ISP basics: Insights into traffic statistics
on the Internet subscriber line

This paper describes the actual IP traffic behaviour of individual users needed for planning of the appropriate access network as well as the right business case of an ISP. It comprises information about the usage of access ports, the average speed of access ports as well as information about the IP volume consumption of particular users. High emphasis is put on the differences in the behaviour of modem users and ISDN users providing valuable information for the deployment of wideband Internet access.

Table of Contents

Author Listing

Maximilian Riegel (

Martin Bokämper (


Currently only rough assumptions about the usage patterns of individual Internet users exist. Planing of Internet Service Provider (ISP) business is done on the assumption that in average one dial-in port is needed for every 10 - 20 users and the bandwidth to the backbone has to be 10 - 20% of the sum of bandwidth of all dial-in ports. Application of these planning figures might be sufficient when starting an ISP business in a less competitive environment mainly serving beginning Internet users.

More and more users are getting extensive experience with using the net and many of them are seeking for ISPs offering better quality. Experienced users are not worried about changing the configuration of their PCs to dial into the network of another ISP. This leads to a competitive market for ISPs where rough assumptions about the behaviour of users are not sufficient for successful business planning as well as for the design of the right access network. Special care has to be taken for handling more advanced access techniques like ISDN, xDSL, DI/AO or wireless access systems assuming some kind of multiplexing gain by statistically sharing the same transfer medium between several users. To enable fine grain optimisation of bandwidth usage as well as access port usage a more detailed look into the particular flow of data on the Internet access line is necessary.

While some information about the traffic statistic on Internet backbone lines exists, information about the real behaviour of Internet users is very rare. This paper intends to fill this gap and provide valuable data about the traffic statistics of individual Internet users.

Investigation environment

The paper is based on usage data recorded over a 2 year time frame from 1997 to 1999 of about 350 (begin) - 600 (end) private users with average to extremely high technical skills.

Location and users

The measurements were taken in the area around Nuremberg in Germany by a scientific association founded beginning of 1994 especially for serving the needs of private users of the Internet with special interest in the technology of networking. The non profit association named 'Kommunikationsnetz Franken e.V.' was the pioneer for providing dial in IP access in northern Bavaria to private users. With widespread availability of Internet access in Germany since 1996 the growth of the association slowed down leading to the remarkable condition that the analysed user group reflects mainly skilled users with several years of Internet experience. This anticipates the situation in developed countries in a few years when the number of Internet users reaches its saturation.



Fig. 1: Growth of user group during analysed period

Another remarkable condition of the user group is the high percentage of ISDN users currently approaching 75% which provides valuable indications about the consequences of usage of DSL techniques for Internet access.

The users are paying a monthly flat fee of about US$ 14.0 to the association including unlimited access to the Internet.

Network infrastructure

The association is running an access network for technical evaluation purposes neglecting economical reasons. Thus the network infrastructure did impair the measurements neither by a lack of access ports nor by a lack of bandwidth to the Internet.

Fig. 2: The network infrastructure

Main equipment of the network is a 'Livingston Portmaster 3' access router with 2x PRI and 30 digital modems connected by a 10 Mb/s Ethernet to the backbone of the German B-WiN (Breitband-WissenschaftsNetz) running at 155Mb/s up to 622Mb/s. The number of ports of the access router were totally sufficient over the whole period never leading to a busy tone. The measurements were taken at the Router running Linux connecting the local network to the backbone network. The local network comprises additionally a mail-, a news-, a ftp- and a www-Server. The router also enables local peering with the University of Erlangen.

Having available plenty of bandwidth and plenty of ports in the local network the only impairment might be caused by congestions on the Internet mainly on the always exhausted connections from Germany to the U.S.A.

Recorded information

Over the analysed period every TCP connection and every UDP packet flow of any host address of this ISP was recorded on five minute boundaries. Each record comprises a time stamp, source and destination IP addresses, port numbers, the number of packets and the transferred data volume. Fixed IP address assignment to every user facilitates the distinction of particular users.

Additional the RADIUS logs of the access router were evaluated. Each session produced a record consisting of the particular username, time stamps for start and stop, the number of packets and bytes transferred in and out, respectively, and an indication whether the call originated from ISDN or from a modem.

Utilization of access ports

The following diagrams were drawn from the recorded data. They show what Internet users are really doing, not what they answered to a questionnaire.

Figure 3 shows the usage of the access router during weekdays.

Fig. 3: Number of access lines in use during working-days (Feb. 1998)

The blue line marks the total number of access lines in use while the green area indicates the number of modems in use. This diagram was recorded in February 1998 reflecting nearly equal use of modem and ISDN.

An equivalent diagram recorded in February 1999 shows the significant increase of ISDN users in comparison to modem users. As the increase of the number of ISDN lines in use even exceeds the increase of the total number of users, ISDN users tend to use the Internet more intensive.

Fig. 4: Number of access lines in use during working-days (Feb. 1999)

The steep increase of used lines starting exactly at 21:00 is astonishing nevertheless explainable. This behaviour is caused by the expenses required for local telephone calls in Germany. Starting at 21:00 the hourly rate for local calls diminishes from about US$ 1.60/hour to US$ 1.0/hour leading users to wait for their call after 21:00 especially if they intend to go on the net shortly before.

