Live Traffic Monitoring with Tstat: Capabilities and Experiences



Similar documents
Experiences of Internet Traffic Monitoring with Tstat

COMPARISON OF FIXED & VARIABLE RATES (25 YEARS) CHARTERED BANK ADMINISTERED INTEREST RATES - PRIME BUSINESS*

COMPARISON OF FIXED & VARIABLE RATES (25 YEARS) CHARTERED BANK ADMINISTERED INTEREST RATES - PRIME BUSINESS*

AT&T Global Network Client for Windows Product Support Matrix January 29, 2015

There e really is No Place Like Rome to experience great Opera! Tel: to discuss your break to the Eternal City!

How To Monitor A Network On A Network With Bro (Networking) On A Pc Or Mac Or Ipad (Netware) On Your Computer Or Ipa (Network) On An Ipa Or Ipac (Netrope) On

Firewall Testing Methodology W H I T E P A P E R

2016 Examina on dates

Cisco IOS Flexible NetFlow Technology

2015 Examination dates

Network Based Intrusion Detection Using Honey pot Deception

Controlling SSL Decryption. Overview. SSL Variability. Tech Note

Trends and Differences in Connection-behavior within Classes of Internet Backbone Traffic

Best Practices for Controlling Skype within the Enterprise > White Paper

UNIVERSITY OF DAYTON DAYTON OHIO ACADEMIC CALENDAR

Many network and firewall administrators consider the network firewall at the network edge as their primary defense against all network woes.

Analysis One Code Desc. Transaction Amount. Fiscal Period

Flow Analysis Versus Packet Analysis. What Should You Choose?

LAUREA MAGISTRALE - CURRICULUM IN INTERNATIONAL MANAGEMENT, LEGISLATION AND SOCIETY. 1st TERM (14 SEPT - 27 NOV)

Case 2:08-cv ABC-E Document 1-4 Filed 04/15/2008 Page 1 of 138. Exhibit 8

Computer Networks. Secure Systems

Validate the performance and security of IPS/IDS, Firewall and Proxy - January 2009

Inside Dropbox: Understanding Personal Cloud Storage Services

CLASSIFYING NETWORK TRAFFIC IN THE BIG DATA ERA

Statistics for ( )

Intrusion Detection System

Kick starting science...

Open Source in Network Administration: the ntop Project

Enhanced Vessel Traffic Management System Booking Slots Available and Vessels Booked per Day From 12-JAN-2016 To 30-JUN-2017

Introducing IBM s Advanced Threat Protection Platform

App-ID. PALO ALTO NETWORKS: App-ID Technology Brief

Layered protocol (service) architecture

Protocols. Packets. What's in an IP packet

Transactions. Georgian Technical University. AUTOMATED CONTROL SYSTEMS - No 1(8), 2010

Scalable Extraction, Aggregation, and Response to Network Intelligence

CSIS CSIS 3230 Spring Networking, its all about the apps! Apps on the Edge. Application Architectures. Pure P2P Architecture

INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY

REPORT & ENFORCE POLICY

Versus Certification Training 2016 Guideline of Versus Technical Education Courses

How To Control Your Network With A Firewall On A Network With An Internet Security Policy On A Pc Or Ipad (For A Web Browser)

Lab 1: Packet Sniffing and Wireshark

SOUTHERN POLYTECHNIC STATE UNIVERSITY. Snort and Wireshark. IT-6873 Lab Manual Exercises. Lucas Varner and Trevor Lewis Fall 2013

CONSTRUCTION AND MANAGEMENT OF A SECURE NETWORK IN SPRING-8

Internet Traffic Measurement

Data driven approach in analyzing energy consumption data in buildings. Office of Environmental Sustainability Ian Tan

VisuSniff: A Tool For The Visualization Of Network Traffic

Smart Network Access System SmartNA 10 Gigabit Aggregating Filtering TAP

Getting the Most Out of Your Existing Network A Practical Guide to Traffic Shaping

Fine-grained traffic classification with Netflow data

Networking for Caribbean Development

Lab VI Capturing and monitoring the network traffic

SECURE P2P VOICE OVER IP USING DEEP PACKET INSPECTION

Alcohol. Alcohol SECTION 10. Contents:

Uncovering the Big Players of the Web

EKT 332/4 COMPUTER NETWORK

Ethereal: Getting Started

Network Packet Analysis and Scapy Introduction

Network Agent Quick Start

Canaveral Port Authority Master Cruise Ship Schedule -- FY 2015

Wireshark Tutorial. Figure 1: Packet sniffer structure

Deep Security/Intrusion Defense Firewall - IDS/IPS Coverage Statistics and Comparison

Wireshark Tutorial INTRODUCTION

Introduction to Netflow

Intrusion Detection Systems (IDS)

Analysis of Network Packets. C DAC Bangalore Electronics City

UNIVERSITY OF DAYTON DAYTON OHIO ACADEMIC CALENDAR (Subject to Change)

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN

High-Speed Network Traffic Monitoring Using ntopng. Luca

Niagara IT Manager s Guide

Firewalls and VPNs. Principles of Information Security, 5th Edition 1

2015 Timetables / HEL STO

Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX

Deep Security Intrusion Detection & Prevention (IDS/IPS) Coverage Statistics and Comparison

Second-generation (GenII) honeypots

IDS / IPS. James E. Thiel S.W.A.T.

Load Balance Router R258V

NORTH EAST Regional Road Safety Resource

Training Assessments Assessments NAEP Assessments (selected sample)

Classifying P2P Activity in Netflow Records: A Case Study on BitTorrent

Applications erode the secure network How can malware be stopped?

Network Monitoring and Management NetFlow Overview

INTRUSION DETECTION SYSTEMS and Network Security

Network sniffing packet capture and analysis

Computer Networks & Security 2014/2015

Transcription:

Live Traffic Monitoring with Tstat: Capabilities and Experiences Maurizio M. Munafò Alessandro Finamore Marco Mellia Michela Meo Dario Rossi WWIC - Luleå, June 3, 2010

Outline Motivations Tstat - TCP STatistic and Analysis Tool Deployment Scenarios Features Layer-3 / Layer-4 Characterization Layer-7 Analysis and DPI LibTstat Outputs Gallery of Tstat Capabilities Conclusions

Traffic Classification & Measurement Why? Identify normal and anomalous behavior Characterize the network and its users Quality of service monitoring Traffic engineering Firewall tuning Pricing

Tstat at a Glance

Worm and Viruses? Did someone open a Christmas card? Happy new year to Windows!!

Anomalies (Good!) Spammer Disappear McColo SpamNet shut off on Tuesday, November 11th, 2008

New Applications P2PTV Fiorentina 4 - Udinese 2 Inter 1 - Juventus 0

TCP STatistic and Analysis Tool Tstat is a long term software project from the TLC Networks Group in Politecnico di Torino Project born to characterize the behavior of TCP connections Evolved to a full-fledged tool to monitor and analyze the traffic in IP networks Runs on most Linux/FreeBSD/NetBSD systems Working both as passive live sniffer and as offline trace analyzer Support for integration in other monitoring tools (libtstat)

Live Monitor Probe Just passively listen (sniff) the traffic passing on an operative link No need for special equipment Good performance with off-the-shelf hardware Manage hundreds of Mpbs with common PC hardware and integrated NIC Support for hi-end NIC cards Using Endace DAG able to manage a couple of Gbps of traffic with no fuss

Monitor Probe Setup LOCAL OUT IN EXTERN

Offline Traffic Analyzer Processing of already captured traffic traces for offline analysis Popular packet trace formats: pcap, erf, etherpeek Common compression formats: gzip, bzip, and 7zip

Tstat Workflow L7 L4 L3 Behavioral FSM DPI Pure DPI TCP/UDP IPv4/IPv6 Skype, Encrypted P2P Web, Mail, IM Peer-to-peer, P2P-TV #bytes, #flows, IP bitrate, packet length,

