IEEE TRANSACTIONS ON MULTIMEDIA, VOL. 11, NO. 1, JANUARY 2009 117 Detailed Analysis of Skype Traffic Dario Bonfiglio, Marco Mellia, Michela Meo, and Dario Rossi Abstract—Skype is beyond any doubt the VoIP application in the current Internet application spectrum. Its amazing success has drawn the attention of telecom operators and the research commu- nity, both interested in knowing its internal mechanisms, charac- terizing its traffic, understanding its users’ behavior. In this paper, we investigate the characteristics of traffic streams generated by voice and video communications, and the signaling traffic generated by Skype. Our approach is twofold, as we make use of both active and passive measurement techniques to gather a deep understanding on the traffic Skype generates. From extensive testbed experiments, we devise a source model which takes into ac- count: i) the service type, i.e., SkypeOut calls or calls between two Skype clients, ii) the selected source Codec, iii) the adopted trans- port layer protocol, and iv) network conditions. Leveraging on the use of an accurate Skype classification engine that we recently pro- posed, we study and characterize Skype traffic based on extensive passive measurements collected from our campus LAN. I. INTRODUCTION T HE last few years witnessed VoIP telephony gaining a tremendous popularity, as testified by the increasing number of operators that are offering VoIP-based phone ser- vices. Skype [1] is beyond doubt the most amazing example of this new phenomenon: developed in 2002 by the creators of KaZaa, it recently reached over 170 millions of users, and accounts for more than 4.4% of total VoIP traffic [2]. Being the most popular and successful VoIP application, Skype is attracting the attention of the research community [3]–[10], and of the telecom operator as well. Many interesting questions related to its internal mechanisms, the traffic it gen- erates and the users’ behavior remain, to date, unanswered. The complexity stems from the fact that Skype protocols are proprietary, and that an extensive use of cryptography, obfus- cation and anti reverse-engineering techniques [4] are adopted by Skype creators. Finally, Skype implements a number of techniques to circumvent NAT and firewall limitations [5], which add further complexity to an already blurred picture. In previous work, we devised a methodology that success- fully tackles the problem of Skype voice traffic identification [3]. We extend here the methodology to identify also video-calls and voice calls generated by the newly deployed SVOPC Codec. Moreover, via a wider set of active and passive measurements Manuscript received May 20, 2008; revised September 26, 2008. First pub- lished December 16, 2009; current version published January 09, 2009. This work was supported by the Italian Ministry of University, Education and Re- search (MIUR) under the PRIN RECIPE, and partly by a research contract with Vodafone Italia. The associate editor coordinating the reviwew of this manus- cipt and approving it for publication was Prof. Jiangchun Liu. D. Bonfiglio, M. Mellia, and M. Meo are with the Dipartimento di Elettronica, Politecnico di Torino, Torino, Italy (e-mail: dario.bonfiglio@gmail.com; dario. bonfiglio@polito.it; marco.mellia@polito.it; michela.meo@polito.it). D. Rossi is with the TELECOM ParisTech-INFRES, Paris, France (e-mail: dario.rossi@enst.fr). Digital Object Identifier 10.1109/TMM.2008.2008927 we investigate Skype users’ behavior and some internal mech- anisms. A preliminary version of this paper appeared in [6]. In this version we complete the characterization of Skype voice Codecs, and add several details to both the signalling traffic study, and users’ behavior measurement. The main contributions of this paper are the following. First, we characterize the traffic generated by voice and video calls, by observing the time evolution in terms of bit rate, inter-packet gap, packet size. Besides distinguishing among various voice Codecs that Skype uses, we also unveil the different behavior of the traffic source based on the adopted transport layer protocol. Second, we observe how Skype reacts to different and changing network conditions. Third, we focus on the users’ behavior by analyzing the number of flows generated in the time unit, the call duration—which unsurprisingly is very much related to the tariff policies—and the churning process. Fourth, we analyze the signaling traffic generated by a Skype client, considering the number of different clients that are contacted by a peer, which gives a feeling about the cost of maintaining the P2P architec- ture. While many details about the Skype protocols and internals can be found in [4], [5], few papers deal with the issues of Skype identification [3], [7], and traffic and users’ characterization [8]–[10]. In [7], authors focus on the identification of relayed 1 traffic only, using Skype as an example of application: little results are therefore presented about Skype source characteri- zation. Authors of [8] present an experimental study of Skype, based on a five month long measurement campaign. Lacking a reliable Skype classification engine, authors are forced to limit the scope to relayed sessions, and they restrict furthermore their attention to the case of UDP transport layer only. Works closest to ours are [9], [10]. In [9], authors focus on the evaluation of the QoS level provided by Skype calls. As the adopted VoIP traffic classification criterion is fairly simple, authors cannot distinguish between video and voice, end-to-end and SkypeOut calls, and cannot account for the impact of transport protocols. Authors in [10] instead investigate the Skype congestion control algorithm considering video-calls, exploring Skype reaction to variation of the available bandwidth and its TCP friendliness. Finally, all previous papers completely ignore Skype signaling traffic except [5], although the focus is different—i.e., authors analyze the login phase, and how Skype traverses NAT and firewalls rather than providing quantitative insights into Skype signaling traffic. II. SKYPE PREMIER The main difference between Skype and other VoIP clients is that Skype is based on a P2P architecture, rather than a more tra- ditional client-server model. Only user’s authentication is per- 1 A session is relayed if packets from a source to a destination are routed through an intermediate node which acts as an application layer relay. 1520-9210/$25.00 © 2008 IEEE Authorized licensed use limited to: Politecnico di Torino. Downloaded on February 2, 2009 at 12:31 from IEEE Xplore. Restrictions apply.