CLog: Low Cost Gigabit Full Packet Logging

Creating high quality network trace files is a difficult task to accomplish on a limited budget. High network speeds may overburden an individual system running packet logging software such as tcpdump, resulting in trace files with missing information and making analysis difficult or incomplete. High end specialized systems may perform the job well, but may be out of reach due to financial constraints. To that end, we developed the Cheap Logger (CLog) system which utilizes inexpensive COTS hardware to create high quality, complete network trace files. A scalable distributed storage system enables the CLog system to expand and continue to create high quality, complete network data trace files even at extremely high data rates.

[1]  Leslie Lamport,et al.  Time, clocks, and the ordering of events in a distributed system , 1978, CACM.

[2]  EDDIE KOHLER,et al.  The click modular router , 2000, TOCS.

[3]  B. Karp,et al.  Autograph: Toward Automated, Distributed Worm Signature Detection , 2004, USENIX Security Symposium.

[4]  George Varghese,et al.  Automated Worm Fingerprinting , 2004, OSDI.

[5]  Mostafa H. Ammar,et al.  Distributed network simulations using the dynamic simulation backplane , 2001, Proceedings 21st International Conference on Distributed Computing Systems.