Measuring and characterising inbound sessions in residential DSL traffic

It has been assumed that the need for successful NAT traversal discourages residential DSL users from running services or applications that require them to accept connections from remote hosts. However, there are now numerous approaches for NAT traversal but there have been no studies measuring the prevalence of DSL users accepting inbound sessions. This paper presents an analysis of TCP and UDP flows initiated by remote clients to a group of residential DSL users, using packet traces captured from a New Zealand ISP between 2009 and 2011. Our analysis reveals that over half of all measured users accepted at least one inbound TCP or UDP session. There was no dominant port being used to accept sessions and port usage was spread over thousands of different ports. Skype and BitTorrent were the most popular application protocols observed and had increased in popularity over time. We also report on the use of dual SYNs to perform TCP NAT traversal in our data.