Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis > publications : papers : 2012 : one_way_traffic_iatmon
One-way Traffic Monitoring with iatmon
N. Brownlee, "One-way Traffic Monitoring with iatmon", in Passive and Active Network Measurement Workshop (PAM), Mar 2012.
|   View full paper:    PDF    |  Citation:    BibTeX   |

One-way Traffic Monitoring with iatmon

Nevil Brownlee 1, 2

CAIDA, San Diego Supercomputer Center, University of California San Diego


University of Auckland, New Zealand

During the last decade, unsolicited one-way Internet traffic has been used to study malicious activity on the Internet. Researchers usually observe such traffic using network telescopes deployed on darkspace (unused address space). When darkspace observations began ten years ago, one-way traffic was minimal. Over the last five years, however, traffic levels have risen so that they are now high enough to require more subtle differentiation - raw packet and byte or even port counts make it hard to discern and distinguish new activities.

To make changes in composition of one-way traffic aggregates more detectable, we have developed iatmon (Inter-Arrival Time Monitor), a freely available measurement and analysis tool that allows one to separate one-way traffic into clearly-defined subsets. Initially we have implemented two subsetting schemes; source types, based on the schema proposed in J. Treurniet's "A network activity classification schema and its application to scan detection"; and inter-arrival-time (IAT) groups that summarise source behaviour over time.

We use 14 types and 10 groups, giving us a matrix of 140 type-and-group subsets. Each subset constitutes only a fraction of the total traffic, so changes within the subsets are easily observable when changes in total traffic levels might not even be noticeable.

We report on our experience with this tool to observe changes in one-way traffic at the UCSD network telescope over the first half of 2011.

Daily average plots of source numbers and their traffic volumes show clear long-term changes in several of our types and groups.

Keywords: measurement methodology, network telescope, routing, software/tools
  Last Modified: Wed Oct-11-2017 17:03:59 PDT
  Page URL: