Flow-concurrence and bandwidth ratio on the Internet

The relevance of flow-based monitoring in tasks such as the detection of anomalies and denial of use attacks, traffic reporting, performance evaluation, software routing among others motivates the study of the Internet traffic in terms of flows. However, by the time a network manager or practitioner start any of these tasks, they face the challenge of planning probes’ capacities, which depends on the number of concurrent flows. Unfortunately, while the bandwidth of a network or link, both in operation and in future deployments, can be known, or at least estimated in advance, nothing is known about the load in terms of concurrent flows. We aimed at filling this gap by studying the concurrence of flows with respect to the bandwidth normalized by factors such as protocol shares, timeouts, applications, time and years among others. As a result, we provide the research community with several models, based on lognormal distributions, and parameter estimates in such a way that any player in the Internet arena can estimate the number of concurrent flows in their own infrastructure. Moreover, such results emerge from a diverse set of network traces so making the extrapolation of conclusions viable.