Usage Characteristics of Dial-in Internet Users: A National Study

Transcription

1 Usage Characteristics of Dial-in Internet Users: A National Study Ron Hutchins Ellen W. Zegura Oleg Kolesnikov Philip H. Enslow, Jr. College of Computing Georgia Institute of Technology Atlanta, GA fron,ewz,ok,enslowg@cc.gatech.edu Abstract We present results from a data set comprised of five months of RADIUS authentication data taken from a large national dial-up Internet Service Provider (ISP). The data, recorded from May 2 through September 2, contains activity from over 6, unique user accounts. Over the five months of data collection, the number of sessions per week grew from 13.6 million to 14.4 million. We analyze characteristics of the data set as a whole and of individual users. We present statistics on the number of sessions based on time-of-day, demonstrating interesting peaks in later afternoon and mid-evening activity. We also present session length data, observing a heavy-tailed distribution. We find that significant numbers of accounts exhibit concurrent sessions, some with as many as 2 sessions that overlap in time. There is considerable activity due to what we hypothesize to be automated processes. These are characterized by regular session interarrival times and relatively constant session lengths. Our results provide important data on the behavior of current dial-up access network users. Such data is potentially useful for a wide range of future studies, including design and evaluation of access network technologies. I. INTRODUCTION In recent years, considerable research effort has been devoted to collection and analysis of traces taken from operational networks. Such studies provide valuable information about the behavior of users, both individually and in aggregate, and allow trace-driven evaluation of proposed protocols and algorithms. Among past studies, relatively few have focused on collecting and analyzing behavior for the access networks that serve as the entry point for many end-users into the Internet 1. Notable examples include studies of a building-wide wireless network [1], a campus dial-in modem bank [2], an ISP s cable modem population [3], and the AT&T WorldNet modem bank [4]. 1 In the category of access networks we do not include campus or corporate-wide, richly-connected networks, such as Ethernet, and instead refer to more widely-available, lower-bandwidth access technologies such as dial-in and cable modems. These past studies largely focus on application-level behavior of access network users (e.g., web access behavior and performance). In this paper, we present results from a data set comprised of five months of RADIUS authentication data [5] taken from a large national dial-up Internet Service Provider (ISP). The data, recorded from May 2 through September 2, contains activity from over 6, unique user accounts, distributed in all 48 of the continental United States. Over the five months of data collection, the number of sessions per week grew from 13.6 million to 14.4 million. We believe this is the largest published study of access network usage characteristics. RADIUS records allow us to extract session start times and lengths, on a per account basis. For the majority of sessions, we also have access to the dialed (access point) phone number for each session and the dialing (origin) phone number. We anonymize both account identification and phone numbers prior to any analysis. We do not have access to application-level information (e.g., TCP port usage) nor to packet-level information, thus our results focus on session-level characteristics. It may be possible to combine our session-level results with prior studies of application-level behavior, especially for users connected via lower bandwidth access technologies, to get a complete model of access network user behavior. However, we have not attempted that synthesis of results in this paper. We analyze characteristics of the data set as a whole and of individual users. We present statistics on the number of sessions based on time-of-day, demonstrating interesting peaks in later afternoon and mid-evening activity. We also present session length data, observing a heavy-tailed distribution. We find that significant numbers of accounts exhibit concurrent sessions, some with as many as 2 sessions that overlap in time. There is considerable activity due to what we hypothesize to be automated processes. These are characterized by regular session interarrival times and 1

