Network traffic analysis is the study of the flow of packets across a network. One observable is the patcket rate process, the number of packets arriving per unit time at a sensor or collection point. The packet rate process determined by the arrival of network packets at a perimeter choke-point of a protected enclave is the result a number of different and even conflicting effects.

The objective of this work is to characterize the state of network traffic at the individual user and aggregate levels, and from this characterization to develop tools that can be used to ascertain the state and health of the network. The fact that the observed traffic is multiplexed from many computers and local area networks indicates an additive model is appropriate; the design of the predominant network service, web, indicates a multiplicative model.

In this talk two different models of the packet rate process will be described and the results of their application to real network traffic analyzed.