This trace contains two hours' worth of all wide-area TCP traffic between
the Lawrence Berkeley Laboratory and the rest of the world.
The trace was reduced from
format to ASCII using the
sanitize-syn-fin scripts. The first script
was used to produce lbl-tcp-3.tcp, which has six columns:
timestamp, (renumbered) source host, (renumbered) destination host,
source TCP port, destination TCP port, and number of data bytes (zero
for "pure-ack" packets). The second script generated lbl-tcp-3.sf,
which includes the same first five columns, plus TCP flags (SYN/FIN/RST/PSH
etc.), sequence number, and acknowledgement number (0 for initial SYN).
The trace ran from 14:10 to 16:10 on Thursday, January 20, 1994 (times
are Pacific Standard Time), capturing 1.8 million TCP packets (about 0.0002
of these were dropped). The tracing was done on the Ethernet DMZ network over
which flows all traffic into or out of the Lawrence Berkeley Laboratory,
located in Berkeley, California.
The raw trace was made using
on a Sun Sparcstation using the
kernel packet filter. Timestamps have microsecond precision.
The trace has been "sanitized" using the
sanitize-tcp script. This means that
the host IP addresses have been renumbered, and all packet contents
The trace was made by Vern Paxson (firstname.lastname@example.org). In publications,
please include an appropriate citation to the paper mentioned below.
This trace corresponds to LBL-PKT-3 in the paper
The Failure of Poisson Modeling, V. Paxson and S. Floyd,
IEEE/ACM Transactions on Networking, 3(3), pp. 226-244, June 1995.
The trace may be freely redistributed.
Available from the Archive in
compressed tar format (16 MB; 55 MB uncompressed).
Traces In The Internet Traffic Archive.