2 relatively constant session lengths. The next section provides more detail on the RADIUS system and the dataset we collected. Section III presents the results of our analysis, organized into aggregate statistics III-A, per-user statistics (including evidence of automated processes) III-B, evidence of mobility in using dial-up services III-C, and concurrent session usage III-D. We describe related work in Section IV and conclude with a discussion of future directions in Section V. II. BACKGROUND In this section, we describe the basic information available via the RADIUS access logs, as well as the initial processing we applied. That processing removes records not needed for our study and anonymizes the account identification information and phone numbers. The data consists of five months of authentication data from PPP [6] sessions, taken from a national scale ISP, during the months of May through September 2. These months span the Summer and early Fall period and therefore exhibit seasonal patterns of usage as well as growth in the user population. This data was collected from the distributed RADIUS authentication servers across the country used for collecting billing information for the ISP. This data set includes authentication records from both dial-in, DSL, and dedicated (low bit rate) service users. These are not separable in this data, since PPPoE [7] is used for point-to-point session implementation over broadband services, authenticated the same RADIUS authentication servers. The users were generically aware that the ISP has the right to perform monitoring, however they were unaware of this specific study. The data thus represents typical user activity, with no change in behavior due to non-standard monitoring. The original data consisted of LOGIN records, START records, STOP records and ERROR records, totaling about 1.25 Gb/day. The data was filtered to include only STOP records, since all information of interest to us was contained in these records. STOP records include the time of day of the end of the session, the length of the session, and the calling and called phone numbers for the session. ERROR records contain information about problems in the authentication process, which is not a focus of our study. Some data was missed over the five month collection period, typically due to problems transferring from the RADIUS servers. Specifically, we are missing data on 1-4, 2-28 May, 2; 5, 8, 11 June, 2; 18-2 August, 2; and September, 2. Of the records collected, some contained anomalies. Specifically, we observed the following: STOP records showing a zero length session. Extremely long reported session lengths (e.g., over one year). STOP records that did not fit the standard record format. STOP records that did not contain dialing or dialed telephone numbers due to different technologies used at the access point (T1 vs. PRI). A condition of our use of this data was the removal of any ability to associate usage characteristics with a particular real user. To provide this anonymity, each individual dial-in account was assigned an identification number, sequentially, based on the first time we saw the account number in the dataset. Subsequent activity on that account was recorded using the assigned identification number, thus preserving per-account statistics. The dialing phone number was anonymized similarly, with the exception that the area code (NPA) was preserved. Because there are many users in each area code, preservation of this information does not identify individual users, yet allows us to examine coarse geographic density of the user population. We are, of course, unable to identify more fine-grained (neighborhood) geographic information from the anonymized dataset. III. DATA ANALYSIS A. Overall Characteristics of User Activity We begin by examining characteristics of the overall data set, including number of sessions based on time-of-day, session length distribution and session length correlated with time-of-day. When time-of-day results are reported, all times are the local time of the dialed (access) point. Because the users are distributed throughout the four times zones of the United States, this essentially merges results that occur at the same relative, but not absolute time 2. Session count over time. Figure 2 shows the number of sessions that end in each 5 minute interval throughout two 24 hour periods 3. The leftmost plot in figure 2 is for a fairly typical weekday, specifically Wednesday, July 26, 2, while the rightmost plot is for a typical weekend day, specifically Saturday, July 29, 2. The weekday activity follows an expected diurnal cycle, with very little activity between 3am and 6am, and a quick increase in activity beginning at 6am. There are several peaks that appear, including one around 9pm and another closer to 11pm. This seems reasonable for home users, 2 For the final version of the paper, we will plot some of the results using absolute time, where that is helpful in making the interpretations more clear. 3 We report ending time, rather than starting time, because that was immediately available from our data. For the final version of the paper, we will convert to start times. 2

3 14 All Users Average Daily Session Counts for May, July, September 2 Average counts of sessions ending during each 5 min increment May Jul Sep midnight 6am noon 9pm midnight Time of day in 5 minute increments, rounded down Fig. 1. Session counts for May, July, and September All Users, Daily Session Counts for Wednesday, July 26, 2 All Users, Daily Session Counts for Saturday, July 29, Counts of sessions ending during each 5 min increment Counts of sessions ending during each 5 min increment midnight midnight 6am noon 9pm midnight 6am noon 9pm midnight Time of day in 5 minute increments, rounded down Time of day in 5 minute increments, rounded down Fig. 2. Session counts for Wednesday 26 July and Saturday 29 July who may dial in several hours after arriving home from work or just before bed. The weekend activity follows the same diurnal cycle, but without the evening and late night peaks present in the weekday data. The overall amount of user activity is also lower on the weekends, with a mid-day peak of about 8 sessions, as compared to 12, during the week. Both weekday plots contain some unusual data points, though there are more on the Wednesday plot. For example, we see a significant number of sessions that end at midnight, far in excess of what would be expected based on nearby data. We conjecture that this is due to an automated timeout that, for example, terminates idle sessions based on time of day. We discuss the presence of suspected automated processes further in Section III-E. We also see several values that are significantly lower than expected on the Wednesday plot around the 4pm time period. We do not see consistent dips in other weekday plots, and hence conjecture that this is due to a short term technical problem in the ISP infrastructure or RADIUS collection process. 3

