On the characteristics of Internet traffic variability: Spikes and Elephants
Tatsuya Mori
NTT Service Integration Laboratories,
NTT corporation
3-9-11 Midoricho Musashino-city Tokyo Japan,
andDept. of Information and Computer Science,
School of Science and Engineering,
Waseda University
3-4-1 Okubo Shinjuku Tokyo Japantatsuya@nttlabs.com

Ryoichi Kawahara
NTT Service Integration Laboratories,
NTT corporation
3-9-11 Midoricho Musashino-city Tokyo Japankawahara.ryoichi@lab.ntt.co.jp

Shozo Naito
NTT Information Sharing Laboratories,
NTT corporation
3-9-11 Midoricho Musashino-city Tokyo Japan
naito.shozo@lab.ntt.co.jp

Shigeki Goto
Dept. of Information and Computer Science,
School of Science and Engineering,
Waseda University
3-4-1 Okubo Shinjuku Tokyo Japan
goto@goto.info.waseda.ac.jp

Abstract
Analysing and modeling of traffic play a vital role indesigning and controlling of networks effectively. To construct a practical traffic model that can be used for various
networks, it is necessary to characterize aggregated traffic
and user traffic. This paper investigates these characteristics and their relationship. Our analyses are based on ahuge number of packet traces from five different networks
on the Internet. We found that: (1) marginal distributionsof aggregated traffic fluctuations follow positively skewed(non-Gaussian) distributions, which leads to the existenceof “spikes”, where spikes correspond to an extremely large
value of momentary throughput, (2) the amount of user traffic in a unit of time has a wide range of variability, and (3)flows within spikes are more likely to be “elephant flows”,
where an elephant flow is an IP flow with a high volume oftraffic. These findings are useful in constructing a practicaland realistic Internet traffic model.

1 Introduction
Analysing and modeling of traffic play a vital role in designing networks and controlling traffic effectively. To con-struct a practical traffic model, it is necessary to characterize both aggregated traffic and user traffic for the following
reasons. Firstly, the characteristics of aggregated traffic are
essential metrics for designing network bandwidth. This isbecause the fluctuations of aggregated traffic strongly affect the queuing behavior of routers. Knowledge of thefluctuations is also useful in the evaluation of QoS mechanisms such as diffentiated services and queue schedulingalgorithms. Secondly, the characteristics of user traffic areimportant for the purposes of traffic engineering. Several
recent papers have proposed router algorithms to control
per-flow bandwidth [7, 9, 17]. Exact knowledge of thesecharacteristics is helpful in fixing the parameters for suchalgorithms or proposing more efficient algorithms. Characterising user traffic is also useful in estimating the performance experienced by individual users.
Up to now, a number of studies have investigated thecharacteristics of aggregated traffic and user traffic. The
numerous papers on aggregated traffic have revealed thatfluctuations of aggregated traffic in various networks exhibit self-similarity [8, 16]. Self-similarity means that traffic fluctuations exhibit long-term time correlation. It has
also been found that the marginal distributions of aggregated traffic fluctuation play a key role in determining network performance [1, 4, 11]. Here, marginal distribution indicates a distribution of throughput per unit time (see lower

part of Fig. 1). On the other hand, several papers on user
traffic have revealed that the duration of individual user traffic follows heavy-tailed distribution [3, 20]. The characteristics were modeled by the well known “Pareto ON/OFF”
model. Recent measurement-based studies have also foundthat the size or average rate of user traffic exhibits quite awide range of variability [14, 21].
Although the characteristics of aggregated and user traffic have been widely studied, few reports have discussed therelationship between them 1 , which is essential for consistently incorporating both characteristics into a traffic model.
Since aggregated traffic is the superposition of user traffic,
the two characteristics are related. Knowing the relationship is also useful for determining traffic engineering policy. For instance, let us consider the following case. Aggregated traffic sometimes exhibits extremely large values (i.e.,bursts) which may cause severe packet loss or long queueing delays at routers. If we know the characteristics of user
traffic when bursts occur, we can establish a per-flow trafficengineering policy to control these bursts.
In this study, we analyzed the characteristics of aggregated traffic and user traffic and investigated the relationshipbetween the two. We obtained a huge number of packet
traces from five different networks on the Internet. The
rest of this paper is organized as follows. Section 2 describes how the traffic data was collected. Section 3 studies
the characteristics of aggregated traffic fluctuations and discusses spikes. Here, a spike is an extremely large value of
momentary throughput. In Section 4, we define per-timeunit flow and investigate the characteristics of user traffic.
We also demonstrate the existence of elephant flows, whichare IP flows with high volume traffic. Section 5 explainsthat elephant flows occur more frequently in spikes. Section
6 discusses the results and section 7 concludes this paper.

that traffic variability would be stationary within this timeinterval. Under these conditions, each trace had sufficient
packets to be analyzed statistically.
In our analyses, we used one-way traffic as summarizedin Table 1 because traffic volumes are asymmetrical. Investigating traffic with a larger volume is meaningful fromthe viewpoint of evaluating performance. The networks weused in our analyses are briefly described below.

2 Traffic Data

APAN This link is one of the international lines for the
Asia-Pacific Advanced Network (APAN) [2]. It connects
the APAN Tokyo Exchange Point in Japan and the STARTAP in the US. The link is an OC3 circuit. We captured
trace data usingOC3mon/Coral [12]. The measurements
were done during daily busy hours on various weekdays inAugust 1999. We used a total of 44 traces for this paper.

We obtained packet traces from five different networks
on the Internet. We captured packet data at a main communication link in each network. None of the links wereseverely congested, but all had sufficient traffic. As is wellknown, traffic exhibits a wide range variability during longterm measurement. For example, the average traffic volume is quite different during busy daytime periods than during less busy night periods. Therefore, we should capture
traces during an adequate period to avoid the effect of nonstationarity. In this paper, all traces were captured within aperiod of 300 seconds during daily busy hours. We assumed
1 The most well known work is the one by Willinger et al. [20]. They
found that superposition of user traffic with heavy-tailed duration time
makes aggregated traffic self-similar. However, as we later show, theirtraffic model cannot cover the characteristics of aggregated and user traffic
on today’s Internet. We will discuss this issue later.

NTTlab This link is used as the main external connection line of NTT R&D center (NTTlab). It is a 12-Mbps
ATM circuit. We captured trace data at an Ethernet segment
connected to the external link via the gateway router. The
measurements were conducted during daily busy hours on
various weekdays in July 2001. In total, we used 56 traces
for this paper.
Waseda This link is the main external connection line for
Waseda university, which is connected to the Inter-Ministry
Research Information Network (IMnet) [5]. The link is a100-Mbps Ethernet. The measurements were done during
daily busy hours on various weekdays in April and July
2001. We used a total of 71 traces for this paper.
OCN-SINET This link connects NTT’s Open Computer
Network (OCN) and the Science Information Network(SINET). OCN is the commercial Internet backbone network operated by NTT, and SINET is the largest Internet
backbone network for scientific research institutes in Japan.
The link is a 135-Mbps ATM circuit. The measurements
were done during daily busy hours on various weekdays in
January 2000. We obtained a total of 32 traces for this paper. For information about this data, see [6].

