As part of a broader organisational restructure, data networking research at Swinburne University of Technology has moved from the Centre for Advanced Internet Architecture (CAIA) to the Internet For Things (I4T) Research Lab.

Although CAIA no longer exists, this website reflects CAIA's activities and outputs between March 2002 and February 2017, and is being maintained as a service to the broader data networking research community.

Logicam QuickCam Express Over Yahoo! Messenger Traffic Characteristics
CAIA Technical Report 040625B

Ana M. Pavlicic
June 25th, 2004


This investigation looks at packet inter-arrival time and length characteristics from web camera chats over a LAN with Yahoo! Messenger. It begins by investigating traffic characteristics of a single web camera transmitting to another user's computer. Next, we look at two users both transmitting web camera video to each other in both Basic (< 1 fps) and Super (up to 20fps) Webcam mode. Lastly, a user on one computer transmits and receives video with two, three, four, five and six other Yahoo! Messenger users.

Generating and Capturing Web Camera Traffic

Traffic generated between computers running the web camera software was captured by Tcpdump running on the CAIA Bridge Machine. All web cameras in the investigation were Logitech QuickCam Express, able to generate up to 30fps and with a video resolution of up to 640x480 pixels. Web camera transmission was firstly initiated by the user on Computer 1 and was then reciprocated by a user on another computer. These results, however, are only representative of web camera transmission after all connections take place so as to only represent pure web camera video transmission.

Yahoo! Messenger was set to transmit web camera video at the fastest speed possible (0.77fps) rather than the highest quality possible (0.26fps) to ensure more packets were captured given the short test time of 10 minutes per test. The only form of communication between the users on Computer 1 and Computer 2 was via video with naturally 'bobbing' heads as for a typical sitting-down and typing environment.

Web Camera Computer Configurations

Computer Details
Pentium(R) 4 1.60GHz
Pentium(R) 4 2.00GHz
Pentium(R) 4 2.00GHz
Pentium(R) 4 2.80GHz
Pentium(R) 4 2.00GHz
Pentium(R) 4 2.80GHz
Pentium(R) 4 2.00GHz
Microsoft Windows XP SP1
Microsoft Windows 2000 SP4
Microsoft Windows 2000 SP3
Microsoft Windows XP SP1
Microsoft Windows 2000 SP4
Microsoft Windows XP SP1
Microsoft Windows 2000 SP4
Web Camera

Equipment Used for Generating/Capturing Web Camera Traffic

Figure 1.1: Web Camera Equipment Setup

We can see from Figure 1.1 that the Bridge Machine running Tcpdump was placed between Computer 1 and the Swinburne ITS network. The user sitting at Computer 1 exchanged video between up to six other users (Computers 2 to 7). These users only sent and received video to and from the user on Computer 1.

Bridge/Packet Sniffing Computer (
CPU: Pentium 3 800MHz
RAM: 256Mb
OS: FreeBSD 4.10
Web Cameras
Brand: Logitech
Model: QuickCam Express
Application: Yahoo! Messenger v 5.6.0
USB Port
Tcpdump was running on the Bridge Machine and Pkthisto 0.3.3 was used to generate packet traffic histograms. Pkthisto recorded a traffic flow once it saw 10 packets and packets were required to arrive more frequently than 10000ms for the flow to be considered active. This configuration was used to ensure no packets were lost for analysis. Each inter-packet arrival time and packet length histogram produced by Pkthisto represents a maximum of 200 packets.


The data set used for analysis was collected in sessions lasting over 10 minutes. The final set of results was collected in order to investigate traffic characteristics to/from Computer 1 and three, four, five and six web cameras. These are called Connection A, B, C and D respecitvely. The following table outlines these connections:

Connection Number
Web Cameras Communicating with Computer 1
(Web Camera 1)
Yahoo! Server
Connection A
Web Camera 2, 3, 4
Connection B
Web Camera 2, 3, 4, 5
Connection C
Web Camera 2, 3, 4, 5, 6
Connection D
Web Camera 2, 3, 4, 5, 6, 7

When there is a one-to-one video conversation, video data is sent directly between the two participants, Computer 1 and Computer 2, as seen in Figure 1.2. In the case where the Computer 1 user conducts a video conference with more than one person, the video data and ACK packets are no longer sent directly between the user and video receivers, but are sent between the user and the Yahoo! server wc{X} This can be seen in Figure 1.3. Since the video data that is being sent to the multiple users (on Computers 2-7) will be exactly the same, this data is sent only once to the Yahoo! server, from where it is distributed to all users that are to receive this identicial data.

Video data from each computer is still sent directly to Computer 1 and acknowledgements are sent to these users indivdually (peer-to-peer).

Figure 1.2: One-to-one
Figure 1.3: One-to-many

The following are the web camera traffic results obtained:

One Web Camera, One-Way Video Transmission - Sample time: 11min 9sec
Two Web Cameras, Two-Way Video Transmission - Sample time: 12min 47sec
Two Web Cameras, Two-Way Video Super Transmission - Sample time: 13min 45sec
Three Web Cameras, Two-Way Video Transmission - Sample time: 10min 19sec
Multiple Web Cameras Video Transmission - Sample time Connection A: 11min 55sec; Connection B: 10min 29sec; Connection C: 11min 1sec; Connection D: 13min 16sec

Summary and Further Analysis

The table below is a summary of the general inter-packet arrival times and packet size distributions observed from the two-way video transmission web camera network traffic.

Traffic Flow
Packet Inter-Arrival Time
Packet Length
Video Data Traffic in Super Webcam Mode
54.8 to 61.1% <= 0.25msec
Activity between 60msec and 130msec
8.3 to 27.7% = 52bytes
38.7 to 47.6% = 1500bytes
ACK Traffic in Super Webcam Mode
2.4 to 7.0% < 0.25msec
Activity between 60msec and 130msec
100% = 46bytes
Video Data Traffic in Normal Mode
64.4 to 69.5% <= 0.25msec
(outliers: 42.7% and 73.6%)
30.7 to 38.8% = 52bytes
(outlier: 26.4%)
32.8 to 39.1% = 1500bytes
(outliers: 22.4% and 47.3%)
ACK Traffic in Normal Mode
< 15% < 0.25ms
(outliers: 22.2% and 38.6%)
Activity between 100msec and 200msec
100% = 46bytes
Video Data Traffic to Yahoo!
70.4 to 72.3% <= 0.25msec
27.1 to 28.9% = 52bytes
42.6 to 45.6% = 1420bytes
ACK Traffic from Yahoo!
38.1 to 47.1% <= 1msec
Activity between 76msec and 118msec
100% = 46bytes

As we can see form the table above packets from a computer transmitting web camera video were mostly either 52bytes, 1420bytes or 1500bytes long. These packets would be replied to with 46byte TCP ACK packets. There was a wide distribution in packet inter-arrival times, most commonly below 1msec and between 100msec to 200msec.

Further investigation will include analysing and comparing data from other web camera software, such as Microsoft Netmeeting, for the purpose of modelling web camera traffic. It will aid in the development of software that uses packet statistics to identify and differentiate between applications producing traffic across a network.


Thuy Nguyen for her editorial assistance.
CAIA research staff for their patience and participation during the data gathering period.

Swinburne Homepage Site Map Search Index

Swinburne Copyright and disclaimer Privacy Feedback

Last Updated: Monday 28-Jun-2004 10:15:49 EST
Maintained by: Ana Pavlicic
Authorised by: Grenville Armitage

IndexSearchSite MapSwinburne Home Page