Packet Length Distribution in LAN

I this post, I have copy-pasted from internet (ofcourse, citing the author) the packet distribution in internet. I always wanted to do that experiment myself. Last week, finally i could do just that. This is just a first experiment where I have captured all my own packets going into LAN, not purely internet.

Setup was similar to what i have done in my previous post. Replace "LAN cloud" with my PC and "wan cloud" with my office servers and internet. Linux box is a dual NIC-PC which runs FC10. I have configured the "Linux box" as a bridge. I wrote a iptables target module and passed all packets emerging from my PC through the module.

The Target module I wrote, looked and sampled the packet length of all packetes it receives and built a histogram. The histogram was built with the step size of 64bytes. After running it for couple of days, the result looks like below:

Pkt Histogram
==============
Length %of total packets
=========================
[ 0- 63]=18.91%
[ 64- 127]=0.84%
[ 128- 191]=5.76%
[ 192- 255]=0.47%
[ 256- 319]=0.8%
[ 320- 383]=0.05%
[ 384- 447]=0.08%
[ 448- 511]=0.09%
[ 512- 575]=0.13%
[ 576- 639]=0.17%
[ 640- 703]=0.09%
[ 704- 767]=0.06%
[ 768- 831]=0.05%
[ 832- 895]=0.03%
[ 896- 959]=0.03%
[ 960-1023]=0.03%
[1024-1087]=0.04%
[1088-1151]=0.04%
[1152-1215]=0.04%
[1216-1279]=0.2%
[1280-1343]=0.02%
[1344-1407]=0.62%
[1408-1471]=0.03%
[1472-1535]=71.44%
[1536-1599]= 0%
[1600-1663]= 0%
[1664-1727]= 0%
[1728-1791]= 0%
[1792-1855]= 0%
[1856-1919]= 0%
[1920-1983]= 0%
[1984-2047]= 0%

Now, I am tempted to the same exercise on the packet flowing purely into internet from my office. I will do the same and report in coming days. so, keep visiting this page or just subscribe to the RSS feed of my page.

PS:
My Work-PC is also a Linux machine running FC13. The packet captured reflects regular web browsing -http/https, email, and NFS (my home is mounted on nfs) and NIS.

Coming up next: How to write a iptables target module... Stay tuned.