9:00 -18 :00
18:00 - 21:00
5:00 - 9:00
21:00 -5:00


US$ 2.7/hour

US$ 1.6/hour

US$ 1.0/hour


US$ 1.6/hour

US$ 1.6/hour

US$ 1.0/hour

Table 1: Telephone tariffs for local calls in Germany

On weekends heavy usage starts earlier with a more flatten peak during early evening hours.

Fig. 5: Number of access lines in use during weekends (Sa/So - Feb. 1999)

Total usage of the Internet varies wide among the users. In average every user of the analysed group is now about 20 hours/month online. This reflects nearly a 20% increase of average usage time during the last 12 month. As mentioned before this coincides with a remarkable increase of ISDN usage.

Achieved access speed

An important quality of an Internet access port is the usable bandwidth. In theory an ISDN access port might provide up to 8000 cps but under real conditions normally much less is used in average. The average speed depends not only from the technical condition of the Internet access network but also from the particular application. E. g. web -browsing combines periods of fast data transfers for loading the page followed by idle periods when the user is reading the www-page.

Information is provided about average bandwidth under real conditions and real applications by the following diagrams summarising the measurements during a period of nearly 6 weeks:

Time Period:

1998-12-15 until 1999-01-23

Total Framed Sessions:


ISDN sessions:


Modem sessions:


Sessions < 5 min:


# of users:


Table 2: Evaluating the access speed

The following diagram shows the distribution of average bandwidth. Every session was assigned to a category according to the achieved average speed. Each category covers a range of 400 cps.

Fig. 6: Distribution of average speed of sessions

The diagram clearly shows that most sessions do not reach high speeds. The maximum achievable speed depends on the technology with ISDN delivering up to 8000 cps, and even more if multilink PPP is used. Few modem sessions reach average transfer rates above 4000 cps.

Evaluating the measurements according to the average speed a particular user achieved results in an interesting diagram.

Fig. 7: Distribution of average speed particular users achieved

Clearly marking the difference between modem and ISDN most users achieve an average speed during their session in the range of about 1200 cps for modem and about 2000 cps for ISDN.

Combining the results of figure 6 and figure 7 leads to the perception that most users do many short sessions with lower data transfers and a few long sessions with extensive file transfers.

Data volume consumption

Furthermore the data consumption of users is important to ISPs. It is a direct figure of the cost structure of an ISP. As more data is consumed by users as more bandwidth is necessary from the ISP's network to the Internet. And that is up to now the most cost driving factor of ISP business.

Often the question is asked how much data volume in average a user is consuming. The following figure shows the monthly consumption of IP volume per user in Jan. 97, Jan. 98 and Jan. 99.

Fig. 8: Monthly IP volume per user

The graphs display in an ordered manner the IP consumption of users. The graph for Jan. 97 ends at 350 users, the graph for Jan. 98 ends nearby 500 users whereas the graph for Jan. 99 extends near to 600. The maximum IP volume consumed by a single user exceeds for all three graphs 1000 MB/month. Users with very high IP consumption are using ISDN access. Even users having their private least line to the Internet are less consuming than ISDN users.

But the diagram clearly demonstrates that it is not possible to speak about an average user. Less than 20% of all users are using more than 80% of the total IP volume.

To emphasise this rule, the diagram above was rescaled according to 100% of users. Figure 9 shows the distribution of consumption over percentage of users.

Fig. 9: Normalised distribution of monthly IP volume

It is astonishing that the graphs for Jan. 98 and Jan. 99 are nearly identical in this diagram. The volume distribution stayed. It means that the increase of consumed IP volume is mainly caused by the increase of the number of users.

The graph for Jan. 97 shows nearly half the values of the graphs of Jan. 98 and Jan. 99. This difference results from the very small number of ISDN users in Jan. 97 and reflects the increased IP volume demand of ISDN users.

Impact of IP services

The ISP business does not only consist of providing IP volume to users. There are many other services an ISP has to operate and has to provide to its users, like mail, news, ftp and a www.

The following diagram shows the distribution of IP volume over IP services.

Fig. 10: Monthly IP volume used for particular IP services

Figure 10 demonstrates clearly the high IP volume some services are requiring and provides an impact on the continuing increase of IP volume, but due to the linear scale only the most expensive services are visible. To get a more detailed view the same diagram is given with a logarithmic scale.

Fig. 11: Monthly IP volume over IP services

Providing IP services causes an additional load on the network of an ISP eventually being several times larger than the load directly generated by the users. The diagram also shows the continuing increase of IP volume needed for IP services like news, ftp and www and upcoming new applications like ssh.


The paper presented the main figures for providing Internet access to private users comprising information about the temporal utilization of dial in ports, the average transfer speed for sessions as well as particular users and the distribution of IP consumption over users denying every idea of an average user.

It showed the high increase of IP volume required by users with more capable access lines like ISDN. More bandwidth requirements can be expected with latest technologies like xDSL. Especially the combination of high bandwidth Internet access with hourly rates might lead to unreasonable conditions for network operators. The usage pattern in Germany during evening hours shows that most users are liking to concentrate their Internet usage to periods with lowest telephone tariffs leading to high peaks during these hours. This burdens additional cost for more access ports and more bandwidth to the Internet not used during the rest of the day.

An interesting result of this paper might be the figures of average used bandwidth of access ports. These values reflect the situation when usage is not impaired by lack of bandwidth to the Internet. It is quite common that ISPs design their networks with figures half the size than given by this paper.