WIDE This is one of the international links for the
Widely Integrated Distributed Environment (WIDE) project– the largest Internet research community in Japan [19]. Theline is a 100-Mbps Ethernet with an 18-Mbps CAR (committed access rate). The trace data is available from the
MAWI traffic archive [10]. All the traces were measured
during daily busy hours (14:00–). We used traces measured
on various weekdays in September to November 2001. In
total, we used 66 traces for this paper. More detailed information on this data is given in [10].

dataNTTlab
WasedaOCN-SINET
APAN
WIDE

Table 1. Summary of data
direction
bandwidth # traces
incoming
12 Mbps56
incoming
100 Mbps
71
OCN-to-SINET 135 Mbps
32
US-to-JP
155 Mbps
44
US-to-JP
100 Mbps
66

line
ATM
Ethernet
ATM
OC3
Ethernet

NTTlab

WasedaOCN-SINET

60

APAN

X(ti) (Mbps)

avg rate
3.75 Mbps
23.31 Mbps
12.50 Mbps
5.14 Mbps
18.00 Mbps

WIDE

30

10

40

10
40

20

20

10

0

0

30

5

20

5

10
0

0

1000

2000

3000

0

1000

ti
10

P[X(ti) > x]

avg packets
1.55 × 10 51.84 × 10 6
8.06 × 10 55.98 × 10 51.61 × 10 6

10

0

10

-1

10

-2

10

10

10

-3

0

5

x (Mbps)

3000

0

1000

10

10

2000

3000

0

10

-1

10

0

-3

-1

60

10

-1

-1

10

10

20

x (Mbps)

30

10

2000

3000

Gaussian
Actual traffic

10
10

-3

-2

10

-4

0

1000

0

10

10

-4

40

0

ti

-2

-3

x (Mbps)

0

3000

10
10

10

-4

2000

0

10

20

1000

ti

-2

0

0

ti

-2

10

-4

10

2000

ti

0

0

5

10

10

-3

-4

0

x (Mbps)20

40

x (Mbps)

Figure 1. Marginal distributions of traffic fluctuations

Summary We used 269 traces from five different networks, and all of them were captured during a period of
300 seconds. Table 1 summarizes these.

3 Characteristics of Aggregated Traffic Fluctuations: Spikes
Let us analyze fluctuations of aggregated traffic for eachlink. We use throughput time series X (t i ) to represent
traffic fluctuations. X (t i ) are defined as follows. Letti (1 ≤ i ≤ M ) be time intervals, where M is the total
number of time intervals in a trace. For all i, the lengthof ti is the same time interval τ . For each t i , we define
variable X (ti ) as the throughput in t i . It is calculated withformula X (ti ) = b (ti ) /τ , where b (ti ) is the total numberof bits sent during the time interval t i . In this paper, thelength of τ is set to 0.1 seconds (100 milliseconds). Since
each trace covers 300 seconds, the number of time intervals M for each trace is 3000 (3000 = 300/0.1). It should
also be pointed out that, while we used a time interval of
0.1 seconds, the following results also held for various timeintervals such as 0.01 seconds, 1 seconds, and 10 seconds.
Figure 1 shows the time series of throughput variables

X (ti ) (upper) and their marginal distributions (lower) for
randomly chosen traces in the five networks described in
Section 2. For the comparison, we draw the curve of Gaussian distributions having the same mean and standard deviations (dashed lines). These figures clearly show that for all
five traces, the marginal distributions of traffic fluctuations
are not Gaussian. They are all positively skewed.
To characterize the distributions, we use skewness, defined as3(X (ti ) − X (ti )),(1)
skewness =3
σX
where X (ti ) stands for the mean of X (t i ) and σX is thestandard deviation of X (t i ). If the distribution is skewed
positively (negatively), skewness becomes positive (negative). If the distribution is strictly Gaussian, the shape ofthe distribution is symmetric and the skewness must be 0.
For the five traces in Fig. 1, we calculate the skewness ofthroughput variables. Table 2 reveals that all skewnesses
take positive values. This quantitatively indicates that all the
distributions in Fig. 1 are positively skewed. In Table 2, thetraffic fluctuations of the NTTlab trace is positively skewed
most in these five traces.