4 Figure 1 shows the average number of sessions per day ending in each 5 minute interval, with a separate curve per month. That is, all days for a given month are averaged. Since there are more weekdays than weekends, the 9pm and 11pm peaks are still present. This plot is primarily interesting for the growth that it illustrates over time, with the peak usage increasing from about 9, to nearly 11, concurrent sessions. Session length distribution. We now turn to the session length distribution. Figure 4 shows the session length distribution for the particular Wednesday and Saturday used above. The x axis is the session length, in five minute buckets, while the y axis is the number of sessions of the given length, on a log scale. The results are generally consistent with other studies, finding that many sessions are quite short, but that a considerable number of sessions last far longer than average. There is little difference between the weekday and weekend session length distributions (modulo relatively fewer weekend sessions). Figure 3 shows the count of sessions for each day of May, July, and September combined into a monthly average. This overlay plot shows the close similarity of the three month s data. Several features stand out in these plots. For example, many sessions have duration of approximately 4 hours and again of approximately 12 hours. The 12 hour spike can be explained by a mechanism used by the ISP to timeout idle users at the 12 hour point of their session. This is common practice in the industry to keep users from camping on the modems. The 4 hour spike is not so definitively explainable. This spike may be from particular user application software, for example Microsoft dial-up applications software, which may include a timeout at this point in the session. An additional increase occurs at about the 8 hour mark. This seems most likely to be due to an additional application software timeout, with perhaps some contribution due to users who are logged on for a traditional 8-hour work day. Those sessions that last longer than 12 hours are nonidle at the 12 hour check point, and therefore continue beyond the time-out. After the 12 hour point, we observe a periodic increase in session counts, every 3 minutes. This is likely due to the 12 hour process that terminates idle sessions revisiting non-idle sessions on a 3 minute basis. There are sessions that last longer than 24 hours and therefore are not visible in Figure 4 and 3. For example, there are approximately 1 terminating sessions per day with duration of 24 hours, about 4 terminating per day with duration of 36 hours, and about 2 with duration of 48 hours. A small number of other sessions exhibiting long extremes appear but may be due to errors in data and so are not shown. Session length over time. We complete the summary of characteristics by examining the correlation between session length and time of day of session end. Figure 5 shows the average session length versus the time of day of session termination. In both plots, we observe about a 4:1 difference between the longest average session length (at about 6am) and the shortest average session length (at about 9am). Across the full range of times of day, sessions tend to be shorter, on average, for the weekday data and longer, on average, for the weekend data. The plots demonstrate a general inverse relationship between the number of sessions at a given time of day and the average session length. That is, during periods of relatively fewer sessions (12am to 6am), the average session length is quite long, while during periods of more session activity (9am to 6pm), the average session length is shorter. We also note that the Wednesday mid-day dip in number of sessions is matched by a spike in average session length. In summary, our user population exhibits an expected diurnal cycle in activity, but with significant differences in weekday and weekend behavior. Weekday activity contains peaks in mid and late evening, while weekend activity is more smooth. The distribution of session lengths appears heavy-tailed, with some sessions lasting far longer than average. Session lengths are also longer, on average, on the weekend and during periods of relatively fewer total sessions. B. User Locations Fig. 7. Area codes represented in the data We next examine in more detail characteristics of the user population, beginning with geographical location of the dialing (origin) phone number. During the data reduction process, the area code of users was maintained and statistics were kept for count of 4

5 All Users, Average Daily Session Lengths for May, July, September 2 Average session counts for each 5 min increment May July Sept 1 5min 6hrs 12hrs 18hrs 24hrs 36hrs 48hrs 6hrs 72hrs Session lengths in 5 minute increments, rounded down Fig. 3. Average of session length counts for May, July, September All Users, Daily Session Lengths for Wednesday, July 26, 2 All Users, Daily Session Lengths for Saturday, July 29, 2 1e+6 1e Session counts for each 5 min increment Session counts for each 5 min increment min 5min 6hrs 12hrs 18hrs 24hrs 6hrs 12hrs 18hrs 24hrs Session lengths in 5 minute increments, rounded down Session lengths in 5 minute increments, rounded down Fig. 4. Average of session length counts for Wednesday 26 July and Saturday 29 July, users calling from each area code in the continental United States. This data is shown in Figure 7, with each dot representing 25 accounts, randomly placed in the geographic region represented by that area code. Where multiple area codes serve an overlapping geographic region, the data points will overlap. The plot illustrates that the users are distributed across the continental United States, but are concentrated in the east. Additional regions of heavy density appear around larger cities (e.g., Denver, Seattle, Dallas, San Francisco). The data has clear implications for provisioning for this particular ISP. C. User Mobility The phone number data also allows us to examine the use of multiple dialing (origin) and dialed (access) phone numbers on a single account. Such information is useful for understanding how to provision globally for an account, as well as understanding a form of mobility in the use of dial-in accounts. Basic trends in mobile computing predict 5

