Public

IEPM

URL:	http://www-iepm.slac.stanford.edu/
Administration:	SLAC Participating Groups/Networks: DOE funded, HENP, DOE/HENP, ESnet, Atlas, BaBar, Belle, CDF, CMS, D0, Zeus, LEP(Aleph, Delphi,Opal,L3), Fusion CIT, Internet2, vBNS, XIWT Monitoring Projects: AMP, PingER(Beacon,Monitor,Remote), RIPE, Surveyor
Site Lists:	http://www-iepm.slac.stanford.edu/monitoring/sites-by.html More than 38 monitoring sites in 14 countries. 3302 pairs to 599 remote nodes at 420 sites in 72 countries.
Security Policy:	Some sites post a security warning about reverse traceroute. Some restrictions exist on broadcast pings.
Time Granularity:	bursty (30 min); synchronizes using NTP
Internet Load/Overhead:	WebSite Stats created using FTPWebLog 1.0.3a1: Reverse traceroute traffic: http://www-iepm.slac.stanford.edu/about/webstats/traceroute.html PingER packets appear to be either 100 bytes or 1000 bytes.
Internet Analysis:	Per Participant Reports and Graphs: http://www.hep.net/hepnrc/network/frame_participants.html Only single graphs of RTT and packet loss are provided for each monitored path Although a time range can be specified, there is no way to see whether data exists for that timeframe prior to query submit. http://www-iepm.slac.stanford.edu/pinger/perfmap/ Animated world map shows network performance between monitoring sites (SLAC, Fermi Lab, and CERN) and hosts in over 70 countries.

Internet2 (Abilene)

URL:	http://monon.uits.iupui.edu/
Administration:	Indiana University NOC Information databased in Abilene NOC Database.
Site Lists:	Connectors Participants Peers
Security Policy:	unknown
Time Granularity:	5 mins; Daily; Weekly. All times reported in Eastern Standard time.
Internet Load/Overhead:	Mping packets {28 byte, 128 byte, 256 byte, 512 byte, 1024 byte, 1500 byte} Also uses WhatsUp Gold 3.5 by Ipswitch,Inc. (ICMP probes)
Internet Analysis:	WhatsUp Reports. (Can use username='guest' with null password) Abilene Weather Map Network Maps Weekly Report Archive

Mantra - Monitor & ANalyze TRAffic (in multicast routers)

URL:	http://www.caida.org/tools/measurement/mantra/
Administration:	Central data collection site located at Networking and Multimedia Systems Lab at UC-Santa Barbara. Mirror site at CAIDA. Contact Prashant Rajvaidya for more information.
Site Lists:	Routers from which Mantra collects data
Security Policy:	Mantra requires read-only access to monitored routers. Many route tables, e.g., MBGP, DVMRP, MSDP, depict global multicast state that is generally not a privacy issue. If statistics about the data flow, and intranet activities are considered too sensitive, then participating sites can filter this information or elect not to pass it on to the central site.
Time Granularity:	Interactive graphs and tables updated every 15-30 minutes
Internet Load/Overhead:	Periodic data collector scripts run on a system local to the target router. This script logs on to the monitored router, reads internal memory tables, and transfers those tables to the local system for preprocessing. Data collection is given low-priority so as not to interfere with high load on the target router. Superfluous text is removed from raw router tables before transferring them to the central analysis site.
Internet Analysis:	General Monitoring: Status of Multicast Multicast Sessions and Membership Multicast mroute and Traffic Protocol Monitoring: MGBP Monitor MSDP Monitor Usage of GLOP Space SSM Usage Visualizations: Visualization of MBGP Topology Geographic View of Multicast Components