Table 2. Skewness of five traces
NTTlab Waseda OCN-SINET APAN
1.31
0.92
0.65
0.58

skewness

WIDE
0.69

2.0
<X(ti)>

spike
non-spike<X(ti)> + 2σX

-3

10

-4

0

x

5

<X(ti)> <X(ti)> + 2σX

10negatively skewed

APAN

spike

-1

10
10

-2

-3

10

-1.0
10

-4

x

10

Time (sec)<X(ti)> <X(ti)> + 2σX

WIDE

APAN

OCN-SINET-20symmetricX(ti)NTTlab

10

X(ti)

-0.5

spike
-1

10

10

P[X(ti) > x]

0.0

NTTlab
WasedaSkewness

0.5

averagepositively skewed

P[X(ti) > x]

10

1.5

1.0

<X(ti)> <X(ti)> + 2σX

0

0

5

10

Time (sec)Figure 2. Skewness of all traces
Figure 3. Examples of spikes
We calculate the skewness of throughput variables for all
traces. Figure 2 illustrates the skewness for all traces in thefive networks. Each point corresponds to one trace. While
there are a few traces with a skewness close to zero, mosthave positive skewness. The average skewness is at least
0.39 for the five networks.
From the above, we conclude that marginal distributionsof traffic fluctuations are positively skewed in various networks. Some previous studies such as those by Addie etal. [1], and Grossglauser and Bolot [4] also suggest thatmarginal distributions of traffic fluctuations are positively
skewed and do not follow Gaussian distributions. However,
the amount of traffic data used in their studies was quite afew. Our analyses are based on vast number of traces. This
supports the results widely for various networks — several
Internet uplinks and backbone lines.
The positively skewed marginal distribution of traffic
fluctuations suggests that there are throughput variables
X (ti ) whose values are extremely large. These extremely
large throughput values may cause severe packet loss orlong queueing delay at routers. That is, they are strongly
related to network performance. Therefore, it is meaningful
to characterize them. Here, we define an extremely large
throughput variable X (t i ) as a spike.
 (k) a spike if
Definition 1: We call a throughput variable X
it satisfies
 (k) ≥ X (ti ) + 2σX ,X

1 ≤ k ≤ NS ,(2)

where X (ti ) stands for the mean of X (t i ), σX isthe standard deviation of X (t i ), and NS is the num-

ber of spikes in a trace. The set of spikes Ω S 
 (k) (1 ≤ k ≤ NS ) satisfies ΩS ⊂ ΩX , where ΩX is theX
set of throughput variable X (t i ) (1 ≤ i ≤ M ).
We set a mean value plus two standard deviations forthe threshold value of large throughput variables — spikes.
Figure 3 has examples of spikes for the NTTlab and APAN
traces used in Fig. 1. In Fig. 3, the graphs at the top are
NTTlab traces and those at the bottom are APAN traces.
These two traces have the maximum and minimum skewness among Table 2. The graphs at the left are the marginal
distributions of traffic fluctuations (throughput), and theones at right are actual time series for throughput (part ofthem). The solid lines indicate X (t i ) and the dashed lines
indicate X (ti ) + 2σX . In the figures at right, the blackzone corresponds to spikes and the gray zone corresponds
to non-spikes.
Let us investigate the relationship between spikes andskewness. We define the occurrence ratio of spikes in eachtrace. It is calculated as NS /M , where M is the number ofthroughput variables in a trace and N S stands for the number of spikes in the trace. It should also be noted that in
a Gaussian distribution, the occurrence ratio of spikes (i.e.,
the probability a random value will exceed the mean plus
two deviations) is about 0.023.
Figure 4 is a scatter plot of the occurrence ratio and theskewness for all the traces in the five networks. Here, eachpoint corresponds to one trace. The solid lines represent thelinear regression, and variable R indicates the value of theNTTlab

