Today's Usenet Usage: NNTP Traffic Characterization

The finding by Maier et al [1] that Network News Transport Protocol (NNTP) traffic is responsible for up to 5% of residential network traffic inspires us to revisit today's Usenet usage. For this purpose we have developed an NNTP analyzer for the Bro network intrusion detection system. We find that NNTP is intensively used by a small fraction of the residential broadband lines that we study and that almost all traffic is to NNTP servers that require subscription for a monthly fee. The accessed content resembles what one might expect from file-sharing systems---archives and multimedia files. Accordingly, it appears that NNTP is used by some as a high performance alternative to traditional P2P file-sharing options such as eDonkey or BitTorrent.