AutoFocus: A Tool for Automatic Traffic Analysis Cristian Estan, University of California, San Diego

October 2003AutoFocus - NANOG 292 Who is using my link?

October 2003AutoFocus - NANOG 293 Informal problem definition Gigabytes of measurement data Analysis Traffic reports Applications: 50% of traffic is Kazaa Sources: 20% is from Steve’s PC

October 2003AutoFocus - NANOG 294 Informal problem definition Gigabytes of measurement data 20% is Kazaa from Steve’s PC 50% is Kazaa from network A Analysis Traffic reports

October 2003AutoFocus - NANOG 295 AutoFocus: system structure Traffic parser Web based GUI Traffic analyzer Grapher (sampled) NetFlow data or Packet header traces categories names

October 2003AutoFocus - NANOG 296 System details l Availability u Downloadable u Free for educational, research and non-profit use l Requirements u Linux or BSD (might run on other Unix OSes) u 256 Megs of RAM at least u 1-10 gigabytes of hard disk (depends on traffic) u Recent Netscape, Mozilla or I.E. (Javascript) u Needs no web server – no server side scripting

October 2003AutoFocus - NANOG 297 Traffic analysis approach l Characterize traffic mix by describing all important traffic clusters u Multi-field clusters (e.g. flash crowd described by protocol, port number and IP address) u At the the right level of granularity (e.g. computer, proper prefix length) u Analysis is automated – finds insightful data without human guidance

October 2003AutoFocus - NANOG 298 Traffic clusters: example l Incoming web traffic for CS Dept. u SrcIP=*, u DestIP in /21, u Proto=TCP, u SrcPort=80, u DestPort in [1024,65535]

October 2003AutoFocus - NANOG 299 l Traffic reports automatically list significant traffic clusters l Describe only clusters above threshold (e.g. T=total of traffic/20) l Compression removes redundant clusters whose traffic can be inferred from more specific clusters Traffic report

October 2003AutoFocus - NANOG 2910 Automatic cluster selection / / / / / / / / / / / /30

October 2003AutoFocus - NANOG 2911 Automatic cluster selection / / / / / / / / / / Threshold= / /30

October 2003AutoFocus - NANOG Automatic cluster selection / / / / / Compression keeps interesting clusters by removing those that can be inferred from more specific ones < ≥100

October 2003AutoFocus - NANOG 2913 Single field report example Source IPTraffic pkts / / AutoFocus has both single field and multi-field traffic reports

October 2003AutoFocus - NANOG 2914 Graphical user interface l Web based interface l Many pre-computed traffic reports l Interactive drill-down l Traffic categories defined by user

October 2003AutoFocus - NANOG 2915 Traffic reports for weeks, days, three hour intervals and half hour intervals

October 2003AutoFocus - NANOG 2916 Traffic reports measure traffic in bytes, packets and flows, have various thresholds

October 2003AutoFocus - NANOG 2917 Single field report

October 2003AutoFocus - NANOG 2918

October 2003AutoFocus - NANOG 2919 Colors – user defined traffic categories Separate reports for each category

October 2003AutoFocus - NANOG 2920 The filter and threshold allow interactive drill-down

October 2003AutoFocus - NANOG 2921 The filter and threshold allow interactive drill-down

October 2003AutoFocus - NANOG 2922 The filter and threshold allow interactive drill-down

October 2003AutoFocus - NANOG 2923 Case study : SD-NAP l Structure of regular traffic mix u Backups from CAIDA to tape server u FTP from SLAC Stanford u Scripps web traffic u Web & Squid servers u Large ssh traffic u Steady ICMP probing from CAIDA l Unexpected events

October 2003AutoFocus - NANOG 2924 l Backups from CAIDA to tape server Structure of regular traffic mix SD-NAP

October 2003AutoFocus - NANOG 2925 l Backups from CAIDA to tape server u Semi-regular time pattern Structure of regular traffic mix SD-NAP

October 2003AutoFocus - NANOG 2926 l Steady ICMP probing from CAIDA Structure of regular traffic mix SD-NAP The flow view highlights different traffic clusters

October 2003AutoFocus - NANOG 2927 Analysis of unusual events l Sapphire/SQL Slammer worm u Find worm port & proto automatically

October 2003AutoFocus - NANOG 2928 Analysis of unusual events l Sapphire/SQL Slammer worm u Can identify infected hosts

October 2003AutoFocus - NANOG 2929 How can AutoFocus help you? l Understand your regular traffic mix better u Better planning of network growth u Better traffic policing l Understand unusual events u More effective reactions to worms, DoS attacks u Notice effects of route changes on traffic

October 2003AutoFocus - NANOG 2930 Benefits w.r.t. existing tools l Multi-field aggregation l Automatically finds right granularity l Drill-down u Per category reports u Using filter

October 2003AutoFocus - NANOG 2931 Thank you! Beta version of AutoFocus downloadable from Any questions? Acknowledgements: Stefan Savage, George Varghese, Vern Paxson, David Moore, Liliana Estan, Mike Hunter, Pat Wilson, Jennifer Rexford, K Claffy, Alex Snoeren, Geoff Voelker, NIST,NSF

October 2003AutoFocus - NANOG 2932

October 2003AutoFocus - NANOG 2933 Definition: unexpectedness l To highlight non-obvious traffic clusters by using unexpectedness label u 50% of all traffic is web u Prefix B receives 20% of all traffic u The web traffic received by prefix B is 15% instead of 50%*20%=10%, unexpectedness label is 15%/10%=150%