[Snort-users] traffic percentage

Fraser Hugh hugh_fraser at ...2804...
Tue Oct 2 08:39:04 EDT 2001

It's difficult to find a single answer. There are several sites that do
internet "health" statistics measuring performance (ie. packet latency,
etc.) rather than protocol distribution, probably because the distribution
depends so much upon where and when you take a sample, and how long the
sample period is. For us, the overall volume to our Internet router is
mostly email, but over shorter sample periods HTTP traffic will saturate the

It also depends on what you need to know the answer for. Judging by the
estimates I've seen for the explosion of the web and e-commerce, I'd expect
(without any basis in fact) that http/https traffic accounts for the bulk of
the Internet traffic. Of course, that's of no use to me if I'm configuring a
traffic-shaping router to improve my use of our Internet connection if I use
it predominantly for email. And if we suddenly start doing voice-over-ip or
video conferencing, all the numbers once again go out the window.

I expect (because you're posting this to an IDS-related discussion list)
that you want to establish a baseline to identify changes in traffic
patterns, perhaps to identify DOS attacks. I've done the same, watching
protocol and overall throughput, but it's based upon our usage patterns, not
general Internet averages. 

-----Original Message-----
From: Ashley Thomas [mailto:athomas at ...3539...]
Sent: Monday, October 01, 2001 5:28 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] traffic percentage

hi all,

In general, if we take a sample of traffic on the Internet, how much
percentage will be occupied by
other tcp

(what are the other big categories)

Any pointers is welcome.


Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list