" traffic for NNTP and file
transfer for Netbios), so I don't think these decreases packet size.
However there are other "chatty" protocols emerging, a notable one is
Gnutella, which tends to send many small packets rather than batching
them to fewer bigger ones.
--
Simon Leinen si...@babar.switch.ch
SWITCH http://www.switch.ch/misc/leinen/
Who is General Failure & why's he reading my disk?