ietf
[Top] [All Lists]

Re: Average Ethernet packet length

2000-05-25 21:30:03
<<On Thu, 25 May 2000 21:08:19 -0400, "Steven M. Bellovin" 
<smb(_at_)research(_dot_)att(_dot_)com> said:

There are no good, current studies on LAN behavior that I've seen.  

However, many LAN switches can provide this information to a
management process.  With high-speed networks, this may be the only
way to get information on LAN behavior.

For example, incoming packets on one interface of my backbone switch
are distributed like this:

  Bucket          # packets     %pack   %bytes
---------       -----------     -----   ------
   0-64          4769641806     29%       2.0%
  65-127         5256510303     32%       6.7%
 128-255          397530898      2.4%     1.0%
 255-511          370987710      2.3%     1.9%
 512-1023        1178964791      7.2%    12%
1024-1518        4506971031     27%      76%

(The last column assumes that packet sizes are uniformly distributed
within each bucket, which is wrong but close enough for the purposes
of this message.  The first two columns are what I get out of my
switch.  Unfortunately, this switch does not count outgoing packets in
the same way.)

That was on an outside-facing interface.  An inside-facing interface
looks more like this:

   0-64            18184         0.0%    0.0%   (I'm not sure I believe this!)
  65-127        29402735        42%      6.2%
 128-255         6402318         9.2%    2.6%
 256-511          848447         1.2%    0.7%
 512-1023        2154682         3.1%    3.6%
1024-1518       31014396        44%     87%

(This is a gigabit Ethernet interface with 802.1Q encapsulation, so
the first bin includes only those packets with less than 47 bytes of
Ethernet payload.  These two distributions together suggest that about
a quarter of all packets are between 46 and 50 bytes!)

There have been a number of papers on WAN behavior.  The usual result 
of those is that ~40-50% of packets are about 40-44 bytes, but most of 
the bytes are carried by packets of ~500-576 or 1500 bytes.

With a little bit of adjustment, this seems to be borne out in my LAN
environment as well.  (But we're probably atypical.)

-GAWollman



<Prev in Thread] Current Thread [Next in Thread>