Building a repository of network traffic captures for information assurance education

  • Authors:
  • Peng Li;Chengcheng Li;Tijjani Mohammed

  • Affiliations:
  • East Carolina University, Greenville, NC;East Carolina University, Greenville, NC;East Carolina University, Greenville, NC

  • Venue:
  • Journal of Computing Sciences in Colleges
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Network traffic analysis is one of the essential skills of information security professionals. To help students develop these skills, pre-recorded network trace files were needed so students could perform hands-on exercises in network security labs. Due to legal and privacy reasons, however, it is not feasible to record traffic on public networks. Traditionally, the main sources of the network traffic captures have been from the public domain or from dedicated physical networking labs. The trace files in the public domain are free but often out-dated and limited. Additionally, the cost of using a private networking lab to record traffic is just too high. Developments in virtual machine technology have now made it possible to create a portable and expandable private virtual networks at a minimal cost. The network is composed of virtual machines running different guest operating systems and applications. We used this diversified virtual network to generate normal and irregular traffic, including traffic of malicious attacks. Transmitted packets were recorded as trace files in libpcap format and were added to our local repository of network traffic captures. The network traces were later provided to students for analyses in hands-on labs.