This trace contains thirty days' worth of all wide-area TCP connections between
the Lawrence Berkeley Laboratory (LBL) and the rest of the world.
The reduced trace was generated by
tcp-reduce, and has the
format explained in
that script's documentation .
Briefly, the trace is an ASCII file with one line per connection, with the
- bytes sent by originator of the connection, or ? if
- bytes sent by responder to the connection, or ? if
- local host - the (renumbered) LBL host that participated in
- remote host - the remote (non-LBL) host that participated in
the connection. Remote hosts have not been renumbered, to allow for
geographic analysis of the data. Please do not attempt any further
traffic analysis regarding the remote hosts.
- state that the connection ended in. The two most important
states are SF, indicating normal SYN/FIN completion, and
REJ, indicating a rejected connection (initial SYN elicited a
RST in reply). Other states are discussed in the
tcp_reduce documentation .
- flags zero or more flags:
- L indicates the connection was initiated locally (i.e.,
the LBL host is the one that began the connection)
- N indicates the connection was with nearby U.C. Berkeley. When
this dataset was captured, a filter was used so that only nntp
traffic with UCB was included, so this flag is only ever set for nntp
The trace ran from midnight, Thursday, September 16 1993 through midnight,
Friday, October 15 1993 (times are Pacific Standard Time), capturing 606,497
wide-area connections. The tracing was done on the Ethernet DMZ network over
which flows all traffic into or out of the Lawrence Berkeley Laboratory,
located in Berkeley, California.
The raw trace was made using
on a Sun Sparcstation using the
kernel packet filter. Fewer than 15 SYN/FIN/RST packets in a million
were dropped. Timestamps have microsecond precision. As noted above,
the traffic was filtered to exclude connections with nearby UCB except
The LBL hosts in the trace have been renumbered. The remote hosts remain
as full IP addresses, to allow for geographic analysis of the data.
Please do not attempt any further traffic analysis regarding the remote hosts.
The trace was made by Vern Paxson (firstname.lastname@example.org). In publications,
please include one or more citations to the papers mentioned below, as
The SF connections in this trace
correspond to LBL-7 in the papers
Empirically-Derived Analytic Models of Wide-Area TCP Connections,
IEEE/ACM Transactions on Networking, 2(4), pp. 316-336, August 1994;
Growth Trends in Wide-Area TCP Connections, V. Paxson,
IEEE Network, 8(4), pp. 8-17, July 1994; and
The Failure of Poisson Modeling, V. Paxson and S. Floyd,
IEEE/ACM Transactions on Networking, 3(3), pp. 226-244, June 1995.
The trace may be freely redistributed.
Available from the Archive in
tar format (16 MB; 45 MB uncompressed).
Traces In The Internet Traffic Archive.