Flow-concurrence and bandwidth ratio on the Internet

The relevance of flow-based monitoring in tasks such as the detection of anomalies and denial of use attacks, traffic reporting, performance evaluation, software routing among others motivates the study of the Internet traffic in terms of flows. However, by the time a network manager or practitioner start any of these tasks, they face the challenge of planning probes’ capacities, which depends on the number of concurrent flows. Unfortunately, while the bandwidth of a network or link, both in operation and in future deployments, can be known, or at least estimated in advance, nothing is known about the load in terms of concurrent flows. We aimed at filling this gap by studying the concurrence of flows with respect to the bandwidth normalized by factors such as protocol shares, timeouts, applications, time and years among others. As a result, we provide the research community with several models, based on lognormal distributions, and parameter estimates in such a way that any player in the Internet arena can estimate the number of concurrent flows in their own infrastructure. Moreover, such results emerge from a diverse set of network traces so making the extrapolation of conclusions viableThis work was partially funded by the Spanish Ministry of Economyand Competitiveness through the research project TRAFICA(MINECO/FEDER TEC2015-69417-C2-1-R

Inspección y análisis científico de las torres atalaya que defendieron el último reino islámico de la Península Ibérica

The Islamic Nasrid kingdom of Granada occupied the mountainous areas of the south-eastern area of the Iberian Peninsula. The Baetic mountain range worked as a natural frontier between the Nasrid kingdom and the Christian kingdom of Castile from 1232 to 1492. An extensive network of watchtowers was built by Nasrid to control this frontier stablishing visual communication between them and the Nasrid centre at the Alhambra citadel. Many of them are still standing, disperse through the provinces of Granada, Malaga, Almeria and the eastern parts of Jaen, Cordoba and Cadiz. Even being this military architecture protected by Spanish Heritage law, many of these medieval towers and their cultural landscapes are in severe risk. There are studies of individual towers, but any global comparative study has been developed. For this reason, within the framework of the R&D project called ‘Las atalayas que defendieron el reino nazarí de Granada. Análisis y documentación científica (Nazalaya)” (HAR2016-79689-P) financed by the Ministry of Economy, Industry and Competitiveness of Spain, the towers are being studied as individual exemplars as well as components of the same typological group. This generates a complete documentation constituted by a homogenous and exhaustively planimetry which supplements the existing information and enabling comparative analysis. Furthermore complete architectural surveys are being carried out using techniques as photogrammetry. In addition to the analysis of construction systems, the structural safety of these towers is evaluated formulating guidelines for its restoration.Universidad de Málaga. Campus de Excelencia Internacional Andalucía Tech. Proyecto del Plan Nacional I+D+i (Programa Estatal de Fomento de la Investigación Científica y Técnica de Excelencia) entitled ‘Las atalayas que defendieron el reino nazarí de Granada. Análisis y documentación científica (Nazalaya)’ (HAR2016-79689-P) Proyecto de Investigación Precompetitivo (mod. A) del Plan Propio de la Universidad de Málaga ‘La construcción de un paisaje: arquitectura de tapial en la Alta Andalucía en el siglo XIII. Estudio y análisis del sistema de torres andalusíes en el valle de Segura de la Sierra’ X Convocatoria de Proyectos de Investigación de la Fundación Pública Andaluza Centro de Estudios Andaluces en la modalidad de proyectos individuales, PRY/259/17 ‘Torres medievales y modernas conservadas en Andalucía. Documentación gráfica, análisis científico e interrelaciones

Characterizing the spatial and temporal diversity of the Internet Traffic: a capacity planning application to the RedIRIS network

Tesis doctoral inédita. Universidad Autónoma de Madrid, Escuela Politécnica Superior, marzo de 201

Performance comparison of scheduling algorithms for IPTV traffic over polymorphous OBS routers

Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.V. López, J. L. García-Dorado, J. A. Hernández, and J. Aracil, "Performance comparison of scheduling algorithms for IPTV traffic over polymorphous OBS routers", in ICTON Mediterranean Winter Conference, 2007. ICTON-MW 2007, p. 1-6Recent research in optical burst switched networks has proposed solutions to support subwavelength reservation for the periodic transmission of data bursts, which can coexist with conventional asynchronous bursts, bringing the polymorphous, agile and transparent optical networks (PATON) [1]. Thus, network operators can distribute IPTV channels to their customers, whereby they can use the spare bandwidth for the transmission of best-effort traffic, making use of the free gaps in between such periodic reservations. This work proposes scheduling algorithms for the transmission of periodic channels using PATON, and studies the blocking probability observed by best-effort traffic, when such scheduling algorithms are used.This work has been partially funded by the Spanish Ministry of Science and Education under the project DIOR (TEC2006-03246), and by the Comunidad Autónoma de Madrid under project e-Magerit (S-0505/TIC/000251). The authors would also like to acknowledge the support from the European Union VI Framework Programme e- Photon/ONe+ Network of Excellence (FP6-IST-027497)

DNS weighted footprints for web browsing analytics

The monetization of the large amount of data that ISPs have of their users is still in early stages. Specifically, the knowledge of the websites that specific users or aggregates of users visit opens new opportunities of business, after the convenient sanitization. However, the construction of accurate DNS-based web-user profiles on large networks is a challenge not only because the requirements that capturing traffic entails, but also given the use of DNS caches, the proliferation of botnets and the complexity of current websites (i.e., when a user visit a website a set of self-triggered DNS queries for banners, from both same company and third parties services, as well for some preloaded and prefetching contents are in place). In this way, we propose to count the intentional visits users make to websites by means of DNS weighted footprints. Such novel approach consists of considering that a website was actively visited if an empirical-estimated fraction of the DNS queries of both the own website and the set of self-triggered websites are found. This approach has been coded in a final system named DNSprints. After its parameterization (i.e., balancing the importance of a website in a footprint with respect to the total set of footprints), we have measured that our proposal is able to identify visits and their durations with false and true positives rates between 2 and 9% and over 90%, respectively, at throughputs between 800,000 and 1.4 million DNS packets per second in diverse scenarios, thus proving both its refinement and applicabilityThe authors would like to acknowledge funding received through TRAFICA (TEC2015-69417-C2-1-R) grant from the Spanish R&D programme. The authors thank Víctor Uceda for his collaboration in the early stages of this wor

On the real impact of path inflation in networks under production

Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. F. Mata, R. Gonzalez-Rey, J. L. García-Dorado, and J. Aracil, "On the real impact of Path Inflation in networks under production", in 8th International Wireless Communications and Mobile Computing Conference (IWCMC), 2012 , p. 53 - 58The research community has proved the existence and studied the root causes of Path Inflation on the Internet - end-to-end paths significantly longer than necessary. However, it has been typically ignored that the popularity of traffic destinations and, consequently, of network paths, is clearly heterogeneous - some destinations are popular while others are barely accessed. In this paper, we propose a trace-driven methodology to measure the Path Inflation accounting for the popularity of Internet destinations from a given network, thus evaluating the implications that Path Inflation exerts on real networks under production. This information is important for network operators because it allows them to objectively stand out those destinations whose connection analysis must be prioritized. The results of applying this methodology to the Spanish academic network show that the most critical regions to focus on are Spain's closest countries, which either are very popular or have large Path Inflation as a consequence of the use of transatlantic links as intermediate nodes, or both.The authors would like to thank the support of the Spanish Ministerio de Ciencia e Innovaci´on (MICINN) to this work, under project ANFORA (TEC2009-13385) and the FPU fellowship program that has funded this research wor

Workforce capacity planning for proactive troubleshooting in the Network Operations Center

Modern data centers require that a Network Operations Center is continuously monitoring network health, desirably in order to take proactive action before potential trouble occurs. In this paper, we contribute to the capacity planning of the workforce in charge. To this end, we have extensively analyzed, with real-world data, behavioral changes in a large server population in a data center. Our findings allow classifying such behavioral changes, which may be indicative of potential trouble, into relevance regions using a ranking mechanism. Then, the proposed methodology allows, together with an estimation of the time to analyze, assessing the workforce necessary to proactively tackle the behavioral changes observed. We conclude with a case study from a working data center, including a hands-on implementation of a traffic analysis solution to detect such behavioral changes and an estimation of the needed workforce to analyze them. Our results show that between 4 and 5 network managers are an adequate number for handling behavioral-changes analysis in a large enterprise data centerThis research has been partially funded the Ministry of Science and Innovation of Spain through Project AGILEMON under Grant AEI PID2019-104451RB-C21 and by Naudit High Performance Computing and Networking under art. 83. project

