BC

Description
These four traces each contain a million packet arrivals seen on an Ethernet at the Bellcore Morristown Research and Engineering facility. Two of the traces are LAN traffic (with a small portion of transit WAN traffic), and two are WAN traffic.
Format
The traces are in 2-column ASCII format, twenty bytes per line (including the newline). The first column gives the time in seconds since the start of the trace. The second column gives the Ethernet data length in bytes, not including the Ethernet preamble, header, or CRC, though note that the Ethernet protocol forces all packets to have at least a minimum size of 64 bytes and at most the maximum size of 1518 bytes.
Measurement
The trace BC-pAug89 began at 11:25 on August 29, 1989, and ran for about 3142.82 seconds (until 1,000,000 packets had been captured). The trace BC-pOct89 began at 11:00 on October 5, 1989, and ran for about 1759.62 seconds. These two traces captured all Ethernet packets.

The trace BC-Oct89Ext began at 23:46 on October 3, 1989, and captured the first 1 million external arrivals (packets headed between Bellcore and the rest of the Internet), ending about 122797.83 seconds later. The trace BC-Oct89Ext4 comes from the 4th tape of a 307-hour trace begun at 14:37 on October 10, 1989. The tape started at timestamp 774018.987692, about 215 hours into the trace, and BC-Oct89Ext4 ends about 75943.08 seconds later.

All times are Eastern Daylight Time. The measurement hardware did not drop any packets, but corrupted packets (e.g., Ethernet collisions) are not included in the traces. 99.5% of the encapsulated packets were IP (Internet Protocol). The tracing was done at the Bellcore Morristown Research and Engineering facility, on the computing lab's Ethernet, which carried primarily local traffic, but also all traffic between Bellcore and the Internet. While timestamps are reported to 6 decimal places, they have 4-microsecond precision, and further analysis indicates that the actual accuracy is about 10 microseconds (primarily due to bus contention).

Here is a more detailed README (which refers to slightly different trace filenames).
Privacy
The traces contain no packet contents and no host or protocol information.
Acknowledgements
The traces were made by Will Leland (wel@bellcore.com) and Dan Wilson (dvw@bellcore.com). In publications, please include appropriate citations to the papers mentioned below.
Publications
The measurement techniques used in making the traces are described in High time-resolution measurement and analysis of LAN traffic: Implications for LAN interconnection, W. E. Leland and D. V. Wilson, Proc. IEEE INFOCOM '91, April 1991, pp. 1360-1366 (the Postscript for this paper has a missing figure).

These traces are a subset of those analyzed in Local Area Network Traffic Characteristics, with Implications for Broadband Network Congestion Management, H. J. Fowler and W. E. Leland, IEEE JSAC, 9(7), September 1991, pp. 1139-1149, and in On the Self-Similar Nature of Ethernet Traffic (Extended Version), W. Leland, M. Taqqu, W. Willinger, and D. Wilson, IEEE/ACM Transactions on Networking, 2(1), February 1994, pp. 1-15. The shorter, SIGCOMM '93 version of this last paper is available on-line.
Restrictions
The traces may be freely redistributed.
Distribution
Available from the Archive as BC-pAug89, compressed ASCII format (5 MB; 20 MB uncompressed); BC-pOct89, (5 MB; 20 MB uncompressed); BC-Oct89Ext, (6 MB; 20 MB uncompressed); and BC-Oct89Ext4 (6 MB; 20 MB uncompressed).


Up to Traces In The Internet Traffic Archive.