Capturing Internet traffic dynamics through graph distances Steve Uhlig 1 , Bingjie Fu 2 , and Almerima Jamakovic 3 1 TU Berlin/Deutsche Telekom labs, Berlin, Germany, steve@net.t-labs.tu-berlin.de 2 Delft University of Technology, Delft, Netherlands, B.Fu@tudelft.nl 3 TNO ICT, Delft, Netherlands, almerima.jamakovic@tno.nl Abstract. Studies of the Internet have typically focused either on the routing system, i.e. the paths chosen to reach a given destination, or on the evolution of traffic on a physical link. In this paper, we combine routing and traffic, and study for the first time the evolution of the traffic on the Internet topology. We rely on the traffic and routing data of a large transit provider, spanning almost a month. We compute distances between the traffic graph over small and large timescales. We find that the global traffic distribution on the AS graph largely differs from traffic observed at small timescales. However, vari- ations between consecutive time periods are relatively limited, i.e. the topology spanned by the traffic from one time period to the next is small. This difference between local and global traffic distribution is found in the timescales at which traffic dynamics occurs on AS-level links. Small timescales, i.e. less than a few hours, do not account for a significant fraction of the traffic dynamics. Most of the traffic variability is concen- trated at timescales of days. Models of Internet traffic on its topology should thus focus on capturing the long-term changes in the global traffic pattern. Key words: Internet traffic, AS topology, graph distance, multi-resolution analysis 1 Introduction Most of the studies on traffic dynamics focus on a single link [9, 8, 12, 18, 10, 25]. In reality, Internet traffic is the outcome of end-hosts exchanging data, not through a single link, but over paths 1 . The Internet is composed of more than 30, 000 autonomous systems (AS). An AS is a network under a single adminis- trative authority. Each AS chooses independently its paths to reach destinations, among the paths that its neighboring ASs advertise. Typical examples of ASs 1 Paths in the Internet are typically asymmetric [17, 6], so that packets exchanged between two hosts follow different paths in the two directions.