2.0

Waseda2.0

Skewness

1.5
1.0
0.5

1.5

1.5

1.0

1.0

1.0

1.0

0.5

0.1

0.5

R = 0.93
0.0

Occurrence ratio of spikes

0

0.05

0.5

R = 0.63
0.1

Occurrence ratio of spikes

0.0

0

0.05

WIDE

2.0

1.5

0.5

0.05

APAN

2.0

1.5

R = 0.70
0.0
0

OCN-SINET

2.0

R = 0.78
0.1

Occurrence ratio of spikes

0.0

0

0.05

R = 0.67

0.1

Occurrence ratio of spikes

0.0

0

0.1

0.05

Occurrence ratio of spikes

Figure 4. Scatter plot of the occurrence ratio of spikes and skewness

correlation coefficients. It is clear that the occurrence ratio
and the skewness are positively correlated for all five networks. The correlation coefficients are at least 0.63. If theoccurrence ratio of spikes increases, the skewness also increases. We can also see that in most traces, the occurrence
ratios of spikes are higher than the Gaussian distribution(i.e., most of occurence ratios are greater than 0.023).
These observations can be summarized as follows. In
all traces, marginal distributions of traffic fluctuations are
positively skewed. According to positively skewed distributions, there are a larger number of spikes than those calculated assuming Gaussian distribution. Since spikes may
cause packet loss or queueing delays, it is necessary to know
their characteristics and causal mechanisms.

4 Characteristics of User Traffic: ElephantThis section analyzes the characteristics of user traffic.
We investigate an IP flow as user traffic. Let us first introduce per-time-unit flow which is an IP flow defined in agiven time unit. We can then calculate the size distributionsof per-time-unit flows for all traces. We found that there
were quite large per-time-unit flows with non-negligible
probability. We call these elephant flows.

4.1 Per-time-unit flow
We introduce a per-time-unit flow to divide the traffic
into flows according to the time interval. We see how the
behavior of each flow contributes to the characteristics ofaggregated traffic.
Figure 5 is a diagram of per-time-unit flow. In this figure,each rectangle corresponds to one IP flow. An IP flow is agroup of IP packets having the same combination of source
IP address, destination IP address, source port, destination
port, and the protocol field. We divide an IP flow into M
pieces, where M stands for the number of time intervals
defined in Section 3. The length of time interval τ is again
set to 0.1 seconds. For each time interval t i , we define pertime-unit flow f l (ti , j), 1 ≤ j ≤ Nti (shaded regions in

fl(ti,j)fl(ti,j-1)
fl(ti,2)fl(ti,1)

t1 t2 t3titM

Figure 5. Diagram of per-time-unit flow.

Fig. 5). Nti is the number of per-time-unit flows in timeinterval ti . The per-time-unit flow f l (t i , j) should containat least one packet in time interval t i .
For each per-time-unit flow f l (t i , j), we define its sizeas b (f l (ti , j)) (bits). Throughput variable X (t i ) satisfies
j=Nti
X (ti ) =j=1

b (f l (ti , j))
.
τ

(3)

For all traces in Fig. 1, we calculate N ti for each X (ti ) belonging to spikes (X (t i ) ∈ ΩS ) and non-spikes (X (t i ) ∈(ΩX − ΩS )) separately. We then take the average values of
Nti for spikes and non-spikes. Table 3 lists the results. Although the average value of N ti is slightly larger in spikes
than in non-spikes, the difference is not large. Since thenumbers of N ti are almost the same, we may conclude
that a large value of X (t i ) derives from large values ofb (f l (ti , j)). That is, b (f l (ti , j)) is considered to be themajor factor determining whether X (t i ) is a spike or not,and Nti is not relevant.
In the following sections, we focus on the size distribution of per-time-unit flow b (f l (t i , j)).

