Analysis of UDP Traffic Usage on Internet Backbone Links

We compared UDP and TCP traffic in several traffic traces collected from different networks and geographical locations, at different times. We find that TCP still dominates in terms of packets and bytes, but UDP is now often responsible for the largest fraction of flows on a given link. A port-based analysis suggests that the recent increase in UDP flows on the traces analyzed stems mainly from P2P applications using UDP for their overlay signaling traffic. This trend may again change with the advent of IPTV and UDP based P2P applications, which not only signal, but also transport large data segments via UDP. We will continue to monitor available data to track trends in UDP usage, and specifically seek data from China where UDP-based IPTV traffic is already common. Finally, we note that precise traffic classification requires methods beyond simple port classification. Most current traffic classification techniques focus on TCP, with only preliminary examination of techniques for UDP traffic (other than deep packet inspection). Given the growing evidence for the use of UDP for increasingly popular applications, including for bulk data transfer in China, we conclude that traffic analysis methods must evolve to classify also UDP traffic.