Tstat Workflow Layer 2 MAC encapsulation Tstat supports several MAC encapsulations (Ethernet, VLAN, MPLS), but no explicit statistic on them L4 L3 TCP/UDP IPv4/IPv6 Layer 3 IP IPv4 and IPv6 datagrams: anything different is ignored Layer 4 TCP and UDP Identification and complete characterization of TCP flows: flow length, lifetime, RTTs, window size, UDP flows: size, length, ports usage

Tstat Features L7 L4 Behavioral FSM DPI Pure DPI TCP/UDP Layer 7 Internet applications protocols L3 Pure Deep Packet Inspection Simple matching of known signatures in the packet payload P2P file sharing (emule/kad, Bittorrent), P2P-TV (Sopcast, PPLive, TVAnts) Finite State Machine DPI Mixes the Pure DPI with a FSM to consider packets in both directions Internet Protocols (HTTP,SMTP,SSL, SSH, ), Instant Messaging (MSN, Yahoo, Jabber), Web 2.0 Applications (Facebook, YouTube, RapidShare, Megaupload, ) Behavioral Classifier Classification of encrypted traffic through statistical properties Skype, Obfuscated emule/kad, Encrypted Bittorrent IPv4/IPv6

Tstat Outputs Connection Logs Text files reporting all of the relevant measures collected for the identified flows Histograms Text files collecting the empirical frequencies distributions for the collected parameters, saved at regular intervals RRD Round Robin Database Popular compact format to collect monitored statistics on several timescales. Used to monitor the probe through a CGI Web page Packed traces Dump of classes of packets into pcap traces for further elaborations

LibTstat Tstat can be compiled as a library to be linked with other measurement tools Simple API to pass packets to the Tstat engine The linking application can control all the aspects of the analyzed traffic Anonymization Packed payload Traffic filtering Successfully used by TIE (Univ. of Naples) and METAWIN (ftw.)

Where Tstat Lives

Gallery of Tstat Capabilities Live probe on the edge of the Politecnico campus network 1 Gbps link connecting to GARR, the Italian Research Network Traffic quite regular, with common workplace patterns (nine-to-five activity, no traffic in the weekends) Hybrid research/education/administration environment, so possibility of peculiar behaviors Traffic from February 2010

One Year of TCP Flows 40 flows [x1000] 20 0-20 -40 http smtp ssl/tsl unknown Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar

IP Traffic bitrate [Mbps] 150 100 50 0-50 -100-150 -200-250 tcp udp Bitrate Mon Tue Wed Thu Fri Sat Sun Mon 250 Flows flows [x1000] 200 150 100 50 0-50 -100-150 tcp udp -200 Mon Tue Wed Thu Fri Sat Sun Mon

IP Bitrate bitrate [Mbps] 150 100 50 0-50 -100-150 -200-250 tcp udp Mon Tue Wed Thu Fri Sat Sun Mon

IP Flows flows [x1000] 250 200 150 100 50 0-50 -100-150 -200 Mon Tue Wed Thu Fri Sat Sun Mon tcp udp

Chat Sessions flows 450 400 350 300 250 200 150 100 50 msn act msn pre xmpp act xmpp pre yahoo act yahoo pre 0 Mon Tue Wed Thu Fri Sat Sun Mon

Tracked Flows flows [x1000] 140 120 100 80 60 40 udp tcp 20 0 Mon Tue Wed Thu Fri Sat Sun Mon

CPU Load %cpu load 90 80 70 60 50 40 30 20 10 max system+user system+user avg system avg 0 Mon Tue Wed Thu Fri Sat Sun Mon

TCP Bitrate per Application 150 100 50 bitrate [Mbps] 0-50 -100-150 -200-250 http bit+obf ssl/tls ssh other unknown Mon Tue Wed Thu Fri Sat Sun Mon

HTTP Bitrate per Application 50 0 bitrate [Mbps] -50-100 -150-200 -250 http-get megaupload facebook -300 youtube rapidshare other Mon Tue Wed Thu Fri Sat Sun Mon

Conclusions Mature tool for network monitoring and analysis Always on the cutting edge, adapting to the changes in the Internet and to the research trends in networking outperform [other] signature based tools used in the literature (IMC 2009) Web site http://tstat.polito.it/

Frågor?

Tack!