Subject: [BEHAVE] Actual data on UDP with/without checksum with/without fragmentation

From: Brian E Carpenter <[email-masked]>
Date: Tue, 15 Sep 2009 13:54:09 +1200

Hi,

A few weeks ago people were asking how much UDP/IPv4 traffic there
really is with or without checksums and with or without fragmentation.

Here are some actual data, kindly analysed by my colleague Dongjin Lee.
(He's in CC, but is not subscribed to the list.)

The first URL below is just the plots. The second one is a mini-report. We
may decide to beef up the report later.

The data are for a variety of network traces in a variety of years.
Dongjin has a disk full of traces that he used for his recently
completed Ph.D. The plots show cumulative distribution functions of
UDP/IPv4 bytes and packets vs port numbers for four cases:

CS=F, MF=F no checksum, not a fragment
CS=F, MF=T no checksum, fragment
CS=T, MF=F checksum, not a fragment
CS=T, MF=T checksum, fragment

You'll see an interesting variability - mainly CS=T, MF=F is above 97%,
but in a couple of traces CS=F, MF=F is above 99%.

CS=F, MF=T is the tricky one for a NAT64, I think. The highest value for
that is 0.20% of packets, on our campus in 2003. Typically, it's zero.

http://www.cs.auckland.ac.nz/~brian/UDP-CSMF-All-plots.pdf
http://www.cs.auckland.ac.nz/~brian/UDP-CSMF.pdf

    Brian