Packet Traces Research Articles

Understanding Long Range-Frequency Hopping Spread Spectrum (LR-FHSS) with Real-World Packet Traces

Long Range-Frequency Hopping Spread Spectrum (LR-FHSS) is a new physical layer option that has been recently added to the LoRa family with the promise of achieving much higher network capacity than the previous versions of LoRa. In this article, we present our evaluation of LR-FHSS based on real-world packet traces collected with an LR-FHSS device and a receiver we designed and implemented in software. We overcame challenges due to the lack of documentation of LR-FHSS, and our study is the first of its kind that processes signals transmitted by an actual LR-FHSS device with practical issues such as frequency error. Our results show that LR-FHSS meets its expectations in communication range and network capacity. We also propose customized methods for LR-FHSS that improve its performance significantly, allowing our receiver to achieve higher network capacity than those reported earlier.

NetDiffusion: Network Data Augmentation Through Protocol-Constrained Traffic Generation

Datasets of labeled network traces are essential for a multitude of machine learning (ML) tasks in networking, yet their availability is hindered by privacy and maintenance concerns, such as data staleness. To overcome this limitation, synthetic network traces can often augment existing datasets. Unfortunately, current synthetic trace generation methods, which typically produce only aggregated flow statistics or a few selected packet attributes, do not always suffice, especially when model training relies on having features that are only available from packet traces. This shortfall manifests in both insufficient statistical resemblance to real traces and suboptimal performance on ML tasks when employed for data augmentation. In this paper, we apply diffusion models to generate high-resolution synthetic network traffic traces. We present NetDiffusion, a tool that uses a finely-tuned, controlled variant of a Stable Diffusion model to generate synthetic network traffic that is high fidelity and conforms to protocol specifications. Our evaluation demonstrates that packet captures generated from NetDiffusion can achieve higher statistical similarity to real data and improved ML model performance than current state-of-the-art approaches (e.g., GAN-based approaches). Furthermore, our synthetic traces are compatible with common network analysis tools and support a myriad of network tasks, suggesting that NetDiffusion can serve a broader spectrum of network analysis and testing tasks, extending beyond ML-centric applications.

NetDiffusion: Network Data Augmentation Through Protocol-Constrained Traffic Generation

Datasets of labeled network traces are essential for a multitude of machine learning (ML) tasks in networking, yet their availability is hindered by privacy and maintenance concerns, such as data staleness. To overcome this limitation, synthetic network traces can often augment existing datasets. Unfortunately, current synthetic trace generation methods, which typically produce only aggregated flow statistics or a few selected packet attributes, do not always suffice, especially when model training relies on having features that are only available from packet traces. This shortfall manifests in both insufficient statistical resemblance to real traces and suboptimal performance on ML tasks when employed for data augmentation. In this paper, we apply diffusion models to generate high-resolution synthetic network traffic traces. We present NetDiffusion1, a tool that uses a finely-tuned, controlled variant of a Stable Diffusion model to generate synthetic network traffic that is high fidelity and conforms to protocol specifications. Our evaluation demonstrates that packet captures generated from NetDiffusion can achieve higher statistical similarity to real data and improved ML model performance than current state-of-the-art approaches (e.g., GAN-based approaches). Furthermore, our synthetic traces are compatible with common network analysis tools and support a myriad of network tasks, suggesting that NetDiffusion can serve a broader spectrum of network analysis and testing tasks, extending beyond ML-centric applications.

RouteNet-Fermi: Network Modeling With Graph Neural Networks

Network models are an essential block of modern networks. For example, they are widely used in network planning and optimization. However, as networks increase in scale and complexity, some models present limitations, such as the assumption of Markovian traffic in queuing theory models, or the high computational cost of network simulators. Recent advances in machine learning, such as Graph Neural Networks (GNN), are enabling a new generation of network models that are data-driven and can learn complex non-linear behaviors. In this paper, we present RouteNet-Fermi, a custom GNN model that shares the same goals as Queuing Theory, while being considerably more accurate in the presence of realistic traffic models. The proposed model predicts accurately the delay, jitter, and packet loss of a network. We have tested RouteNet-Fermi in networks of increasing size (up to 300 nodes), including samples with mixed traffic profiles — e.g., with complex non-Markovian models — and arbitrary routing and queue scheduling configurations. Our experimental results show that RouteNet-Fermi achieves similar accuracy as computationally-expensive packet-level simulators and scales accurately to larger networks. Our model produces delay estimates with a mean relative error of 6.24% when applied to a test dataset of 1,000 samples, including network topologies one order of magnitude larger than those seen during training. Finally, we have also evaluated RouteNet-Fermi with measurements from a physical testbed and packet traces from a real-life network.

