A company that I am affiliated with is considering developing a
network product which provides various services for enterprise network
traffic.  The effectiveness of this product and therefore its success
in the market is largely dependent on the characteristics of the
network traffic and the applications which it will be designed to work
with.

Since this product is targeted at medium to large enterprise IP
networks, I require information about the typical mix of IP network
traffic within a medium to large enterprise IP network.  I am NOT
interested in information about Internet destined traffic or Internet
backbone traffic.  Certainly a portion of enterprise traffic will be
destined for the Internet and that traffic should not be ignored, but
traffic which is only with in the enterprise must be considered as
well.  I'm also NOT interested in non Internet Protocol based traffic.

Some examples of metrics that I'm looking for:

- Distribution of IP traffic by specific application type
  (ie.  HTTP, LANMAN/CIFS, NFS, etc.)

- Distribution of IP traffic characteristics
  (ie. small packets vs. large packets, short lifetime of traffic
flows, vs. long life time, transactional vs. data movement)

- Distribution of IP traffic based upon application characteristics
  (ie. transactional - stock quotes; data movement - storage area
networks)

The most important metric would be information about the distribution
of layer 7 (application) protocols as a percentage of overall
enterprise IP network traffic.

Note that I've spent considerable time looking on caida.org,
internet.com and similar sites.  I've found information about traffic
on the Internet but not intra-enterprise traffic.

Feel free to post comments seeking clarification.

Thanks

Gee, I wish I could answer this for you!

I would point out that a good way to do this would be to find a large
enterprise who's implemented NetFlow or sflow on their network and
look at an average of the data.  I think what you'll find is that this
number varies widely depending on type of business.  Traffic on large
enterprise networks is largely either HTTP, CIFS/NetBxxx, or legacy
Telnet, 3270, or SSH sessions.  Very few alternative protocols are
seen.

Maybe check out Network Physics?  They have some good mechanisms for
this type of data collection.

This is a very interesting question, but I suspect that the data for
this will be hard to pin down exactly.  In part, this is because any
given company may have different demands on their network.  And in
part, it's because the way companies use networks is evolving rapidly.

What if they're using a VOIP system or have internal H.323
videoconferencing?  Both would generate huge amounts of short-lifetime
packet data which would dwarf your HTTP traffic data.  You might be
better off deciding more specifically what kinds of companies you're
targeting and then, as arimathea suggests above, visiting onsite to
collect data and/or plunking a LAN analyzer on their network.