LBL-CONN-7 Network Traces
Vern Paxson

@article{,
title = {LBL-CONN-7 Network Traces},
doi= {10.1109/90.330413},
journal = {},
author = {Vern Paxson},
year = {1993},
url = {http://ita.ee.lbl.gov/html/contrib/LBL-CONN-7.html},
abstract = {Description
This trace contains thirty days' worth of all wide-area TCP connections between the Lawrence Berkeley Laboratory (LBL) and the rest of the world.

Format
The reduced trace was generated by tcp-reduce, and has the format explained in that script's documentation . Briefly, the trace is an ASCII file with one line per connection, with the following columns:
timestamp
duration
protocol
bytes sent by originator of the connection, or ? if not available
bytes sent by responder to the connection, or ? if not available
local host - the (renumbered) LBL host that participated in the connection
remote host - the remote (non-LBL) host that participated in the connection. Remote hosts have not been renumbered, to allow for geographic analysis of the data. Please do not attempt any further traffic analysis regarding the remote hosts.
state that the connection ended in. The two most important states are SF, indicating normal SYN/FIN completion, and REJ, indicating a rejected connection (initial SYN elicited a RST in reply). Other states are discussed in the tcp_reduce documentation .
flags zero or more flags:
L indicates the connection was initiated locally (i.e., the LBL host is the one that began the connection)
N indicates the connection was with nearby U.C. Berkeley. When this dataset was captured, a filter was used so that only nntp traffic with UCB was included, so this flag is only ever set for nntp connections.

Measurement
The trace ran from midnight, Thursday, September 16 1993 through midnight, Friday, October 15 1993 (times are Pacific Standard Time), capturing 606,497 wide-area connections. The tracing was done on the Ethernet DMZ network over which flows all traffic into or out of the Lawrence Berkeley Laboratory, located in Berkeley, California. The raw trace was made using tcpdump on a Sun Sparcstation using the BPF kernel packet filter. Fewer than 15 SYN/FIN/RST packets in a million were dropped. Timestamps have microsecond precision. As noted above, the traffic was filtered to exclude connections with nearby UCB except for nntp.
Privacy

The LBL hosts in the trace have been renumbered. The remote hosts remain as full IP addresses, to allow for geographic analysis of the data. Please do not attempt any further traffic analysis regarding the remote hosts.

Acknowledgements
The trace was made by Vern Paxson (vern@ee.lbl.gov). In publications, please include one or more citations to the papers mentioned below, as appropriate.

Publications
The SF connections in this trace correspond to LBL-7 in the papers Empirically-Derived Analytic Models of Wide-Area TCP Connections, V. Paxson, IEEE/ACM Transactions on Networking, 2(4), pp. 316-336, August 1994; Growth Trends in Wide-Area TCP Connections, V. Paxson, IEEE Network, 8(4), pp. 8-17, July 1994; and Wide-Area Traffic: The Failure of Poisson Modeling, V. Paxson and S. Floyd, IEEE/ACM Transactions on Networking, 3(3), pp. 226-244, June 1995.

Restrictions
The trace may be freely redistributed.

**Reference:** Paxson, Empirically derived analytic models of wide-area TCP connections. 1994. https://doi.org/10.1109/90.330413}
}