Using relational graphs for exploratory analysis of network traffic data

The human brain is designed to perceive the surrounding world as associations. These associations between the individual pieces of information allow us to analyze and categorize new inputs and thus understand them. However, the support for association-based analysis in traditional network analysis tools is only limited or not present at all. These tools are mostly based on manual browsing, filtering, and aggregation, with only basic support for statistical analyses and visualizations for communicating the general characteristics. Yet, it is the relationship diagram that could allow the analysts to get a broader context and reveal the associations hidden in the data. In this paper, we explore the possibilities of relational analysis as a novel paradigm for network forensics. We provide a set of user requirements based on the discussion with domain experts and introduce a novel visual analysis tool utilizing multimodal graphs for modeling relationships between entities from captured packet traces. Finally, we demonstrate the relational analysis process on two use cases and discuss feedback from domain experts.

Scaling by Learning: Accelerating Open vSwitch Data Path With Neural Networks

Open vSwitch (OVS) is a widely used open-source virtual switch implementation. In this work, we seek to scale up OVS to support hundreds of thousands of OpenFlow rules by accelerating the core component of its data-path -the packet classification mechanism. To do so we use NuevoMatch, a recent algorithm that uses neural network inference to match packets, and promises significant scalability and performance benefits. We overcome the primary algorithmic challenge of the slow rule updatetraining rate in the vanilla NuevoMatch, speeding it up by over three orders of magnitude. This improvement enables two design options to integrate NuevoMatch with OVS: (1) as an extra caching layer in front of OVS’s megaflow cache, and (2) using it to completely replace OVS’s data-path while performing classification directly on OpenFlow rules, and obviating control-path upcalls. Comprehensive evaluation on real-world packet traces and ClassBench rules demonstrates geometric mean speedups of 1.9 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times$</tex-math> </inline-formula> and 12.3 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times$</tex-math> </inline-formula> for the first and second designs, respectively, for 500K rules, with the latter also supporting up to 60K OpenFlow rule updates/second, by far exceeding the original OVS.

Enhancing Network Performance Tomography in Software-Defined Cloud Network

For cloud network performance profiling, network tomography based on end-to-end measurement is often used in deducing the network performance for its efficiency. However, most tomography problems are under-constrained, which require additional assumptions or probing monitors planted among network switches, which are often unavailable in software-defined networking (SDN) environment. On the other hand, SDN-based flow mirroring could provide accurate flow information, but the cost of both gathering and analysing the packet traces is tremendous that it is impossible to cover the whole network. We propose ScoutFlow, a method combining SDN flow measurement and end-to-end performance tomography, to achieve accurate performance profiling for cloud network while keeping low monitoring overhead. We evaluate ScoutFlow in our campus data center cloud, and the experiment shows good scalability and accuracy.

RuleOut Forwarding Anomalies for SDN

Reliable Software-Defined Networking (SDN) should mitigate forwarding anomalies due to cross-plane rule inconsistencies. Most existing countermeasures either inject probe packets to infer forwarding correctness or collect packet traces to detect forwarding anomalies. They, however, cannot detect or filter forwarding anomalies for production packets in real time. In this paper, we propose RuleOut as the first attempt to automatically throttle SDN forwarding anomalies. It disambiguates dependent rules via augmenting their matching fields with unique tags. Leveraging source routing, we further bind each packet with the tag sequence corresponding to rules the packet should match. RuleOut thus renders each packet to match at most one rule on each switch. This completely addresses the root cause of forwarding ambiguity. To implement RuleOut, we develop a non-overlapping rule dependency graph, a series of algorithms for incremental rule update and tag generation upon it, and various optimization techniques toward scalability and efficiency. We prototype RuleOut on the Ryu controller and Open vSwitch and evaluate its performance over public rule sets such as Stanford, Internet2, and Airtel1. RuleOut can use tags of only several bits long to disambiguate thousands to millions of rules and generate tags fairly fast within a few milliseconds.

