Due to the rapid development of telecommunication technologies, the capacity of the networks is increasing quickly that makes possible to transfer more and more volume of data. At the same time, the number of devices connected to the Internet gets higher day by day, and in many instances the network infrastructure cannot completely satisfy the continuously increasing demands.
One of the key components of today’s Internet is the congestion control, which is implemented in TCP (Transmission Control Protocol). In the last decades, numerous versions of this protocol have been worked out to realize efficient congestion control in high-speed networks and lossy environments as well. Unfortunately, none of these approaches were entirely successful, and the researchers have shown that there is a need for a new paradigm. The Internet of the future requires inventing new network devices and solutions, which need careful design, but it is not possible to carry out without the deep knowledge of the traffic behavior. In addition, traffic analysis can also be used for many other purposes such as detecting distributed attacks, analyzing user activities and traffic-based accounting services.
This thesis deals with the processing and analysis of traces originated from an ISP (Internet Service Provider). First of all, the literature background and the architecture of the network are reviewed, and then the results of the flow-level analysis are presented. The distribution functions and histograms of the flows as well as the relation between the most important traffic parameters are examined. In the following section flows are separated into groups based on three different dimensions (size, duration and rate). The characteristics of these categories and the connection between them are revealed. The features of the traffic generated by the applications and their impact on the aggregated traffic are also investigated. The results are given for both the whole measurement period and busy hours, moreover, the most significant differences are highlighted. In the next part two fundamental properties of the network traffic, namely burstiness and correlation are studied. A brief description of the stationarity problem is given and an analysis on a packet-level trace is performed. The intensity, density and distribution functions are depicted and analyzed, additionally, the correlations of inter-arrivals and counts as well as the indices of dispersion for intervals and counts are examined. In the last section a comparative and multi-level analysis study of three popular applications (BitTorrent, YouTube and Facebook) is carried out, and the main differences between their traffic characteristics are discussed. Finally, the main results of the thesis are summarized and conclusions are drawn.