Characterization of Large-Scale SMTP Traffic: the Coexistence of the Poisson Process and Self-Similarity

Network traffic such as Ethernet, Internet, World Wide Web, and TCP/UDP protocols has been extensively studied, with efforts focusing on the Poisson process and self-similarity. However, although SMTP (Simple Mail Transfer Protocol) occupies a significant portion of Internet traffic, it has attracted little attention. This paper shows that large-scale SMTP traffic possesses both the characteristics of the Poisson process and self-similarity through an analysis of high quality SMTP traces collected from one of the largest Web portal sites in South Korea over a period of almost nine months. First, we show that, at small (several-second) time scales, interarrival times of SMTP session arrivals are exponentially distributed and independent of each other, which makes it possible to model SMTP session arrivals as a Poisson process. On the contrary, at large (several-month) time scales, SMTP session arrivals exhibit self-similarity. They are strongly autocorrelated across time scales of days and their Hurst parameters are estimated to be somewhere between 0.85 to 0.97. In addition, we find that SMTP traffic consists of many individual ON/OFF sources whose distributions of OFF-period lengths are heavy-tailed, which confirms self-similarity of SMTP traffic.