A measurement study of correlations of Internet flow characteristics

Previous studies of Internet traffic have shown that a very small percentage of flows consume most of the network bandwidth. It is important to understand the characteristics of such flows for traffic monitoring and modeling purposes. Several prior researchers have characterized such flows using different classification schemes: by size as elephant and mice; by duration as tortoise and dragonfly; and by burstiness as alpha and beta traffic. However, it is not clear how these different definitions of flows are related to each other. In this work, using data recorded from two different operational networks, we study these "heavy-hitter" flows in four different dimensions, namely size, duration, rate and burstiness, and examine how they are correlated. This paper makes three contributions: first, we systematically characterize prior definitions for the properties of such heavy-hitter traffic. Second, based on our datasets, we observe that there are strong correlations between some combinations of size, rate and burstiness. Finally, we provide a plausible explanation for the observed correlations. We show that these correlations could be explained by transport and application-level protocol mechanisms.