Factor analysis of Internet traffic destinations from similar source networks

This article is (©) Emerald Group Publishing and permission has been granted for this version to appear here (http://www.emeraldinsight.com/doi/full/10.1108/10662241211199951). Emerald does not grant permission for this article to be further copied/distributed or hosted elsewhere without the express permission from Emerald Group Publishing Limited.Purpose – This study aims to assess whether similar user populations in the Internet produce similar geographical traffic destination patterns on a per-country basis. Design/methodology/approach – We have collected a country-wide NetFlow trace, which encompasses the whole Spanish academic network, which comprises more than 350 institutions and one million users, during four months. Such trace comprises several similar campus networks in terms of population size and structure. To compare their behaviors, we propose a mixture model, which is primarily based on the Zipf-Mandelbrot power law to capture the heavy-tailed nature of the per-country traffic distribution. Then, factor analysis is performed to understand the relation between the response variable, number of bytes or packets per day, with dependent variables such as the source IP network, traffic direction, and country. Findings – Surprisingly, the results show that the geographical distribution is strongly dependent on the source IP network. Furthermore, even though there are thousands of users in a typical campus network, it turns out that the aggregation level which is required to observe a stable geographical pattern is even larger. Consequently, our results show a slow convergence rate to the domain of attraction of the model, specifically, we have found that at least 35 days worth of data are necessary to reach stability of the model’s estimated parameters. Practical implications – Based on these findings, conclusions drawn for one network cannot be directly extrapolated to different ones. Therefore, ISPs’ traffic measurement campaigns should include an extensive set of networks to cope with the space diversity, and also encompass a significant period of time due to the large transient time. Originality/value – Current state of the art includes some analysis of geographical patterns, but not comparisons between networks with similar populations. Such comparison can be useful for the design of Content Distribution Networks and the cost-optimization of peering agreements.This work has been partially funded by the Spanish Ministry of Education and Science under project ANFORA (TEC2009-13385), European Union CELTIC initiative program under project TRAMMS, European Union project OneLab, and the F.P.U. and F.P.I. Research Fellowship programs of Spain. The authors would also like to thank the anonymous reviewers who helped us to improve the quality of the paper

On the impact of packet sampling on Skype traffic classification

Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. P. M. Santiago del Río, D. Corral, J. L. García-Dorado, and J. Aracil, "On the Impact of Packet Sampling on Skype Traffic Classification", in IFIP/IEEE International Symposium on Integrated Network Management (IM 2013), 2013, p. 800 - 803Nowadays, traffic classification technology addresses the exciting challenge of dealing with ever-increasing network speeds, which implies more computational load especially when on-line classification is required, but avoiding to reduce classification accuracy. However, while the research community has proposed mechanisms to reduce load, such as packet sampling, the impact of these mechanisms on traffic classification has been only marginally studied. This paper addresses such study focusing on Skype application given its tremendous popularity and continuous expansion. Skype, unfortunately, is based on a proprietary design, and typically uses encryption mechanisms, making the study of statistical traffic characteristics and the use of Machine Learning techniques the only possible solution. Consequently, we have studied Skypeness, an open-source system that allows detecting Skype at multi-10Gb/s rates applying such statistical principles. We have assessed its performance applying different packet sampling rates and policies concluding that classification accuracy is significantly degraded when packet sampling is applied. Nevertheless, we propose a simple modification in Skypeness that lessens such degradation. This consists in scaling the measured packet interarrivals used to classify according to the sampling rate, which has resulted in a significant gain

Utilidad de los flujos NetFlow de RedIRIS para análisis de una red académica

La tecnología Netflow se encuentra actualmente desplegada en la mayoría de los routers de las redes comerciales. Dicha tecnología permite registrar los flujos que atraviesan la red, contando el número de bytes y paquetes que se transmiten entre dos equipos, lo cual puede ser útil para diversas aplicaciones. Este trabajo muestra la utilidad y aplicabilidad a la gestión de los flujos de red. En concreto, se presenta cómo los registros de flujos de red que captura RedIRIS en los nodos autonómicos pueden resultar de interés para monitorizar redes y como herramienta de obtención de medidas de la red para su posterior análisis con múltiples fines. Para ello, se ha implementado una aplicación que accede a estos registros, previamente procesados, y muestra de forma sencilla un conjunto de medidas y estadísticas para la mayoría de las universidades conectadas a RedIRIS