MAWI - Measurement and Analysis on the WIDE Internet

URL:	http://tracer.csl.sony.co.jp/mawi/
Administration:	Relationship with other Research Entities WIDE Project Sponsors and Management Partners
Site Lists:	Four sample points collect traffic traces: A Trans-Pacific T1 line Another Trans-Pacific (18Mbps) line An IPv6 line connected to 6Bone An IPv6 line connected to WIDE-6Bone
Security Policy:	Traffic traces are for research purposes only. Traces are sanitized using tcpdpriv. Payload is removed. Specific location of monitor is not disclosed.
Time Granularity:	approximately daily
Internet Load/Overhead:	Traces of varying time lengths are taken using tcpdump utility.
Internet Analysis:	Samplepoint A Traffic Traces by Year, then by Day (also contains Bi-hourly Y2K traces) Samplepoint B Traffic Traces by Year, then by Day Samplepoint C Traffic Traces by Year, then by Day Samplepoint D Traffic Traces by Year, then by Day

NIMI

URL:	http://www.ncne.nlanr.net/nimi/
Administration:	Distributed: Local management and control.
Site Lists:	ACIRI (Berkeley), APAN (Seoul), AT&T Research, Boston U., CAIRN, CERN (Geneva), Columbia U., Georgia Tech U., ISI East, MIT, NASA Glenn Research Center, Sandia National Laboratory, SLAC, Swedish Inst. of Computer Science, U. of California (Berkeley, Los Angeles, and Santa Barbara), U. College (London), U. of Lulea, U. of Mannheim, U. of Massachusetts, U. of Michigan, U. or Oregon, U. of Pisa, U. of Southern California, U. of Virginia, U. of Washington.
Security Policy:	NIMI messages are encrypted via RSA private/public key pairs, and passed between NIMI components via TCP/IP. A message consists of a header listing the information necessary to decrypt the message body (key name), and an encrypted message body. Volunteers hosting NIMI platforms trust NIMI developers enough to either grant admin access, or perform privileged operations upon request. Secure updating is needed. Each NIMI probe is configured by its CPOC to authorize particular sets of operations per credential. End users access infrastructure via the Measurement Client (MC). Data Analysis Client (DAC) acts as a repository and post-processor of measurement data.
Time Granularity:	various (DAC can be run as part of the MC to collect immediate results, or as a daemon to collect on-going measurements.) MINC probes occur once every 2 minutes.
Internet Load/Overhead:	NIMI probe consists of the nimid daemon (responsible for communication with the outside world and performing access control checks), and scheduled daemon (does actual measurement scheduling, execution, and result packaging). Measurement modules currently include: traceroute, mtrace, treno, cap/capd, zing, mflect, traffic/discardd, and ftp. MINC (Multicast Inference of Network Characteristics) provides the measurement methodology used to determine performance characteristics of the interior of a network from edge measurements. This method is based on the use of correlations between performance degradation on different paths. Its innovation lies in its use of multicast probes (once every 2 minutes) exchanged between measurement servers. Probes use the MBone, the multicast-capable subset of the Internet. Three tools based on RTCP are used: mgen generates a stream of data; mflect calculates packet loss; mmerge collates mflect results. (Purpose of zing is unknown; may be a ping variant.) MINC probes reveal performance degradation correlations inherently. The MINT2000 (Multicast Inference Network Tool) provides a web-based interface for selecting MINC datasets, and visualizing the results.
Internet Analysis:	V. Paxson, J. Mahdavi, A. Adams, and M. Mathis, An Architecture for Large-Scale Internet Measurement. IEEE Communications, Vol.36, No.8, pp 48-54, August 1998. ftp://ftp.ee.lbl.gov/papers/nimi-ieee-comm98.ps.gz. V. Paxson, A. Adams, and M. Mathis, Experiences with NIMI, to appear, Proceedings of Passive & Active Measurement: PAM-2000. http://www.aciri.org/vern/papers/nimi-pam-00.ps.gz. http://www.ncne.nlanr.net/nimi/nimipapers.phtml. An index of NIMI papers.

