Named Data Networking (NDN) is one of five projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. NDN has roots in an earlier project, Content-Centric (CCN), which Van Jacobson first publicly presented 2006. The project investigates Jacobson's proposed evolution from today's host-centric network architecture (IP) to a data-centric (NDN). This conceptually simple shift far-reaching implications for how we design, develop, deploy, and use...

On July 19, 2001, more than 359,000 computers connected to the Internet were infected with Code-Red (CRv2) worm in less 14 hours. The cost of this epidemic, including subsequent strains Code-Red, is estimated be excess $2.6 billion. Despite global damage caused by attack, there have been few serious attempts characterize spread worm, partly due challenge collecting information about worms. Using a technique that enables detection spread, we collected and analyzed data over period 45 days...

In a packet network, the terms bandwidth and throughput often characterize amount of data that network can transfer per unit time. Bandwidth estimation is interest to users wishing optimize end-to-end transport performance, overlay routing, peer-to-peer file distribution. Techniques for accurate are also important traffic engineering capacity planning support. Existing tools measure one or more three related metrics: capacity, available bandwidth, bulk capacity. Currently employ variety...

Since the emergence of peer-to-peer (P2P) networking in late '90s, P2P applications have multiplied, evolved and established themselves as leading `growth app' Internet traffic workload. In contrast to first-generation networks which used well-defined port numbers, current ability disguise their existence through use arbitrary ports. As a result, reliable estimates require examination packet payload, methodological landmine from legal, privacy, technical, logistic, fiscal perspectives....

Traffic classification technology has increased in relevance this decade, as it is now used the definition and implementation of mechanisms for service differentiation, network design engineering, security, accounting, advertising, research. Over past 10 years research community networking industry have investigated, proposed developed several approaches. While traffic techniques are improving accuracy efficiency, continued proliferation different Internet application behaviors, addition to...

Recent reports in the popular media suggest a significant decrease peer-to-peer (P2P) file-sharing traffic, attributed to public's response legal threats. Have we reached end of P2P revolution? In pursuit legitimate data verify this hypothesis, paper, embark on more accurate measurement effort traffic at link level. contrast previous efforts, introduce two novel elements our methodology. First, measure all known protocols. Second, go beyond "known port" limitation by reverse engineering...

We introduce the area of remote physical device fingerprinting, or fingerprinting a device, as opposed to an operating system class devices, remotely, and without fingerprinted device's known cooperation. accomplish this goal by exploiting small, microscopic deviations in hardware: clock skews. Our techniques do not require any modification devices. report consistent measurements when measurer is thousands miles, multiple hops, tens milliseconds away from connected Internet different...

Recent research on Internet traffic classification algorithms has yield a flurry of proposed approaches for distinguishing types traffic, but no systematic comparison the various algorithms. This fragmented approach to leaves operational community with basis consensus what use when, and how interpret results. In this work we critically revisit by conducting thorough evaluation three approaches, based transport layer ports, host behavior, flow features. A strength our is broad range data...

Business relationships between ASes in the Internet are typically confidential, yet knowledge of them is essential to understand many aspects structure, performance, dynamics, and evolution. We present a new algorithm infer these using BGP paths. Unlike previous approaches, our does not assume presence (or seek maximize number) valley-free paths, instead relying on three assumptions about Internet's inter-domain structure: (1) an AS enters into provider relationship become globally...

In the first months of 2011, Internet communications were disrupted in several North African countries response to civilian protests and threats civil war. this paper we analyze episodes these disruptions two countries: Egypt Libya. Our analysis relies on multiple sources large-scale data already available academic researchers: BGP interdomain routing control plane data; unsolicited traffic unassigned address space; active macroscopic traceroute measurements; RIR delegation files; MaxMind's...

We present a parameterizable methodology for profiling Internet traffic flows at variety of granularities. Our differs from many previous studies that have concentrated on end-point definitions in terms state derived observing the explicit opening and closing TCP connections. Instead, our model defines based satisfying various temporal spatial locality conditions, as observed internal points network. This approach to flow characterization helps address some central problems networking model....

We present the concept of network traffic streams and ways they aggregate into flows through Internet links. describe a method measuring size lifetime streams, use this to characterize distributions at two different sites. find that although most (about 45 percent them) are dragonflies, lasting less than 2 seconds, significant number have lifetimes hours days, can carry high proportion (50-60 percent) total bytes on given link. define tortoises as last longer 15 minutes. point out be...

The relative performance of different data collection methods in the assessment various traffic parameters is significant when amount generated by a complete trace interval computationally overwhelming, and even capturing summary statistics for all impractical. This paper presents study sampling answering questions related to wide area network characterization. Using packet from environment that aggregates large number sources, we simulate approaches, including time-driven event-driven...

We calculate an extensive set of characteristics for Internet AS topologies extracted from the three data sources most frequently used by research community: traceroutes, BGP, and WHOIS. discover that traceroute BGP are similar to one another but differ substantially WHOIS topology. Among widely considered metrics, we find joint degree distribution appears fundamentally characterize as well narrowly define values other important metrics. discuss interplay between specifics collection...

We introduce the area of remote physical device fingerprinting, or fingerprinting a device, as opposed to an operating system class devices, remotely, and without fingerprinted device's known cooperation. accomplish this goal by exploiting small, microscopic deviations in hardware: clock skews. Our techniques do not require any modification devices. report consistent measurements when measurer is thousands miles, multiple hops, tens milliseconds away from connected Internet different...

We describe the structure and functionality of Internet cache protocol (ICP) its implementation in Squid web caching software. ICP is a lightweight message format used for communication among Web caches. Caches exchange queries replies to gather information use selecting most appropriate location from which retrieve an object. present background on history ICP, discuss issues deployment, efficiency, security, interaction with other aspects traffic behavior. catalog successes, failures,...

Research on performance, robustness, and evolution of the global Internet is fundamentally handicapped without accurate thorough knowledge nature structure contractual relationships between Autonomous Systems (ASs). In this work we introduce novel heuristics for inferring AS relationships. Our improve upon previous works in several technical aspects, which outline detail demonstrate with examples. Seeking to increase value reliability our inference results, then focus validation inferred We...

As the Internet has grown, so challenge of accurate measurement and modeling its topology. Commonly used but coarse methods measuring topology, e.g., BGP tables, suffer from several limitations. To pursue more empirically-based topology modeling, in 1998 CAIDA began Macroscopic Topology Project, which focuses on actively round trip time (RTT) information across a large cross-section commodity Internet. We describe CAIDA's architecture our analysis visualization tools. differences between IP...