Even with a solid set of operational statistics there are times when one wants dedicated collection to gain greater insight into short-term dynamics of workloads. For example, there are limitations of the operationally collected statistics for the NSFNET for describing flows in terms of their impact on an aggregate Internet workload . We have developed tools for supporting operational flow assessment, to gain insight into both individual traffic signatures as well as heavy aggregations of end users. We have tested our methodology using packet header traces from a variety of Internet locations, yielding insight far beyond a simple aggregated utilization assessments, into details of the composition of traffic aggregation, e.g., what components of the traffic dominate in terms of flow frequency, durations, or volumes. We have shown that shifts in traffic signatures as a result of evolving technologies, e.g., toward multimedia applications, will require a different approach in network architectures and operational procedures. In particular, the much higher demands of some of these new applications will interfere with the ability of the network to aggregate the thousands of simultaneous but relatively short and low volume flows that we observe in current environments.
The methodology  defines a flow based on actual traffic activity from, to, or between entities, rather than using the explicit setup and teardown mechanisms of transport protocols such as TCP. Our flow metrics fall into two categories: metrics of individual flows and metrics of the aggregate traffic flow. Metrics of individual flows include: flow type, packet and byte volume, and duration. Metrics of the aggregate flow, or workload characteristics seen from the network perspective, include: counts of the number of active, new, and timed out flows per time interval; flow interarrival and arrival processes; and flow locality metrics. Understanding how individual flows and the aggregate flow profile influence each other, is essential to securing Internet stability, and requires ongoing flow assessment to track changes in Internet workload in a given environment.
Because it requires comprehensive and detailed statistics collection, we recognize that the NAPs and other service providers may not be able to afford to continuously monitor flow characteristics on an operational basis. Nonetheless we imagine that NAP operators will find it useful to undertake traffic flow assessment at least periodically to obtain a more accurate picture of the workload their infrastructure must support. The methodology and tools that implement it will be increasingly applicable, even on a continuous basis, for NAP tasks such as ATM circuit management, usage-based accounting, routing table management, benchmarks by which to shop for equipment from vendors, and load balancing in future Internet components.
The methodology can form a complementary component to other existing operational statistics collection, yielding insights into larger issues of Internet evolution, i.e., how environments of different aggregation can cope with resource contention by an ever-changing composition and volume of flows. Internet traffic cross-section and flow characteristics are a moving target, and we intend that our methodology serve as a tool for those who wish to track and keep pace with its trajectory. For example, as video and audio flows, and even single streams combining voice and audio, become more popular, Internet service providers will need to parametrize them to determine how many such end user streams they will be able to support, and how many more resources each new such stream would require. Multicast flows will also likely constitute a increasingly significant component of Internet traffic, and applying our methodology to multicast flows would be an important step toward coping with their impact on the infrastructure.