NLANR(MOAT) AMP

URL:	http://watt.nlanr.net
Administration:	Requires installation of a rack mountable, FreeBSD machine with a 10/100Mbps Ethernet interface provided and administered by NLANR.
Site Lists:	List of monitors and site info
Security Policy:	unknown
Time Granularity:	Linear random occuring sometime during 1st 15 secs of each minute; synchronizes using NTP
Internet Load/Overhead:	Probes are 64 bytes.
Internet Analysis:	Real-Time Status Reports(includes simple round trip time (RTT) statistics {min, mean, max, stddev, loss}) AMP Measurement Program for DREN Long-Term 3D AMP Data Graphs AMP System Stability Sensors Active Measurement of the vBNS

NLANR(MOAT) PMA

URL:	http://moat.nlanr.net/PMA/
Administration:	Requires installation of a rack mountable, FreeBSD machine with a FDDI, OC3, or OC12 network interface provided and administered by NLANR.
Site Lists:	Map of PMA Passive Monitoring Sites. Note that one PMA site is in Israel, and one PMA machine is on the APAN link to Japan.
Security Policy:	IP adresses in traces are encoded using a one-way function.
Time Granularity:	Eight 90-second trace samples are taken at different times daily.
Internet Load/Overhead:	Each 90 second trace is sanitized and stored as a uniquely named file.
Internet Analysis:	Raw network traffic packet header traces are available for network analysis research within the Internet community at: Traces. Web interface to 17 monitors that regularly perform 8 measurement projects.

NPACI NWS

URL:	http://nws.cs.ucsb.edu
Administration:	Requires the NWS software be installed by a local administrator.
Site Lists:	SDSC; U Texas; Rice U.; ISI; Indiana U.; U. Tennessee; U. N. Carolina; NCSA; CalTech; U. Chicago Appears to have been run on up to 100 hosts simultaneously.
Security Policy:	unknown
Time Granularity:	Typically, NWS network Sensors make measurements once every 10 to 60 seconds.
Internet Load/Overhead:	"To avoid Sensor contention and to provide a scalable way to generate all-to-all network performance measurements, the network Sensors are organized as a hierarchy of Sensor sets called CLIQUES. Each Sensor participating in a clique conducts inter-machine experiments with every other clique member, but not with Sensors outside the clique." "Sensors may operate in multiple cliques concurrently." The system will conduct a series of performance experiments every K seconds, where K is a tunable parameter. A performance experiment consists of a 64K data transfer, a 4 byte data transfer, and two storage requests to a local NWS persistent state
Internet Analysis:	Network Weather Service (Select "Interactive Query" from Contents)

PPNCG

URL:	http://icfamon.rl.ac.uk/ppncg/title.html
Administration:	Particle Physics Network Co-ordinating Group, JANET, UKERNA
Site Lists:	UK connections to CERN UK connection to DESY UK connections to SLAC and FNAL
Security Policy:	unknown
Time Granularity:	Frequency of ICFA Traceroutes is unknown. Traceping statistics gathered at Oxford occur at "regular intervals over a 24-hour period".
Internet Load/Overhead:	unknown
Internet Analysis:	Network Monitoring from Daresbury Network Monitoring from RAL

RIPE-RIS (Routing Information Service) and RIPE-TTM (Test Traffic Measurements)

URL:	RIS:   http://www.ripe.net/ripencc/pub-services/np/ris-index.html TTM:   http://www.ripe.net/ripencc/mem-services/ttm
Administration:	RIS:  RIPE-NCC staff TTM:  Requires dedicated test-box PC configured and administered by RIPE-NCC test-box staff. Also requires installation of GPS receiver antenna at each monitor site. RIPE-NCC test-box alarm messages are emailed to designated local technical contact.
Site Lists:	RIS:   RRC00 in Amsterdam has 15 EBGP peers. RRC01 at LINX has approximately 50 peers. TTM:  A map of locations of all test-boxes is available to members on a password-protected web page.
Security Policy:	RIS:  Default free routing information between Autonomous Systems only TTM:  RIPE test-boxes require: TCP: outgoing mail (SNMP); incoming SSH (from 193.0.0.0/23) UDP: incoming/outgoing NTP (port 23); incoming/outgoing DNS (local resolver); incoming/outgoing TestTraffic Formal Disclosure of Data Agreements Used
Time Granularity:	RIS:  Periodic since July 1999 TTM:  Poisson (1/min); synchronizes using GPS
Internet Load/Overhead:	RIS:  Routing Data collected into RIS DB. SQL2RRD queries DB and makes plots for display on the web. TTM:  Approximately 3 probes per minute, each 100 bytes long.
Internet Analysis:	RIS:  Prototype web interface available at: RIPE-RIS. TTM:   Only available to members or service subscribers.

