Presentation is loading. Please wait.

Presentation is loading. Please wait.

Differences between In- and Outbound Internet Backbone Traffic Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering Chalmers University.

Published byEarl Fowler Modified over 8 years ago

Similar presentations

Presentation on theme: "Differences between In- and Outbound Internet Backbone Traffic Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering Chalmers University."— Presentation transcript:

1 Differences between In- and Outbound Internet Backbone Traffic Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering Chalmers University of Technology Göteborg, Sweden

2 2007-05-23TNC 2007 Overview 1.Introduction 2.Highlights of directional differences on IP level TCP level UDP level 3.Summary of results 4.Conclusions

3 2007-05-23TNC 2007 Introduction: Motivation Why measuring on Internet links? –to understand the nature of Internet traffic –quantify deployment of protocol features Interesting for –Network engineers and protocol developers –Network modeling and simulation community –Network security and intrusion detection

4 2007-05-23TNC 2007 Introduction: Related work Directional differences on backbone traffic –Evident on simple packet header analysis –Correlation of packets might reveal reasons Related work: –Mainly unidirectional flow data (NetFlow) –Either low or very high aggregation level –Marginal discussion on directional differences

5 2007-05-23TNC 2007 Introduction: Our contribution Complete view on different levels Contemporary data Packet level analysis Bi-directional TCP connections Specific measurement location –Medium aggregation level –Suitable for highlighting directional differences

6 2007-05-23TNC 2007 Introduction: Measurement location Internet Regiona l ISPs Gbg Sthlm Göteborgs Univ. Chalmers Univ. Stud-Net 2x 10 Gbit/s (OC-192) 2x DAG6.2SE Cards tightly synchronized capturing headers

7 2007-05-23TNC 2007 Introduction: General traffic characteristics Data from 20 days in April 2006 146 traces, 10.7 billion frames, 7.5 TB 99.99% IPv4 data 93% TCP packets 97% TCP data Data and packet counts equal on inbound and outbound links!

8 2007-05-23TNC 2007 Highlights: IP level Distinct IP addresses seen (in Millions)

9 2007-05-23TNC 2007 Distinct IP addresses seen (in Millions) Surprisingly large numbers Inbound destinations >> outbound sources Outside hosts primarily due to UDP Highlights: IP level

10 2007-05-23TNC 2007 Highlights: TCP level Connection attempt breakdown (Millions)

11 2007-05-23TNC 2007 Highlights: TCP level Connection attempt breakdown (Millions) Inbound connections mainly scans!

12 2007-05-23TNC 2007 Highlights: TCP level (2) TCP termination behavior (Millions)

13 2007-05-23TNC 2007 Highlights: TCP level (2) TCP termination behavior (Millions) Only 67% close properly (2xFIN) Inbound: 20% of conn. closed by FIN and RST!

14 2007-05-23TNC 2007 Highlights: TCP level (3) Statistical properties of established TCP connections –Lifetime, data volume, packet count Inbound connections more likely to: –show lifetimes between 1 and 5 seconds –be long lasting (>10 minutes) –carry more data and more packets –show higher asymmetry (client-server pattern)

15 2007-05-23TNC 2007 TCP level: P2P traffic Quantification according to port-numbers Missing payload → underestimated by factor 2-3 [*,**] –13% of data in outbound connections –25% of data in inbound connections * S. Sen et al, “Accurate, Scalable in-network identification of P2P traffic across large networks”, IMW 2002 ** T. Karagiannis et al, “Transport layer identification of P2P Traffic”, ACM SIGCOMM 2004

16 2007-05-23TNC 2007 Highlights: UDP level 68 million UDP flows 51 million carry less than 3 packets! DNS: 5%; NTP 1.7% Incoming scanning: > 8% P2P overlay traffic: > 20% Signaling Traffic –Distributed Hash Table (DHT) like Kademlia –Update routing tables in decentralized way –Periodic “ping” queries and replies –P2P overlay networks span entire globe –High fluctuation in peering partners → lots of IPs

17 2007-05-23TNC 2007 Summary of results Besides equal counts and volumes on both links, directional differences were found in: –IP packet sizes –IP fragmentation –Number of TCP connections –TCP connection establishment & termination –TCP option usage –TCP connection properties –UDP scanning traffic

18 2007-05-23TNC 2007 Conclusion High level analysis does not necessarily show differences → detailed analysis does! 2 main reasons for directional differences: –Malicious traffic the Internet is “unfriendly” –P2P Göteborg is a P2P source P2P is changing traffic characteristics e.g. packet sizes, TCP termination, TCP option usage

19 Thank you very much for you attention! Questions?

20 2007-05-23TNC 2007 BACKUP BACKUP SLIDES

21 2007-05-23TNC 2007 Common P2P port numbers

22 2007-05-23TNC 2007 TCP level (4) TCP options (in %)

23 2007-05-23TNC 2007 TCP level (4) TCP options (in %)

24 2007-05-23TNC 2007 IP level (2) Packet size distribution on the 2 links

25 2007-05-23TNC 2007 IP level (2) Packet size distribution on the 2 links

26 2007-05-23TNC 2007 IP level (3) IP fragmentation on the 2 links

27 2007-05-23TNC 2007 Malicous traffic / P2P traffic Connection properties lifetime in sec

Download ppt "Differences between In- and Outbound Internet Backbone Traffic Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering Chalmers University."

