<<On Thu, 25 May 2000 21:08:19 -0400, "Steven M. Bellovin" <[EMAIL PROTECTED]> said:
> There are no good, current studies on LAN behavior that I've seen.
However, many LAN switches can provide this information to a
management process. With high-speed networks, this may be the only
way to get information on LAN behavior.
For example, incoming packets on one interface of my backbone switch
are distributed like this:
Bucket # packets %pack %bytes
--------- ----------- ----- ------
0-64 4769641806 29% 2.0%
65-127 5256510303 32% 6.7%
128-255 397530898 2.4% 1.0%
255-511 370987710 2.3% 1.9%
512-1023 1178964791 7.2% 12%
1024-1518 4506971031 27% 76%
(The last column assumes that packet sizes are uniformly distributed
within each bucket, which is wrong but close enough for the purposes
of this message. The first two columns are what I get out of my
switch. Unfortunately, this switch does not count outgoing packets in
the same way.)
That was on an outside-facing interface. An inside-facing interface
looks more like this:
0-64 18184 0.0% 0.0% (I'm not sure I believe this!)
65-127 29402735 42% 6.2%
128-255 6402318 9.2% 2.6%
256-511 848447 1.2% 0.7%
512-1023 2154682 3.1% 3.6%
1024-1518 31014396 44% 87%
(This is a gigabit Ethernet interface with 802.1Q encapsulation, so
the first bin includes only those packets with less than 47 bytes of
Ethernet payload. These two distributions together suggest that about
a quarter of all packets are between 46 and 50 bytes!)
> There have been a number of papers on WAN behavior. The usual result
> of those is that ~40-50% of packets are about 40-44 bytes, but most of
> the bytes are carried by packets of ~500-576 or 1500 bytes.
With a little bit of adjustment, this seems to be borne out in my LAN
environment as well. (But we're probably atypical.)
-GAWollman