Characterizing Privacy Leakage in Encrypted DNS Traffic

Increased demand for DNS privacy has driven the creation of several encrypted DNS protocols, such as DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ). Recently, DoT and DoH have been deployed by some vendors like Google and Cloudflare. This paper addresses privacy leakage in these three encrypted DNS protocols (especially DoQ) with different DNS recursive resolvers (Google, NextDNS, and Bind) and DNS proxy (AdGuard). More particularly, we investigate encrypted DNS traffic to determine whether the adversary can infer the category of websites users visit for this purpose. Through analyzing packet traces of three encrypted DNS protocols, we show that the classification performance of the websites (i.e., user's privacy leakage) is very high in terms of identifying 42 categories of the websites both in public (Google and NextDNS) and local (Bind) resolvers. By comparing the case with cache and without cache at the local resolver, we confirm that the caching effect is negligible as regards identification. We also show that discriminative features are mainly related to the inter-arrival time of packets for DNS resolving. Indeed, we confirm that the F1 score decreases largely by removing these features. We further investigate two possible countermeasures that could affect the inter-arrival time analysis in the local resolver: AdBlocker and DNS prefetch. However, there is no significant improvement in results with these countermeasures. These findings highlight that information leakage is still possible even in encrypted DNS traffic regardless of underlying protocols (i.e., HTTPS, TLS, QUIC).

A General Approach for Traffic Classification in Wireless Networks Using Deep Learning

Traffic Classification (TC) systems allow inferring the application that is generating the traffic being analyzed. State-of-the-art TC algorithms are based on Deep Learning (DL) and have outperformed traditional methods in complex and modern scenarios, even if traffic is encrypted. Most of the works on TC assume the traffic flows on a wired network under the same network management domain. This assumption limits the capabilities of TC systems in wireless networks since users’ traffic on one network domain can be negatively impacted by undetected users’ traffic from other network domains or detected ones but with no traffic context in a shared spectrum. To solve this problem, we introduce a novel framework to achieve TC at any layer on the radio network stack. We propose a spectrum-based procedure that uses a DL-based classifier to realize this framework. We design two DL-based classifiers, a novel Convolutional Neural Network (CNN) spectrum-based TC and a Recurrent Neural Networks (RNN) as baseline architecture, and benchmark their performance on three TC tasks at different radio stack layers. The datasets were generated by combining packet traces from real transmissions with an 802.11 standard-compliant waveform generator. Performance evaluations show that the best model can achieve an accuracy above 92% in the most demanding TC task, a drop of only 4.37% in accuracy compared to a byte-based DL approach, with micro-second per-packet prediction time, which is very promising for delivering real-time spectrum-based traffic analyzers.

Flow Entry Timeouts Optimization over Software Defined Networks Supporting Elephant Flow Classification

&lt;p&gt;Elephant flow (elephant) classification is significant for network performance management and resource optimization. Classifying elephants over Software Defined Networks (SDNs) often relies on statistics counted by switches and transferred to controllers, leading to a huge control channel bandwidth occupation that degrades network latency and user experience. Classifying elephants using flow packets forwarded to controllers completely avoids moving statistics from switches to controllers, but couples flow entry timeouts to elephant classification accuracy, time efficiency, flow table size, control channel bandwidth usage, and network latency. This paper aims to find the best flow entry timeouts to optimize the objectives by modeling the objectives and formulating a multi-objective optimization problem. The number of objectives is further reduced to 3 and the problem is solved by Machine Learning (ML) approaches. Extensive evaluations are made over real packet traces. To the best of our knowledge, this work is the first effort that explores all the objectives related to flow entry timeouts when using flow packets forwarded to controllers to classify elephants over SDNs.&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt;

Data-Driven Network Path Simulation with iBox

While network simulation is widely used for evaluating network protocols and applications, ensuring realism remains a key challenge. There has been much work on simulating network mechanisms faithfully (e.g., links, buffers, etc.), but less attention on the critical task of configuring the simulator to reflect reality. We present iBox ("Internet in a Box"), which enables data-driven network path simulation, using input/output packet traces gathered at the sender/receiver in the target network to create a model of the end-to-end behaviour of a network path. Our work builds on recent work in this direction [2, 6] and makes three contributions: (1) estimation of a lightweight non-reactive cross-traffic model, (2) estimation of a more powerful reactive cross-traffic model based on Bayesian optimization, and (3) evaluation of iBox in the context of congestion control variants in an Internet research testbed and also controlled experiments with known ground truth. This paper represents an abridged version of [3].

