Subject: Re: Average Ethernet packet length

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 25 May 2000 21:08:19 -0400

In message <CC96542306D7D2119E0B080009EB58FE9582FA@MERCURY>, Timothy Behne writ
es:
>
>> Hi,
>> 
>> A recent thread suggested something interesting - an average Ethernet/IP
>> packet length of 500 bytes.  Has there been any work done in the area of
>> finding average packet lengths, bandwidth usage, etc. of typical (read:
>> unknown) networks?  Are there any "rules of thumb" values that are
>> typically used?

There are no good, current studies on LAN behavior that I've seen.  
There have been a number of papers on WAN behavior.  The usual result 
of those is that ~40-50% of packets are about 40-44 bytes, but most of 
the bytes are carried by packets of ~500-576 or 1500 bytes.

		--Steve Bellovin

---

From: Paul Ferguson <[email-masked]>
Date: Thu, 25 May 2000 21:36:42 -0400

Also some good stats at www.caida.org

- paul

---

From: Garrett Wollman <[email-masked]>
Date: Fri, 26 May 2000 00:23:45 -0400 (EDT)

> There are no good, current studies on LAN behavior that I've seen.  

However, many LAN switches can provide this information to a
management process.  With high-speed networks, this may be the only
way to get information on LAN behavior.

For example, incoming packets on one interface of my backbone switch
are distributed like this:

  Bucket	  # packets	%pack	%bytes
---------	-----------	-----	------
   0-64		 4769641806	29%	  2.0%
  65-127	 5256510303	32%	  6.7%
 128-255	  397530898	 2.4%	  1.0%
 255-511	  370987710	 2.3%	  1.9%
 512-1023	 1178964791	 7.2%	 12%
1024-1518	 4506971031	27%	 76%

(The last column assumes that packet sizes are uniformly distributed
within each bucket, which is wrong but close enough for the purposes
of this message.  The first two columns are what I get out of my
switch.  Unfortunately, this switch does not count outgoing packets in
the same way.)

That was on an outside-facing interface.  An inside-facing interface
looks more like this:

   0-64		   18184	 0.0%	 0.0%	(I'm not sure I believe this!)
  65-127	29402735	42%	 6.2%
 128-255	 6402318	 9.2%	 2.6%
 256-511	  848447	 1.2%	 0.7%
 512-1023	 2154682	 3.1%	 3.6%
1024-1518	31014396	44%	87%

(This is a gigabit Ethernet interface with 802.1Q encapsulation, so
the first bin includes only those packets with less than 47 bytes of
Ethernet payload.  These two distributions together suggest that about
a quarter of all packets are between 46 and 50 bytes!)

> the bytes are carried by packets of ~500-576 or 1500 bytes.

With a little bit of adjustment, this seems to be borne out in my LAN
environment as well.  (But we're probably atypical.)

-GAWollman