These traces each contain an hour's worth of all wide-area traffic between the Lawrence Berkeley Laboratory and the rest of the world.
The traces were reduced from tcpdump format to ASCII using the sanitize scripts. They include five files: lbl-pkt-n.tcp (TCP packets), lbl-pkt-n.sf (TCP SYN/FIN/RST packets), lbl-pkt-n.udp (UDP packets), lbl-pkt-n.encap (encapsulated IP - MBone), and lbl-pkt-n.other (whatever else was in the trace).
The trace lbl-pkt-4 ran from 14:00 to 15:00 on Friday, January 21, 1994, and lbl-pkt-5 ran from 14:00 to 15:00 on Friday, January 28, 1994 (times are Pacific Standard Time). Each captured 1.3 million TCP packets, the first dropping about 0.0007 of the total, the second about 0.0005. The tracing was done on the Ethernet DMZ network over which flows all traffic into or out of the Lawrence Berkeley Laboratory, located in Berkeley, California. The raw traces were made using tcpdump on a Sun Sparcstation using the BPF kernel packet filter. Timestamps have microsecond precision.
The traces have been "sanitized" using the sanitize scripts. This means that the host IP addresses have been renumbered, and all packet contents removed.
The traces were made by Vern Paxson ( In publications, please include an appropriate citation to the first paper mentioned below.
The traces correspond to LBL-PKT-4 and LBL-PKT-5 in Wide-Area Traffic: The Failure of Poisson Modeling, V. Paxson and S. Floyd, IEEE/ACM Transactions on Networking, 3(3), pp. 226-244, June 1995. LBL-PKT-4 is also briefly studied in Fast Approximation of Self-Similar Network Traffic, V. Paxson, technical report LBL-36750/UC-405, April 1995.
Related traces
The traces may be freely redistributed.
Available from the Archive as lbl-pkt-4, compressed tar format (10 MB; 33 MB uncompressed), and lbl-pkt-5 (9 MB; 30 MB uncompressed).

Up to Traces In The Internet Traffic Archive.