6 1 All Users, Average Daily Session Lengths vs. Time of Day for Wednesday, July 26, 2 1 All Users, Average Daily Session Lengths vs. Time of Day for Saturday, July 29, Average session length in seconds Average session length in seconds am 12am 6am noon 6pm 12am 6am noon 6pm 12am Time of day in 5 minute increments, rounded down Time of day in 5 minute increments, rounded down Fig. 5. Session length over time for Wednesday, 26 July and Saturday, 29 July 1 Average Daily Session Lengths vs. Time of Day for May, July, Sept 2 May July Sept Average session length in seconds am 6am noon 6pm 12am Time of day in 5 minute increments, rounded down Fig. 6. Session length over time for May, July, September that over time users will tend to increase the number of dialing phone numbers (that is, using an account from an increasing number of locations), with a corresponding increase in the number of access phone numbers (caused by using an access number in the same geographic region as the origin number). For this data, we examine the entire population of over 6, accounts to extract counts of unique dialing and dialed phone numbers for each account. Figure 8 shows the number of unique dialing and dialed phone numbers on a per account basis, where the accounts are sorted in decreasing order of number of phone numbers. These figures reveal that on average users tend to dial from more phone numbers than they dial to; that is, they change their origin location more often than they change their access phone number. Further, while most users use a small number of origin and access locations, some users appear at over 1 origin locations and over 49 access 6

7 Fig. 8. Number of unique dialed and dialing phone numbers for each account locations. The seven largest data points out of the nearly 7, were removed from the data set due to the large distance between these seven and the next point in the set. The largest point has a verified value of over 7, dialing numbers. Figure 9 shows a scatter plot of the number of distinct dialing phone numbers versus the number of distinct dialed phone numbers for each account. The plot reveals the expected trend that the number of dialed phone numbers generally tracks the number of dialing phone numbers. The single plot does not show that early sequential userids contained very large values of dialing and dialed phone number counts while higher values contained much lower counts. This may be due to the correlation of early timeof-day accesses and automated processes. This will be discussed further in Section V. D. Concurrent Account Use Another important issue for provisioning (and potentially billing) is understanding the concurrent use of a single account for multiple sessions. We are able to determine the number of concurrent sessions on a single account by utilizing the session termination time and length data. Since the number of user accounts is large (nearly 7,) we chose a random sample of about 12 accounts to analyze. The sampling represents the data set reasonably well based on our experience with this data set. Figure 1 shows the breakdown of the percentage of time an account spends idle, contains one session, and contains more than one concurrent session, where the accounts are sorted by the sum of time spent idle and with one session. The plot reveals considerable differences across different accounts, both in percentage of idle time and in percentage of time with concurrent sessions. Figure 11 shows the percentage of accounts and time where concurrent sessions existed. The leftmost plot shows that more than half (45.8 percent) of all accounts have more than one concurrent session at some point in the data collection period. The rightmost plot of figure 11 shows the percentage of time idle and with one or more sessions combined for all sampled accounts. The percent time in which all accounts were idle (with sessions) is large in the general case. The time with one session is shown to be 8 percent while the time with multiple concurrent sessions is about 2 percent This indicates that one fourth of the active time in general is spent with multiple concurrent sessions active. E. Evidence of Automated Processes We alluded earlier to automated termination of sessions, either by the ISP or by application software. We also offer evidence of significant session activity due to automated processes, as characterized by regular, periodic interarrival times and durations. This activity is potentially a significant contribution to the total account activity and results in characteristics that are quite different from real user activity. Figure 12 shows the interarrival time between sessions for one selected user, moving sequentially across the session records on the x axis at two different resolutions. The rightmost plot shows a portion of the total data set, from record to record 14. Immediately evident from these plots is the presence of banding in at least four interarrival times, namely about 15 seconds, 35 seconds, 8 seconds and 12 seconds. Also present is some tendency for these bands to have some regularity in the number of sessions in a band. We believe these plots offer significant evidence of automated processes, with possibly half the sessions from this user appearing to be automated. More work is needed to automatically identify and extract sessions that are likely to be automated, as well as to 7