Network Traffic Shaping for Enhancing Privacy in IoT Systems

Motivated by traffic analysis attacks based on the packet sizes and timing information in the Internet of Things (IoT) networks, we establish a rigorous event-level differential privacy (DP) model on infinite packet streams. We propose a traffic shaper satisfying a first-come-first-served queuing discipline that outputs traffic dependent on the input using a DP mechanism. We show that in special cases the proposed mechanism recovers existing shapers which standardize the output independently from the input. To find the optimal shapers for given levels of privacy and transmission efficiency, we formulate the constrained problem of minimizing the expected delay per packet and propose using the expected queue size across time as a proxy. We further show that the constrained minimization is a convex program. We demonstrate the effect of shapers on both synthetic data and packet traces from actual IoT devices. The experimental results reveal inherent privacy-overhead tradeoffs: more shaping overhead provides better privacy protection. Under the same privacy level, there is a tradeoff between dummy traffic and delay. When shaping heavier or less bursty traffic, all shapers become more overhead-efficient. We also show that increased traffic from more IoT devices makes guaranteeing event-level privacy easier. The DP shaper offers tunable privacy that is invariant with the change in the input traffic distribution and has an advantage in handling burstiness over traffic-independent shapers. This approach accommodates heterogeneous network conditions and user demands in privacy and overhead.

Adaptive One Memory Access Bloom Filters

Bloom filters are widely used to perform fast approximate membership checking in networking applications. The main limitation of Bloom filters is that they suffer from false positives that can only be reduced by using more memory. We suggest to take advantage of a common repetition in the identity of queried elements to adapt Bloom filters for avoiding false positives for elements that repeat upon queries. In this paper, one memory access Bloom filters are used to design an adaptation scheme that can effectively remove false positives while completing all queries in a single memory access. The proposed filters are well suited for scenarios on which the number of memory bits per element is low and thus complement existing adaptive cuckoo filters that are not efficient in that case. The evaluation results using packet traces show that the proposed adaptive Bloom filters can significantly reduce the false positive rate in networking applications with the single memory access. In particular, when using as few as four bits per element, false positive rates below 5% are achieved.

Asynchronous Federated Learning for Elephant Flow Detection in Software Defined Networking Systems

This paper introduces an Asynchronous Federated Learning (AFL) approach to train an elephant flow model over Software Defined Networking (SDN) systems with distributed controllers. The AFL addresses the issues of data privacy and communication overhead in collecting network statistics over large-scaled SDN systems. It allows each local controller to train a local model based on its local statistics using Decision Tree and upload the local model to the root in an asynchronous manner, so that the root controller can aggregate each local model into a global model once a local model is received to improve its time efficiency. The AFL proposes to weight the performance of each local model to form the global model. The evaluation based on 5 real packet traces demonstrates the accuracy of the AFL is better than any local models and two classical federated learning approaches.

Data-Driven Network Path Simulation with iBox

While network simulation is widely used for evaluating network protocols and applications, ensuring realism remains a key challenge. There has been much work on simulating network mechanisms faithfully (e.g., links, buffers, etc.), but less attention on the critical task of configuring the simulator to reflect reality. We present iBox ("Internet in a Box"), which enables data-driven network path simulation, using input/output packet traces gathered at the sender/receiver in the target network to create a model of the end-to-end behaviour of a network path. Our work builds on recent work in this direction and makes three contributions: (1) estimation of a lightweight non reactive cross-traffic model, (2) estimation of a more powerful reactive cross-traffic model based on Bayesian optimization, and (3) evaluation of iBox in the context of congestion control variants in an Internet research testbed and also controlled experiments with known ground truth.