Surveyor

URL:	http://www.advanced.org/csg-ippm/
Administration:	Requires a dedicated host and GPS aerial at each monitor site. All coordination done by Advanced Network and Services, Inc.
Site Lists:	Advanced Network Services, Inc; Argonne T1; Army Labs, MD DREN; U. Auckland, NZ; BCNet GigaPop, Vancouver,Canada; Berkeley, Brookhaven Natl. Labs; Brown; Brown T1; U. New Brunswick, CANARIE; CANARIE I2 GigaPop; CERN, Carnegie-Mellon U.; U. Colorado; Columbia; Fermilab; Frontrange GigaPop; France Telecom; George Washington U.; Harvard; U. Hawaii; Indiana U. GigaPop; APAN, Japan; APAN, Korea; MCNC,RTP; U. Michigan; Maui HPCC; NASA Ames GigaPop; NCAR; NCSA; NIST; Ntl. Lib. Medicine(NLM); Nova Scotia CANARIE; Naval Post Graduate School T1; OneNet; Ontario GigaPop - CANARIE; Oregon GigaPop; Oak Ridge Labs; U. Penn. T1; Pacific Internet; Penn State U.; RIPE; SingAREN, Singapore APAN; SLAC; Spawar, DREN; Stanford U.; Texas GigaPop; U. Chicago; UCLA; UKERNA; U. Maryland; U. Minnesota; U. N. Carolina-T1; UNINETT; U. Alaska DREN; U. Mass.; U. Utah; U. Twente, Netherlands; U. Virginia; U. Washington; U. Wisconsin.
Security Policy:	Secure Shell (SSH) and public-key encryption required for access to Surveyor Measurement Machine
Time Granularity:	Probes sent at Poisson randomized intervals (2/sec); time synchronization using GPS
Internet Load/Overhead:	Approximately 2Kbps/sec, where individual packets are 40 Bytes
Internet Analysis:	Surveyor Technical Report STR 004: Participants Guide to the Surveyor Daily Summary Reports available on web site at http://www.advanced.org/csg-ippm/ under section entitled "Technical Papers/Reports.

TRIUMF

URL:	http://sitka.triumf.ca/
Administration:	TRIUMF - Canada's National Laboratory for Particle and Nuclear Physics
Site Lists:	18 nodes monitored
Security Policy:	unknown
Time Granularity:	Traceroute data 4x per day. Pings every 10 minutes.
Internet Load/Overhead:	unknown
Internet Analysis:	Ping archives Dynamic Tools

U Oregon Route Views Project

URL:	http://www.antc.uoregon.edu/route-views/
Administration:	Voluntary collaborations of network operators arranged with Route Views administrator David Meyer. David is also the director of the Advanced Network Technology Center at the University of Oregon.
Site Lists:	See "Current Participants" section on web page. As of 8/15/00, 16 participants provide full routing tables and 9 others provide partial tables.
Security Policy:	Loosely defined 'Acceptable Use of Data' discourages non-aggregated (e.g. where a specific provider is named) results where this might be sensitive.
Time Granularity:	real-time snapshot of router's RAM
Internet Load/Overhead:	The Route Views router, route-views.oregon-ix.net , uses multi-hop BGP peering sessions with backbones at interesting locations (note that location should not matter if the provider is announcing consistent routes corresponding to its policy). Route Views uses AS65534 in its peering sessions, and routes received from neighbors are never passed on nor used to forward traffic. Finally, route-views.oregon-ix.net itself does not announce any prefixes. Route Views currently services about 830 daily connections, about 90% of which are short interactive sessions likely used for querying specific routes or ASes, and the rest of which are longer-lived data collecting sessions from known data collectors.
Internet Analysis:	NLANR AS paths to individual networks. NLANR collects Route-Views data nightly. NLANR BGP-system usage of 32 bit Internet address space BGP Routing Table Dynamics by Sean McCreary