8 Fig. 9. Phone number dialing count versus dialed count repeat the analysis of the data after removing such sessions. F. Correlations with Time of First Appearance Several interesting features were observed in analyzing the data set that were made visible by the anonymization process. This process sequentialized users as they appeared in RADIUS records and maintained that sequential number across all future data. Since data observations began at midnight each day, users who appeared early in the first day s data received low sequential numbers. During the analysis process, we continually noted that several statistical values are correlated with the time of day the user is first seen, based on this midnight initiation of data collection. Those users who appear very early in the day, soon after midnight, have significantly more sessions documented than those users who appear later in the day. We conjecture that this is due to automated processes that run around the clock. Figure 13 shows the sequentially assigned userid related to count of sessions. It is noteworthy that the low numbered userids, about the first 25, exhibit a consistently high number of sessions, one with more than 42, sessions documented for the data collection period. Three points were deleted from this graph to more clearly show the data in the lower left corner of the plot. One other point of note is that at around the 43, userid mark a second peak appears. This may have been caused by a new set of users being added to the system showing broadly similar characteristics to the earlier group. Figure 14 presents the number of accounts which had x sessions during the period. Data points representing users having less than 2 sessions total were removed from the graph for clarity. For example, accounts had only one session for the period, 3924 had two sessions, 2228 had three. The graph shows two distinct distributions, one below about 1 sessions and another above 1. The point where these two curves join spans the session count. Since the 5 month study includes about 124 days total if the 26 missing days are removed, the 1 session mark approaches a once per day access for the period. So, one explanation of these low session count users may be that they represent once a day users. 8

9 1 Time distribution for zero, single, and multiple concurrent sessions Percentage of time idle, single session, and multiple sessions User index Fig. 1. Time idle, with one session, and with multiple concurrent sessions 45 Distribution of maximum number of concurrent sessions among users 9 Overall concurrent sessions distribution 4 8 Percentage of users with n concurrent sessions Percentage of time Maximum number of concurrent sessions n Number of concurrent sessions Fig. 11. Maximum and overall percentage of concurrent sessions: time and users IV. RELATED WORK Most closely related to our work are studies of access network user populations. Gribble and Brewer conducted an early study in this area, gathering traces from the University of California at Berkeley s dial-in modem banks [2]. They collected HTTP traces for 45 days in the Fall of 1996, observing 8, unique clients. They collected information on a per-http-request basis, discarding traffic not destined to port 8. Most comparable to our results are their measurements of requests per minute as a function of time of day. They observe a strong dependence, with a diurnal cycle that somewhat resembles ours. We see a more dramatic difference between weekday and weekend, and a weekday late evening peak that is not noticeably present in their data. Both observations are consistent with our population, which is includes a strong component of at-home users, while their population is at-work users. In the area of commercial access network populations, Arlitt et al. collect data at an ISP accessed via a cable modem bank [3]. Their collection took place over 5 9

10 2 Disconnected Intervals Between Sessions for Userid Disconnected Intervals Between Sessions for Userid 8262 Time in seconds between sessions (stop to start) Time in seconds between sessions (stop to start) Sequential record number Sequential record number Fig. 12. Session interarrival times for a single user Fig. 13. Sequential userid vs. count of RADIUS records months in Spring of 1997, observing several thousand subscribers. As in the Gribble data, the collected information is recorded on a per-http-request basis. The Arlitt data also exhibits a strong dependence on time of day, with a general shape that closely matches the Gribble data. Most of the rest of the data analysis focuses on application-level characteristics, rather than session information. Feldmann et al. also collect a trace in a commercial access network, specifically the AT&T WorldNet modem bank [4]. Data was collected over 12 days in mid-august 1997, observing nearly 8, unique users with over 15, dial-up sessions. They used the trace to drive a simulation of a web proxy, in order to assess the performance of web proxy caching. The session-level characteristics of the trace are not analyzed in the referenced paper, and therefore there is no basis for direct comparison to our results. Tang and Baker analyze a 12-week trace of the local-area wireless network located in the Gates Computer Science building at Stanford University [1]. Their user community 1