Complementary cumulative distribution

Table 3. Average of Nti for spikes and non-spikes
NTTlab Waseda OCN-SINET APAN WIDE
spike
17.8
80.9
191.7
50.9
253.6
non-spike
15.2
78.2
174.3
48.3
213.7

NTTlab0

10

Waseda

0

10

-2

-1

10

-2

10

-2

10

WIDE

0

10

-1

10

-2

10

APAN

0

10

-1

10

-1

10

OCN-SINET

0

10

-1

-2

10

10

10

-3

-3

10

-3

10

-3

10

10

-3

10

-4

-4

10
-4

10

10

-5

-5
3

10

4

5

10

10

b(fl(ti,j)) (bit)

6

10

10

3

10

4

10

5

10

6

10

7

10

10

-5

10

-6

2

10

10

-5

10

-6

2

10

-4

10

-5

10

10

-4

10

-6

2

10

3

10

b(fl(ti,j)) (bit)

4

10

5

10

6

10

10

-6

2

10

3

10

b(fl(ti,j)) (bit)

4

10

5

10

6

10

10

2

10

b(fl(ti,j)) (bit)

3

10

4

10

5

6

10

10

7

10

b(fl(ti,j)) (bit)Figure 6. LLCD plots of b (f l (ti , j)).

4.2 Size distribution of per-time-unit flow
— occurrence of elephant flows —We define the occurrence ratio of elephant flows (number) and occupation ratio of elephant flows (size). They aredefined by

We investigate the size distribution of per-time-unit flowf l (ti , j) (i.e., the distribution of b (f l (t i , j)).).
We calculate the following complementary cumulative
distribution.
P [b (f l (ti , j)) > x]

(4)

Figure 6 shows the log-log complementary cumulative
distribution (LLCD) plots of b (f l (t i , j)) for the five tracesin Fig. 1. The distributions show that b (f l (t i , j)) varies
over several orders of magnitude. That is, there are large
per-time-unit flows with non-negligible probability, whilemost per-time-unit flows are relatively small. We call a large
per-time-unit flow an elephant flow.
Definition 2: We call a per-time-unit flow fl (m) =f l (ti , j) an elephant flow if it satisfiesb fl (m) ≥ b (f l (ti , j)) + 2σb , 1 ≤ m ≤ NE ,(5)
where b fl (m) is the size of the flow, b (f l (ti , j))is the mean of b (f l (ti , j)) and σb is the standard
deviation of b (f l (t i , j)), and NE is the total number of elephant flows in the trace. The set of elephant flows ΩE  fl (m) (1 ≤ m ≤ NE ) satisfiesΩE ⊂ ΩF , where ΩF is the set of per-time-unit flows
f l (ti , j) (1 ≤ i ≤ M, 1 ≤ j ≤ Nti ).
Similar to the definition of spikes, we set the mean value
plus two standard deviations for the threshold values oflarge per-time-unit flows — elephant flows. The dashedlines in Fig. 6 indicate the threshold values.

NEoccurrence ratio = 
i Nti
and

occupation ratio = mbfl (m)i,j b (f l (ti , j))

(6)

.

(7)

We calculate the above two ratios for the traces in Fig. 1.
Results are summarized in Table 4 and these indicate thatfor all five traces, a small number of elephant flows occupy
a large part of the entire aggregated traffic 2 .
This kind of phenomenon is well known as the elephantand mice phenomenon or the vital few and the trivial manyrule. Some papers have reported that the size or averagerate of IP flows follows the elephant and mice phenomenon[14, 21]. In this study, we found that the size of a per-timeunit flow (i.e., momentary rate of IP flow) also have thistendency. Thus, a small percentage of flows occupies a largepart of the whole aggregated traffic in a unit of time.
While researchers such as Papagiannaki et al. [14] andZhang et al. [21] focused on the behavior of average flowrate (i.e., average flow rate is equal to flow size divided
by flow duration time), this paper uses per-time-unit flows.
This is because they represent the behavior of IP flows moreaccurately during a short time interval. As the rate of an IP
flow is not constant but is highly variable, our approach andfindings can directly address the relationship between flowlevel behavior and the characteristics of aggregated traffic.
2 While we used the five traces in Fig. 1, the results were the same forthe rest of the traces as well.

