Abstract
Efficient and reliable network operation are the major concerns of computer networks monitoring, an objective that can be achieved by properly analysing the monitored network traffic. But due to the huge size of monitored traffic, this paper suggests a solution by presenting a representative of the monitored traffic. We claim that analysing the representative will generate the same information about the monitored networks, rather than analysing the whole network traffic. The representative is created by decomposing the monitored traffic into two parts, a representative and the rest of the traffic (data traffic), visual plots and cross-correlation will be used to expose the similarity between the representative and the data traffic. Experiments showed that the presented methodology reduces the volume of the analyzed traffic by a percentage of (30-80%), representative and data traffic showed similar behavior in the visual plots and in the cross-correlation calculations.