Consistency Analysis of Network Traffic Repositories

Authors:
Elmer Lastdrager;Aiko Pras
Affiliations:
University of Twente, the Netherlands;University of Twente, the Netherlands
Venue:
EUNICE '09 Proceedings of the 15th Open European Summer School and IFIP TC6.6 Workshop on The Internet of the Future
Year:
2009

Citing 3
Cited 0

The performance analysis of linux networking - Packet receiving

Computer Communications
Traffic data repository at the WIDE project

ATEC '00 Proceedings of the annual conference on USENIX Annual Technical Conference
Consistency of Network Traffic Repositories: An Overview

AIMS '09 Proceedings of the 3rd International Conference on Autonomous Infrastructure, Management and Security: Scalability of Networks and Services

Quantified Score

Hi-index	0.00

Visualization

Abstract

Traffic repositories with TCP/IP header information are very important for network analysis. Researchers often assume that such repositories reliably represent all traffic that has been flowing over the network; little thoughts are made regarding the consistency of these repositories. Still, for various reasons, the traffic capturing process may have missed packets. For certain kinds of analysis, for example loss measurements, such inconsistencies may lead to the wrong conclusions. This paper proposes an algorithm to detect such inconsistencies, using the idea of "fake gaps". A prototype has been developed, and used to test two well-known repositories: the WIDE and Simpleweb repositories. The paper shows that both repositories contain several inconsistencies.