These four traces each contain a million packet arrivals seen on an Ethernet
at the Bellcore Morristown Research and Engineering facility.
Two of the traces are LAN traffic (with a small portion of transit WAN
traffic), and two are WAN traffic.
The traces are in 2-column ASCII format, twenty bytes per line (including
the newline). The first column gives the
time in seconds since the start of the trace. The second column
gives the Ethernet data length in bytes, not including
the Ethernet preamble, header, or CRC, though note that the Ethernet
protocol forces all packets to have at least a minimum size of 64 bytes
and at most the maximum size of 1518 bytes.
The trace BC-pAug89 began at 11:25 on August 29, 1989, and
ran for about 3142.82 seconds (until 1,000,000 packets had been captured).
The trace BC-pOct89 began at 11:00 on October 5, 1989, and ran
for about 1759.62 seconds. These two traces captured all Ethernet packets.
The trace BC-Oct89Ext began at 23:46 on October 3, 1989, and
captured the first 1 million external arrivals (packets headed between
Bellcore and the rest of the Internet), ending about 122797.83
seconds later. The trace BC-Oct89Ext4 comes from the 4th tape
of a 307-hour trace begun at 14:37 on October 10, 1989. The tape
started at timestamp 774018.987692, about 215 hours into the trace,
and BC-Oct89Ext4 ends about 75943.08 seconds later.
All times are Eastern Daylight Time. The measurement hardware did not
drop any packets, but corrupted packets (e.g., Ethernet collisions)
are not included in the traces.
99.5% of the encapsulated packets were IP (Internet Protocol).
The tracing was done at the Bellcore Morristown Research and Engineering
facility, on the computing lab's Ethernet, which carried primarily
local traffic, but also all traffic between Bellcore and the Internet.
While timestamps are reported to 6 decimal places, they have 4-microsecond
precision, and further analysis indicates that the actual accuracy
is about 10 microseconds (primarily due to bus contention).
Here is a more detailed README (which
refers to slightly different trace filenames).
The traces contain no packet contents and no host or protocol information.
The traces were made by Will Leland (email@example.com)
and Dan Wilson (firstname.lastname@example.org).
please include appropriate citations to the papers mentioned below.
The measurement techniques used in making the traces are described in
High time-resolution measurement and analysis of LAN traffic:
Implications for LAN interconnection,
W. E. Leland and D. V. Wilson,
Proc. IEEE INFOCOM '91, April 1991, pp. 1360-1366 (the Postscript for
this paper has a
These traces are a subset of those analyzed in
Local Area Network
Traffic Characteristics, with Implications for Broadband Network
H. J. Fowler and W. E. Leland,
IEEE JSAC, 9(7), September 1991, pp. 1139-1149,
and in On the Self-Similar Nature of Ethernet Traffic
(Extended Version), W. Leland, M. Taqqu, W. Willinger, and D. Wilson,
IEEE/ACM Transactions on Networking, 2(1), February 1994, pp. 1-15. The
shorter, SIGCOMM '93 version of this last paper is available on-line.
The traces may be freely redistributed.
Available from the Archive as
BC-pAug89, compressed ASCII format (5 MB; 20 MB uncompressed);
BC-pOct89, (5 MB; 20 MB uncompressed);
BC-Oct89Ext, (6 MB; 20 MB uncompressed); and
BC-Oct89Ext4 (6 MB; 20 MB uncompressed).
Traces In The Internet Traffic Archive.