WAND

URL:	http://wand.cs.waikato.ac.nz/wand/wits/
Administration:	Requires dedicated host equipped with one or more DAG cards and a GPS system supporting time accuracy < 1 microsecond to UTC (typical installations use Trimble Palisade).
Site Lists:	University of Auckland (OC3c) (All packets for all external connections must pass this measurement point.) New Zealand Internet Exchange. (NZIX) 100BaseTX University of Calgary, Canada (OC3c) RIPE Amsterdam, the Netherlands (10BaseT) Several more sites in preparation (New Zealand, USA)
Security Policy:	Only Internet protocol headers get captured (first 40 bytes). Some sites can operate with cleartext IP addresses. When published for anonymous retrieval via the Internet, traces get sanitized by mapping IP addresses into address space 10.x.x.x in a non-reversible fashion. The security policy will see improvements with more sophisticated measurement configurations.
Time Granularity:	A Trimble Palisade GPS system delivers a 1PPS signal that is timestamped by the DAG network interface/measurement system and is accurate within one microsecond to UTC or better. Traces typically run for 24 hours, with measurements taken each second.
Internet Load/Overhead:	Passive traces are non-intrusive. Dealing with large captured trace files can impose heavy network load when transferred.
Internet Analysis:	Current focus of analysis is to establish trace integrity and to provide a simple web interface for network researchers who can then select trace files for further analysis. http://moat.nlanr.net/Traces/Kiwitraces/ (includes graphs) http://wand.cs.waikato.ac.nz/wand/wits/auck/2/ Trace data - illustrated

CAIDA CoralReef

URL:	https://anala.caida.org/CoralReef/Demos/cerfnet/link/
Administration:	CAIDA configures dedicated Intel monitor boxes running FreeBSD, and installs using an optical splitter to passively capture, and analyze packets.
Site Lists:	UCSD/SDSC commodity link NASA Ames Internet eXchange Monitors for MAE-West and UCSD/SDSC vBNS are planned
Security Policy:	Trace files anonymized; no payloads.
Measurement Granularity:	5 minutes; 1 hour; 1 day; 7 days; 28 days; 365 days
Internet Load/Overhead:	None.
Internet Analysis:	Current protocol breakdown Current applications Current flows Current source hosts Current destination hosts Current unknown TCP Current source ASes Current Destination ASes Current source countries Current destination countries Timeseries protocol plot Timeseries protocol fraction Timeseries top application plot Timeseries emerging application plot

CAIDA skitter

URL:	http://sk-summary.caida.org/cgi-bin/main.pl
Administration:	primarily by CAIDA
Site Lists:	http://www.caida.org/tools/measurement/skitter/monitors/
Security Policy:	Monitor boxes are physically secure. Secure data storage is used. All communication with the central collector is encrypted.
Time Granularity:	Probes are typically made once every 30 minutes. Monitor Unix kernel has been modified to support consistent, meaningful probe timestamping.
Internet Load/Overhead:	1. ICMP probe packets are 52 bytes long. 2. Probes are rate-limited based on an algorithm that considers quality of connectivity. No more than 300 52-byte packets/second allowed. A monitor may generate between 300K - 1.1M probes/day.
Internet Analysis:	Daily summaries can be used to compare: topology differences (e.g. by continent, by country or organization) RTT performance differences (e.g. by continent, by country or organization)