NDLI: Building a time machine for efficient recording and retrieval of high-volume network traffic

Please wait, while we are loading the content...

Measurement-based characterization of a collection of on-line games

A first look at modern enterprise traffic

Client behavior and feed characteristics of RSS, a publish-subscribe system for web micronews

Measurements, analysis, and modeling of BitTorrent-like systems

Characterizing unstructured overlay topologies in modern P2P file-sharing systems

Should internet service providers fear peer-assisted content distribution?

Joint data streaming and sampling techniques for detection of super sources and destinations

Optimal combination of sampled network measurements

The power of slicing in internet flow measurement

Poisson versus periodic path probing (or, does PASTA matter?)

On the accuracy of embeddings for internet coordinate systems

An empirical approach to modeling inter-AS traffic matrices

Geographic locality of IP prefixes

An information-theoretic approach to network monitoring and measurement

Multi-hop probing asymptotics in available bandwidth estimation: stochastic analysis

Exploiting internet route sharing for large scale available bandwidth estimation

Inferring and debugging path MTU discovery failures

Characterization and measurement of TCP traversal through NATs and firewalls

Predicting short-transfer latency from TCP arcana: a trace-based validation

Novel approaches to end-to-end packet reordering measurement

Data reduction for the scalable automated analysis of distributed darknet traffic

Sparse approximations for high fidelity compression of network traffic data

Building a time machine for efficient recording and retrieval of high-volume network traffic

Improving sketch reconstruction accuracy using linear least squares method

Understanding congestion in IEEE 802.11b wireless networks

Facilitating access point selection in IEEE 802.11 wireless networks

Eliminating handoff latencies in 802.11 WLANs using multiple radios: applications, experience, and evaluation

Estimation of link interference in static multi-hop wireless networks

Exploiting partially overlapping channels in wireless networks: turning a peril into an advantage

Network anomography

Combining filtering and statistical methods for anomaly detection

Detecting anomalies in network traffic using maximum entropy estimation

Exploiting underlying structure for detailed reconstruction of an internet-scale event

Collaborating against common enemies

Perils of transitive trust in the domain name system

Flooding attacks by exploiting persistent forwarding loops

Building a time machine for efficient recording and retrieval of high-volume network traffic

Content Provider	ACM Digital Library
Author	Kornexl, Stefan Sommer, Robin Paxson, Vern Feldmann, Anja Dreger, Holger
Abstract	There are times when it would be extraordinarily convenient to record the entire contents of a high-volume network traffic stream, in order to later "travel back in time" and inspect activity that has only become interesting in retrospect. Two examples are security forensics--determining just how an attacker compromised a given machine--and network trouble-shooting, such as inspecting the precursors to a fault after the fault. We describe the design and implementation of a Time Machine to efficiently support such recording and retrieval. The efficiency of our approach comes from leveraging the heavy-tailed nature of network traffic: because the bulk of the traffic in high-volume streams comes from just a few connections, by constructing a filter that records only the first N bytes of each connection we can greatly winnow down the recorded volume while still retaining both small connections in full, and the beginnings of large connections (which often suffices). The system is designed for operation in Gbps environments, running on commodity hardware. It can hold a few minutes of a high volume stream in RAM, and many hours to days on disk; the user can flexibly configure its operation to suit the site's nature. We present simulation and operational results from three distinct Gbps production environments exploring the feasibility and efficiency of a Time Machine implementation. The system has already proved useful in enabling analysis of a break-in at one of the sites.
Starting Page	23
Ending Page	23
Page Count	1
File Format	PDF
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2005-10-19
Access Restriction	Subscribed
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in