Abstract: The cluster algorithm may make classification on a few attributes of objects. Based on the above feature, this paper studies the Gaussian mixture model (GMM) of network traffic and its log-normal distribution on flow scale. The EM algorithm is used to cluster traffics with interactive features. It is shown that EM algorithm is more appropriate on traffic clustering than K-means algorithm. The clustering analysis on both the balanced and unbalanced traffics shows that GMM is effective on different kinds of traffics. The lognormal distribution and the transitivity of power law from application layer to IP layer are studied. After the lognormal distribution in application layer produced by user behaviors and application features is transferred to IP layer via the control protocols in transport layer, the traffic presents fractal and selfsimilar on the packet scale.