Analysis of Passive End-to-End Network Performance Measurements

Network measurements end-to-end passive Internet

Simpson, Charles Robert, Jr. ; Electrical and Computer Engineering

University:Georgia Institute of Technology

Department:Electrical and Computer Engineering

关键词: Network measurements end-to-end passive Internet;   

Others  :  https://smartech.gatech.edu/bitstream/1853/14612/1/simpson_charles_r_200612_phd.pdf

美国|英语

来源: SMARTech Repository

【 摘 要 】

NETI@home, a distributed network measurement infrastructure to collect passive end-to-end network measurements from Internet end-hosts was developed and discussed.The data collected by this infrastructure, as well as other datasets, were used to conduct studies on the behavior of the network and network users as well as the security issues affecting the Internet.A flow-based comparison of honeynet traffic, representing malicious traffic, and NETI@home traffic, representing typical end-user traffic, was conducted.This comparison showed that a large portion of flows in both datasets were failed and potentially malicious connection attempts.We additionally found that worm activity can linger for more than a year after the initial release date.Malicious traffic was also found to originate from across the allocated IP address space.Other security-related observations made include the suspicious use of ICMP packets and attacks on our own NETI@home server.Utilizing observed TTL values, studies were also conducted into the distance of Internet routes and the frequency with which they vary.The frequency and use of network address translation and the private IP address space were also discussed.Various protocol options and flags were analyzed to determine their adoption and use by the Internet community.Network-independent empirical models of end-user network traffic were derived for use in simulation.Two such models were created.The first modeled traffic for a specific TCP or UDP port and the second modeled all TCP or UDP traffic for an end-user.These models were implemented and used in GTNetS.Further anonymization of the dataset and the public release of the anonymized data and their associated analysis tools were also discussed.