Passive Measurements
• historical archives often:
– are truncated
– have corrupt blocks, especially before clock resets
– file formats don't usually have way of reporting loss (and if
they did, they might lie anyway)
– poor time synchronization between directions
– “broken” timestamp design:
• FORE cards have hw and sw clocks, hw can wrap w/o sw noticing
• FORE cards (and any normal NIC) have queues before timestamps
– University sites on Abilene & vBNS links
– have IP address encoding (changes per file)
– no SNMP (mrtg) or other any sort of calibration/sanity