11 2 Number of Userids with X Active Sessions for period May-September 2 15 Count of userids Number of sessions total Fig. 14. Count of users with X RADIUS records comprises 74 users; at least half are graduate students, and the remainder are faculty, staff and three robots. They were able to capture packet-level activity (which allows identification of the application via port number), as well as access point information. Their results on overall user behavior are most directly comparable to ours. They observe a different trend in number of active users versus time-of-day, with a much more pronounced mid-afternoon peak on weekdays. This is expected since this network is located in a workplace, while dial-in ISP use includes a large number of at-home users. In looking at how often users are active, their results generally agree with ours in that more users are active on fewer days, while a few users are active on many days, though the limited size of their user population makes the trend less clear. V. CONCLUSIONS AND FUTURE WORK This analysis presents data from a large set of users over a significant time period. The results support basic expectations about time-of-day of network use and session length distribution as well as the relationship between time of day and session length. Session counts are light in early morning hours, showing peaks during specific times in the afternoon and early evening relating to down time of users during the waking hours Session lengths on average are longer in the early morning hours. This may be due to automated processes that run at very regular intervals around the clock. The count of dialing phone numbers tracks the count of dialed numbers closely. This could be from users traveling and using local access numbers, or from multiple users access via the same account. Some features of the data show interesting relationships. Three characteristics of note were somewhat unexpected in this study: Significant counts of concurrent sessions on a single account likely represent multiple users (or a single user and an automated process) accessing the Internet through a single ISP account. This has implications in billing and accounting as well as in planning for network capacity. 11

12 Significant counts of highly correlated patterns of consistent session interarrival times and session lengths show possible automated processes. These processes do not exhibit the same characteristics of use as humans and again can impact planning for network capacity and upgrade schedules. High correlation of number of sessions to time of first appearance in the authentication system again indicates high probability of automated processes with suggested impacts. In conclusion, we mention one interesting circumstance identified in Section III-C where an account appears with more than 7, dialing numbers calling to only about 1 dialed numbers. On investigation, the dialed numbers were almost exclusively one toll-free number and calling numbers were nearly always unique (one access per dialing number) indicating a special use account possibly for marketing purposes. This example shows that the new uses we will discover for network technologies will continue to challenge the designers and planners of the future Internet. In future research, we hope to document the percentage of network use due to automated processes and to identify accounts accessed by multiple users. Setting this data aside, we will document characteristics of what remains. This analysis should show individual human movement across multiple dialing and dialed locations and document current mobile capability across dial-up access networks. The demand for mobile networks is growing rapidly and data on current characteristics across the national landscape are needed for designing future protocols and infrastructure. REFERENCES [1] Diane Tang and Mary Baker, Analysis of a local-area wireless network, in Proceedings of MOBICOM 2. August 2, pp. 1 1, ACM Press. [2] Steven D. Gribble and Eric A. Brewer, System design issues for internet middleware services: Deductions from a large client trace, in USENIX:Proceedings of the Smposium on Internet Technologies and Systems 99, December 1997, pp [3] Martin Arlitt, Rich Friedrich, and Tai Jin, Workload characterization of a web proxy in a cable modem environment, Performance Evaluation Review 99, pp. 1 12, August [4] Anja Feldmann, Ramon Caceres, Fred Douglis, Gideon Glass, and Michael Rabinovich, Performance of web proxy caching in heterogeneous bandwidth environments, in Proceedings of Infocom 99, [5] C. Rigney, A. Rubens, W. Simpson, and S. Willens, Remote authentication dial in user service (radius), Internet Request for Comments 2138, April [6] W. Simpson, The point-to-point protocol (ppp), Internet Request for Comments 1661, July [7] Mamakos et. al., Transmitting ppp over ethernet, Internet Request for Comments 2516, February ACKNOWLEDGEMENTS Invaluable statistical expertise for automated process discovery was provided by Dr. Russell Heikes and Dr. T. Govindaraj of the School of Industrial and Systems Engineering at Georgia Tech. Dr. Steve French and Claudia Martin of the Georgia Tech GIS Center provided the time and tools to produce the area code map. Karen Carter and Dan Forsyth of the College of Computing at Georgia Tech contributed significantly with their expertise in PERL and aspects of processing the very large data set. LATEX help and invaluable moral support from Minaxi Gupta, Richard Liston, and Matt Sanders of the College of Computing Networking Group helped to complete the paper. Many thanks also go to Carl Rigney of Livingston Corporation for help in understanding RADIUS accounting data in this context. 12