collected on a choke point in an access network on a T3 line; collected on the span (monitoring ) port of the major edge rounter of AT&T Research's local network;
Collected Date:
16th of July, 2003;3rd of November 2003;over 13 days from the 13th until the the 26th of April 2004;
Notes:
Gigascope was configured to collect TCP connection records;Each such TCP connection record contains the information found in a typical flow records such as IP addresses and port number. Another difference to typical flow record (such as Netflow) is that the Gigascope maintains a state machine for each TCP conntection it monitors, only one TCP connection record is generated per TCP connection;
Gigascope Trace1: collected at a choke point in an access network on a T3 line from the 7th of May to the 16th of July, 2003, using a Gigascope probe;
Gigascope Trace2: Gigascope was placed on the span (monitoring ) port of the major edge rounter of AT&T Research's local network; see all of the traffic to and from the public Internet over a T3 connection, and also from our local network to other company sites via another T3 connection, and also a significant amount of internal LAN to LAN traffic consists of several hundred users, with a similar number of PCs. It was observed from the 17th of October until the 3rd of November 2003;
Gigascope Trace3: Gigascope was placed on the span (monitoring ) port of the major edge rounter of AT&T Research's local network. the data was measured over 13 days from the 13th until the the 26th of April 2004. this packet trace alone was 60GB of data, representing about 150 million flows.