Similar presentations

Routing Routing in an internetwork is the process of directing the transmission of data across two connected networks. Bridges seem to do this function.

Routing Routing in an internetwork is the process of directing the transmission of data across two connected networks. Bridges seem to do this function.
Introduction to TCP/IP

Introduction to TCP/IP
CPSC 441 - Network Layer4-1 IP addresses: how to get one? Q: How does a host get IP address? r hard-coded by system admin in a file m Windows: control-panel->network->configuration-

CPSC Network Layer4-1 IP addresses: how to get one? Q: How does a host get IP address? r hard-coded by system admin in a file m Windows: control-panel->network->configuration-
Multihoming in IPV6 Habib Naderi Department of Computer Science University of Auckland.

Multihoming in IPV6 Habib Naderi Department of Computer Science University of Auckland.
CS 457 – Lecture 16 Global Internet - BGP Spring 2012.

CS 457 – Lecture 16 Global Internet - BGP Spring 2012.
Introduction1-1 message segment datagram frame source application transport network link physical HtHt HnHn HlHl M HtHt HnHn M HtHt M M destination application.

Introduction1-1 message segment datagram frame source application transport network link physical HtHt HnHn HlHl M HtHt HnHn M HtHt M M destination application.
Multi-Layer Switching Layers 1, 2, and 3. Cisco Hierarchical Model Access Layer –Workgroup –Access layer aggregation and L3/L4 services Distribution Layer.

Multi-Layer Switching Layers 1, 2, and 3. Cisco Hierarchical Model Access Layer –Workgroup –Access layer aggregation and L3/L4 services Distribution Layer.
International Standards Organization Open Systems Interconnect (OSI) Reference Model Advanced Computer Networks.

International Standards Organization Open Systems Interconnect (OSI) Reference Model Advanced Computer Networks.
Copyright © 2005 Department of Computer Science CPSC 641 Winter 20111 WAN Traffic Measurements There have been several studies of wide area network traffic.

Copyright © 2005 Department of Computer Science CPSC 641 Winter WAN Traffic Measurements There have been several studies of wide area network traffic.
5/1/2006Sireesha/IDS1 Intrusion Detection Systems (A preliminary study) Sireesha Dasaraju CS526 - Advanced Internet Systems UCCS.

5/1/2006Sireesha/IDS1 Intrusion Detection Systems (A preliminary study) Sireesha Dasaraju CS526 - Advanced Internet Systems UCCS.
Report by: Loizos Konomou EL933 Fall 2005 Prof: Yong Liu Ruoming Pang, Mark Allman, Mike Bennett, Jason Lee, Vern Paxson, Brian Tierney Princeton University,

Report by: Loizos Konomou EL933 Fall 2005 Prof: Yong Liu Ruoming Pang, Mark Allman, Mike Bennett, Jason Lee, Vern Paxson, Brian Tierney Princeton University,
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 6 Packet Filtering By Whitman, Mattord, & Austin© 2008 Course Technology.

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 6 Packet Filtering By Whitman, Mattord, & Austin© 2008 Course Technology.
1 Spring Semester 2007, Dept. of Computer Science, Technion Internet Networking recitation #12 LSNAT - Load Sharing NAT (RFC 2391)

1 Spring Semester 2007, Dept. of Computer Science, Technion Internet Networking recitation #12 LSNAT - Load Sharing NAT (RFC 2391)
Assessing the Nature of Internet traffic: Methods and Pitfalls Wolfgang John Chalmers University of Technology, Sweden together with Min Zhang Beijing.

Assessing the Nature of Internet traffic: Methods and Pitfalls Wolfgang John Chalmers University of Technology, Sweden together with Min Zhang Beijing.
Licentiate Seminar: On Measurement and Analysis of Internet Backbone Traffic Wolfgang John Department of Computer Science and Engineering Chalmers University.

Licentiate Seminar: On Measurement and Analysis of Internet Backbone Traffic Wolfgang John Department of Computer Science and Engineering Chalmers University.
1 WAN Measurements Carey Williamson Department of Computer Science University of Calgary.

1 WAN Measurements Carey Williamson Department of Computer Science University of Calgary.
 The Open Systems Interconnection model (OSI model) is a product of the Open Systems Interconnection effort at the International Organization for Standardization.

 The Open Systems Interconnection model (OSI model) is a product of the Open Systems Interconnection effort at the International Organization for Standardization.
Using Argus Audit Trails to Enhance IDS Analysis Jed Haile Nitro Data Systems

Using Argus Audit Trails to Enhance IDS Analysis Jed Haile Nitro Data Systems
FIREWALL TECHNOLOGIES Tahani al jehani. Firewall benefits  A firewall functions as a choke point – all traffic in and out must pass through this single.

FIREWALL TECHNOLOGIES Tahani al jehani. Firewall benefits  A firewall functions as a choke point – all traffic in and out must pass through this single.
Network Monitoring School of Electronics and Information Kyung Hee University. Choong Seon HONG Selected from ICAT 2003 Material of James W. K. Hong.

Network Monitoring School of Electronics and Information Kyung Hee University. Choong Seon HONG Selected from ICAT 2003 Material of James W. K. Hong.

Similar presentations

Ads by Google