Table 4. Occurrence and occupation ratios of elephant flows
NTTlab Waseda OCN-SINET
APAN
WIDE
Occurrence ratio 3.01 %1.15 %
2.35 %
3.22 %
4.65 %
Occupation ratio 35.72 % 39.07 %25.59 %
41.22 % 41.30 %

80

Spike
Non-spike
10

50NTTlab

WasedaOCN-SINET

APAN

WIDE

Figure 7. Occurrence ratio of elephant flows(average)

5 Spikes and Elephants
As we have discussed in the previous subsections, there
are elephant flows, which have a large number of packets
during a given short time interval. We presume that the existence of elephant flows is closely related to spikes. In otherwords, we presume that within a spike, the occurrence ofelephant flows would be higher than in other areas (e.g., in
non-spikes).
To prove this, we calculate the following statistics. For
per-time-unit flows belonging to spikes and non-spikes, we
separately calculate the occurrence and occupation ratios ofelephant flows. Their definitions are the same as those given
in formulas (6) and (7).
Figures 7 and 8 show the occurrence and occupation ratios of elephant flows for all five traces. We used the average value for traces belonging to each network. The figure
shows that both ratios of elephant flows are higher in the
spikes. This means that:
1. Within spikes, the occurrence probability of elephantflows is higher than that in non-spikes (about 1.7 – 2.9
times higher).
2. A large part of the spikes are constructed by elephantflows (for spikes, about 42 – 61% of per-time-unit
flows are elephant flows).
We thus verified our presumption.

Occupation ratio of elephant flows (%)

Occurrence ratio of elephant flows (%)

15

Spike
Non-spike
60

40

20

0

NTTlab

WasedaOCN-SINET

APAN

WIDE

Figure 8. Occupation ratio of elephant flows(average)

The most significant result here is that there are elephantflows in spikes at a higher probability than in non-spikes.
In other words, when there are a larger number of elephantflows in a time interval, the throughput variable of the timeinterval tends to be a spike. Our flow level analyses revealthat the occurrence of elephant flows is an essential factor
in generating spikes.

6 Discussion
The relationship between the characteristics of aggregated traffic and user traffic plays a key role in constructing
a practical and realistic traffic model. However, little work
has focused on this issue. The heavy-tailed ON/OFF source
traffic model [20] is the best well known and most valuable
one, which takes both the characteristics into account. This
traffic model reflects the characteristics of (1) self-similarity(aggregated traffic) and (2) heavy-tailed duration (user traffic). A number of measurement analysis have shown thegenerality of these characteristics. The model explains bothcharacteristics in a consistent fashion. That is, the superposition of heavy-tailed ON/OFF user traffic leads to theself-similarity of aggregated traffic. Willinger et al. [20]proved the above relationship within a rigorous mathematical framework, and Park et al. [15] also verified it by simulation. The model has also been implemented on such widelyused network simulators as NS [18] or OPNET [13].
However, the model has two big weaknesses. Firstly, themarginal distribution of aggregated traffic fluctuations is assumed to be Gaussian. As we have shown, this Gaussian
assumption does not agree with the characteristics of realInternet traffic. Secondly, traffic is assumed to be aggregated from a number of flows having the same fixed rate.
Therefore, each flow has the same size on a certain timescale when the flow is in an ON-period. As we have seen,
flow rates (i.e., size of per-time-unit flow) vary over several
orders of magnitude.
Thus, it is essential that we include positively skewed
marginal distributions of traffic fluctuations (aggregatedtraffic) and the great variability in flow rate distribution(user traffic) in the traffic model. Our measurement-based
analyses revealed these characteristics and the relationshipbetween them. By considering these characteristics, we canconstruct a practical and realistic Internet traffic model. Ourfindings will also be useful in the setting of traffic engineering policies for user traffic. For instance, since elephantflows make a large contribution to spikes (i.e., bursts), controlling user traffic that takes the form of elephant flows will
effectively suppress bursts. We will extend our research to atheoretical investigation of the relationship to better understand these phenomena in network traffic.

