Network traffic characterisation using flow-based statistics

Performing research on live network traffic requires the traffic to be well documented and described. The results of such research are heavily dependent on the particular network. This paper presents a study of network characteristics, which can be used to describe the behaviour of a network. We propose a number of characteristics that can be collected from the networks and evaluate them on five different networks of Masaryk University. The proposed characteristics cover IP, transport and application layers of the network traffic. Moreover, they reflect strong day-night and weekday patterns that are present in most of the networks. Variation in the characteristics between the networks indicates that they can be used for the description and differentiation of the networks. Furthermore, a weak correlation between the chosen characteristics implies their independence and contribution to network description.

[1]  Andrew W. Moore,et al.  Discriminators for use in flow-based classification , 2013 .

[2]  José Luis García-Dorado,et al.  Characterization of ISP Traffic: Trends, User Habits, and Access Technology Impact , 2012, IEEE Transactions on Network and Service Management.

[3]  David A. Maltz,et al.  Network traffic characteristics of data centers in the wild , 2010, IMC '10.

[4]  Konstantina Papagiannaki,et al.  Toward the Accurate Identification of Network Applications , 2005, PAM.

[5]  John S. Heidemann,et al.  On the characteristics and reasons of long-lived internet flows , 2010, IMC '10.

[6]  Chase Cotton,et al.  Packet-level traffic measurements from the Sprint IP backbone , 2003, IEEE Netw..

[7]  Aiko Pras,et al.  Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX , 2014, IEEE Communications Surveys & Tutorials.

[8]  kc claffy,et al.  Longitudinal study of Internet traffic in 1998-2003 , 2004 .

[9]  Walter Willinger,et al.  On the self-similar nature of Ethernet traffic , 1993, SIGCOMM '93.

[10]  Murad S. Taqqu,et al.  On the Self-Similar Nature of Ethernet Traffic , 1993, SIGCOMM.

[11]  Azer Bestavros,et al.  Self-similarity in World Wide Web traffic: evidence and possible causes , 1996, SIGMETRICS '96.

[12]  Sally Floyd,et al.  Wide area traffic: the failure of Poisson modeling , 1995, TNET.

[13]  IEEE/IFIP Network Operations and Management Symposium, NOMS 2010, 19-23 April 2010, Osaka, Japan , 2010, IEEE/IFIP Network Operations and Management Symposium.