Is P2P Dying Or Just Hiding?

Is P2P dying or just hiding?
Thomas Karagiannis
UC Riverside tkarag@cs.ucr.edu

Andre Broido, Nevil Brownlee, kc claffy
CAIDA, SDSC, UC San Diego {broido,nevil,kc}@caida.org

Michalis Faloutsos
UC Riverside michalis@cs.ucr.edu

Abstract— Recent reports in the popular media suggest a significant decrease in peer-to-peer (P2P) file-sharing traffic, attributed to the public’s response to legal threats. Have we reached the end of the P2P revolution? In pursuit of legitimate data to verify this hypothesis, we embark on a more accurate measurement effort of P2P traffic at the link level. In contrast to previous efforts we introduce two novel elements in our methodology. First, we measure traffic of all known popular P2P protocols. Second, we go beyond the “known port” limitation by reverse engineering the protocols and identifying characteristic strings in the payload. We find that, if measured accurately, P2P traffic has never declined; indeed we have never seen the proportion of p2p traffic decrease over time (any change is an increase) in any of our data sources. Index Terms—traffic measurements, peer-to-peer, file-sharing

OC48 (2.5Gbps) links of Tier1 Internet Service Providers (ISPs) in 2002 through 2004. Our specific contributions include:
•

•

• •

In our traces, P2P traffic volume has not dropped since 2003. Our datasets are inconsistent with claims of significant P2P traffic decline. We present a methodology for identifying P2P traffic originating from several different P2P protocols. Our heuristics exploit common conventions of P2P protocols, such as the packet format. We illustrate that over the last few years, P2P applications evolved to use arbitrary ports for communication. We claim that accurate measurements are bound to remain difficult since P2P users promptly switch to new more sophisticated protocols, e.g., BitTorrent.

I. I NTRODUCTION Recently, popular media sources have reported a sharp decline in peer-to-peer (P2P) traffic during the last...