T-Cache: Efficient Policy-Based Forwarding Using Small TCAM

Ternary Content Addressable Memory (TCAM) is widely used by modern routers and switches to support policy-based forwarding due to its incomparable lookup speed and flexible matching patterns. However, the limited TCAM capacity does not scale with the ever-increasing rule table size due to the high hardware cost and high power consumption. At present, using TCAM just as a rule cache is an appealing solution, but one must resolve several tricky issues including the rule dependency and the associated TCAM updates. In this paper, we propose a new approach which can generate dependency-free rules to cache. By removing the rule dependency, the complex TCAM update problem also disappears. We provide the complete T-cache system design including slow path processing and cache replacement, and implement a T-cache prototype on Barefoot Tofino switches. We conduct comprehensive software simulations and hardware experiments based on real-world and synthesized rule tables and packet traces to show that T-cache is efficient and robust for network traffic in various scenarios.

A Network Analysis on Cloud Gaming: Stadia, GeForce Now and PSNow

Cloud gaming is a class of services that promises to revolutionize the videogame market. It allows the user to play a videogame with essential equipment while using a remote server for the actual execution. The multimedia content is streamed through the network from the server to the user. Hence, this service requires low latency and a large bandwidth to work properly with low response time and high-definition video. Three of the leading tech companies (Google, Sony, and NVIDIA) entered this market with their products, and others, like Microsoft and Amazon, are also launching their platforms. However, these companies have released little information about their cloud gaming operation and how they utilize the network. In this work, we study cloud gaming services from the network point of view. We collect more than 200 packet traces under different application settings and network conditions from a broadband network to poor mobile network conditions, for 3 cloud gaming services, namely Stadia from Google, GeForce Now from NVIDIA and PS Now from Sony. We analyze the employed protocols and the workload that they impose on the network. We find that GeForce Now and Stadia use the RTP protocol to stream the multimedia content, with the latter relying on the standard WebRTC APIs. Depending on the network and video quality, they result in bandwidth-hungry services consuming up to 45 Mbit/s. PS Now instead uses only undocumented protocols and never exceeds 13 Mbit/s. 4G mobile networks can often sustain these loads, while traditional 3G connections struggle. The systems quickly react to deteriorated network conditions, and packet losses up to 5% do not cause a reduction in resolution.

Jamming detection at the edge of drone networks using Multi-layer Perceptrons and Decision Trees

As wireless networks play an increasingly key role in everyday life, it is necessary to secure them from radio frequency attacks, such as jamming, which are hard to detect, especially because they may be easily mistaken for other network conditions. Within this challenging context, the paper proposes a framework for jamming detection in drone networks, relying on a distributed approach based on supervised machine learning techniques, namely, Multi-layer Perceptrons and Decision Trees. Given a reference data packet trace set, our framework computes the features of some predefined metrics, such as throughput, PDR and RSSI, which vary during a jamming attack, and that can therefore be used to detect it. We evaluate our framework using datasets from publicly available standardized jamming attack scenarios with IEEE 802.11p radio data, and via ns3-based simulation datasets from networks of drones using WiFi. We show that the performance of the classifiers improves as the sampling time of the packets decreases. We also show that the Multi-layer Perceptron can be effectively generalized to achieve jamming detection accuracy superior to that of Decision Trees even when applied to communication scenarios for which it has not been specifically trained. Our proposed framework reaches a satisfactory accuracy level of 96%, while requiring low computational and hardware capabilities, thus proving to be suitable for resource-constrained drone networks.

Lab Implementation of IPv6 in Enterprise NetworkUsing Cisco Packet Tracer

As technology is growing fast, using technologies is also increasing because the previous technologies cannot support the new requirements. In this case, every company is trying to implement newly released technologies. As IPv4 was introduced, it has been used for a long time in networking. But now, the limitations of IPv4 are too much, such as address limitation, subnet-ting with complex structure, inefficient NAT employment. This is why IPv4 is not considered to be used anymore. Because of IPv4 problems, the IPv6 protocol is designed and developed to overcome IPv4 limitations. The efficiency of IPv6 is more in packet processing, and routing pro-vides a simple network configuration and improves the QoS by decreasing latency in the time of the data packet transformation. As IPv6 has many features and new supported services.&#x0D; With the emergence of IPv6, any enterprise companies are interested in implementing IPv6 in the enterprise network. An enterprise network includes protocols, virtual and physical networks that connect all systems and users on a LAN, and all applications in the cloud and data center. The main purpose of this research is to implement ipv6in the enterprise network. We used the latest version of the Cisco packet Tracer for simulation purposes. Cisco packet Trace can simulate necessary routing using EIGRPv6, OSPVv3, and RIPng and application layer protocols.