Bro: a system for detecting network intruders in real-time
Computer Networks: The International Journal of Computer and Telecommunications Networking
An analysis of TCP reset behaviour on the internet
ACM SIGCOMM Computer Communication Review
A first look at modern enterprise traffic
IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
Towards highly reliable enterprise network services via inference of multi-level dependencies
Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications
A study of end-to-end web access failures
CoNEXT '06 Proceedings of the 2006 ACM CoNEXT conference
The cubicle vs. the coffee shop: behavioral modes in enterprise end-users
PAM'08 Proceedings of the 9th international conference on Passive and active network measurement
Malware in IEEE 802.11 wireless networks
PAM'08 Proceedings of the 9th international conference on Passive and active network measurement
Packet-level traffic measurements from the Sprint IP backbone
IEEE Network: The Magazine of Global Internetworking
A First Look at Media Conferencing Traffic in the Global Enterprise
PAM '09 Proceedings of the 10th International Conference on Passive and Active Network Measurement
Mining policies from enterprise network configuration
Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference
The nature of data center traffic: measurements & analysis
Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference
A first look at traffic classification in enterprise networks
Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
A preliminary analysis of TCP performance in an enterprise network
INM/WREN'10 Proceedings of the 2010 internet network management conference on Research on enterprise networking
HostView: annotating end-host performance measurements with user feedback
ACM SIGMETRICS Performance Evaluation Review
Space-efficient tracking of persistent items in a massive data stream
Proceedings of the 5th ACM international conference on Distributed event-based system
Performance of networked applications: the challenges in capturing the user's perception
Proceedings of the first ACM SIGCOMM workshop on Measurements up the stack
REfactor-ing content overhearing to improve wireless performance
MobiCom '11 Proceedings of the 17th annual international conference on Mobile computing and networking
An end-host view on local traffic at home and work
PAM'12 Proceedings of the 13th international conference on Passive and Active Measurement
Classifying internet one-way traffic
Proceedings of the 2012 ACM conference on Internet measurement conference
Hi-index | 0.00 |
In this paper we take a look at the health of a typical enterprise network via a new metric based on the fraction of useful flows generated by endhosts. Flows considered non-useful are those that explicitly fail or else do not elicit a response from the intended destination. Examining traces collected from a large number of mobile hosts in an enterprise network, we find that about 34% of the flows are not useful. Through our study that combines data analysis and ongoing interactions with our IT department, we learn that these non-useful flows arise from several causes. Our mobile hosts frequently change environments, by either moving in and out of the corporate environment, or by switching the point and means of attachment to the corporate network. We find that many of the failures occur due to the hosts' lack of environment awareness, which results in attempts to discover services that are not present in all environments. Other causes include misconfiguration, unnecessary broadcast traffic, and excessive connection retries. Understanding this ever present noise in endhost communication is important for a variety of reasons including the fact that it complicates anomaly detection design and wastes resources, the latter of which is particularly crucial for wireless and mobile environments. Finally, we discuss possible means to design applications and services that can significantly improve the health of the network.