Analysis of Internet Backbone Traffic and Header Anomalies Observed Wolfgang John and Sven Tafvelin Dept. of Computer Science and Engineering Chalmers University of Technology Göteborg, Sweden

IMC 2007 Overview 1.Introduction 2.Traffic properties IP properties TCP properties 3.Header anomalies 4.Conclusions

IMC 2007 Introduction: Measurement location Internet Regiona l ISPs Göteborg Stockholm Other smaller Univ. and Institutes Göteborgs Univ. Student- Net 2x 10 Gbit/s (OC-192) 2x DAG6.2SE Cards capturing headers only IP addresses anonymized Chalmers Univ.

IMC 2007 Traffic Properties Data from 20 days in April x74 traces, 7.5 TB billion frames 99.97% IPv4 packets PacketsData TCP92.0 % %.. UDP7.6 %..2.6 %.. ICMP0.2 %..0.1 %.. ESP, GRE0.2 %..0.1 %.

IMC 2007 Traffic Properties (2) Packet size distribution (former) default: 576 bytes 1300 bytes 628 bytes

IMC 2007 Traffic Properties: IP IP properties –No IP options (only 68 instances) –91.3% set DF bit –TOS: 0.02% ECN enabled packets

IMC 2007 Traffic Properties: IP (2) IP fragmentation rare (0.06%) 90% of fragmented packets incoming –97% UDP 10% outgoing –63% ESP, between 1 pair of hosts –VPN header causes fragmentation 72% of the fragmented traffic during office hours (10AM, 2PM)

IMC 2007 Traffic Properties: TCP TCP options in SYN segments TCP options values –MSS: from 0 to % (Ethernet max.) –WS: scale factors up to 14 58% scale factor zero 31% scale factor 2 MSSSACK perm.WSTS 99.2 %89.9 %17.9 %14.5 %

IMC 2007 Header Anomalies 10.7 billion IP packets 9.8 billion TCP segments

IMC 2007 Summary and Conclusions Updated packet-level characteristics of Internet traffic Inconsistencies in headers will appear –Network attacks and malicious traffic –Active OS fingerprinting –Buggy applications or protocol stacks

Thank you very much for you attention! Questions?