LBL-TCP-3

Description

This trace contains two hours' worth of all wide-area TCP traffic between the Lawrence Berkeley Laboratory and the rest of the world.

Format

The trace was reduced from tcpdump format to ASCII using the sanitize-tcp and sanitize-syn-fin scripts. The first script was used to produce lbl-tcp-3.tcp, which has six columns: timestamp, (renumbered) source host, (renumbered) destination host, source TCP port, destination TCP port, and number of data bytes (zero for "pure-ack" packets). The second script generated lbl-tcp-3.sf, which includes the same first five columns, plus TCP flags (SYN/FIN/RST/PSH etc.), sequence number, and acknowledgement number (0 for initial SYN).

Measurement

The trace ran from 14:10 to 16:10 on Thursday, January 20, 1994 (times are Pacific Standard Time), capturing 1.8 million TCP packets (about 0.0002 of these were dropped). The tracing was done on the Ethernet DMZ network over which flows all traffic into or out of the Lawrence Berkeley Laboratory, located in Berkeley, California. The raw trace was made using tcpdump on a Sun Sparcstation using the BPF kernel packet filter. Timestamps have microsecond precision.

Privacy

The trace has been "sanitized" using the sanitize-tcp script. This means that the host IP addresses have been renumbered, and all packet contents removed.

Acknowledgements

The trace was made by Vern Paxson (vern@ee.lbl.gov). In publications, please include an appropriate citation to the paper mentioned below.

Publications

This trace corresponds to LBL-PKT-3 in the paper Wide-Area Traffic: The Failure of Poisson Modeling, V. Paxson and S. Floyd, IEEE/ACM Transactions on Networking, 3(3), pp. 226-244, June 1995.

Related traces

LBL-PKT .

Restrictions

The trace may be freely redistributed.

Distribution

Available from the Archive in compressed tar format (16 MB; 55 MB uncompressed).