Rethinking The Building Block: A Profiling Methodology for UDP Flows 123Jing Cai 13Zhibin Zhang 13Peng Zhang 13Xinbo Song 1Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China 2Graduate University of Chinese Academy of Sciences, Beijing, China 3National Engineering Laboratory for Information Security, Beijing, China
[email protected] Abstract—With the increase of network bandwidth, more and analysis on the 24-hour data we collected from a backbone more new applications such as audio, video and online games router, we found that the proportion of the UDP packets is have become the main body in network traffic. Based on real- around 40%. It could sometimes reach 80% at most. From the time considerations, these new applications mostly use UDP as transport layer protocol, which directly increase UDP traffic. view of the proportion of UDP bytes, we also found that the However, traditional studies believe that TCP dominates the proportion of the UDP bytes fluctuated greatly, but generally Internet traffic and previous traffic measurements were generally exceeded 40%, and sometimes was even above 80%. based on it while UDP was ignored. Since the increase of UDP traffic, more and more people In view of this, we mainly discuss the profiling methodology of have started to pay attention to the traffic of UDP. However, UDP flows in this paper. First, from the view of the network layer, we present a profiling methodology on the basis of the Claffy’s compared with the TCP, we found there at least exist two big parameter flow model. Next, due to the significant differences differences.