7 Conclusion
In this paper, we investigated the characteristics of aggregated and user traffic, and the relationship between them.
We collected a huge number of packet traces from five different networks on the Internet. Our main findings are
as follows. (1) Marginal distributions of aggregated traffic fluctuations followed positively skewed (non-Gaussian)
distributions, which led to the existence of spikes, (2) thesize of user traffic per unit time revealed a wide range ofvariability, and (3) elephant flows were more likely within
spikes. These findings will be useful in the construction ofpractical and realistic Internet traffic models.

References[1] R. G. Addie, T. D. Neame, and M. Zukerman. Modelingsuperposition of many sources generating self similar traffic.
In Proceedings of ICC, pages 387–391, June 1999.
[2] Asia-Pacific Advanced Network. http://www.apan.net.
[3] M. Crovella and A. Bestavros. Self-Similarity in World
Wide Web Traffic: Evidence and Possible Causes. In Proceedings of ACM SIGMETRICS, May 1996.
[4] M. Grossglauser and J. C. Bolot. On the relevance of longrange dependence in network traffic. IEEE/ACM Transactions on Networking, pages 629–640, October 1999.
[5] Inter-Ministry
Research
Information
Network.
http://www.imnet.ad.jp.
[6] R. Kawahara, K. Ishibashi, T. Hirano, H. Saito, H. Ohara,
D. Satoh, S. Asano, and J. Matsukata. Traffic measurement

and analysis in an ATM-based internet backbone. Computer
Communications, 24:1508–1524, 2001.
[7] R. Kawahara and N. Komatsu. A scalable IP traffic control
method for weighted bandwidth allocation per flow. IEICE
Trans. Commun., E84-B(10):2815–2829, October 2001.
[8] W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson.
On the self-similar nature of Ethernet traffic. IEEE/ACM
Transactions on Networking, 2(1), Feburary 1994.
[9] D. Lin and R. Morris. Dynamics of Random Early Detection. In ACM SIGCOMM, September 1997.
[10] Measurement and Analysis on the WIDE Internet.
http://www.wide.ad.jp/wg/mawi.
[11] T. Mori. A study on the difference of characteristics of selfsimilar traffic with similar Hurst parameter. In IEICE General Conference, March 2001. (in Japanese).
[12] OC3mon/Coral.
http://www.caida.org/tools/measurement/coralreef.
[13] OPNET. http://www.opnet.com.
[14] K. Papagiannaki, N. Taft, S. Bhattacharyya, P. Thiran,
K. Salamatian, and C. Diot. A pragmatic definition of elephants in internet backbone traffic. In ACM SIGCOMM Internet Measurement Workshop, 2002.
[15] K. Park, G. Kim, and M. Crovella. On the effect of traffic self-similarity on network performance. In Proceedingsof the SPIE International Conference on Performance andControl of Network Systems, November 1997.
[16] K. Park and W. Willinger. Self-similar network traffic andperformance evaluation. Wiley Interscience, 2000.
[17] I. Stoica, S. Shenker, and H. Zhang. Core-stateless fairqueueing: Achieving approximately fair bandwidth allocations in high-speed networks. In ACM SIGCOMM, September 1998.
[18] The
Network
Simulator
ns-2.
http://www.isi.edu/nsnam/ns.
[19] Widely Integrated Distributed Environment project.
http://www.wide.ad.jp.
[20] W. Willinger, M. S. Taqqu, R. Sherman, and D. V. Wilson.
Self-similarity through high-variability: statistical analysisof Ethernet LAN traffic at the source level. IEEE/ACM
Transactions on Networking, 5(1):71–86, 1997.
[21] Y. Zhang, L. Breslau, V. Paxson, and S. Shenker. On thecharacteristics and origins of internet flow rates. In ACM
SIGCOMM, August 2002.