Transport layer identification of P2P traffic Victor Gau Yi-Hsien Wang

Reference Transport layer identification of P2P traffic. Proc. of the 4th ACM SIGCOMM Conf. on Internet Measurement pp Thomas Karagiannis (UC Riverside) Andre Broido (CAIDA, SDSC) Michalis Faloutsos (UC Riverside) Kc Claffy (CAIDA, SDSC)

P2P Traffic Profiling (PTP) Features Flow patterns and characteristics of P2P behavior No examination of user payload Effectiveness (compared to payload analysis) 99% of P2P flows More than 95% of P2P bytes False positives: <10%.

P2P Traffic Profiling (PTP) Capable of identifying P2P flows missed by payload analysis Identifying approximately 10% additional P2P flows over payload analysis HTTP requests Encryption Other P2P protocols Unidirectional traces

Characteristic Bit Strings of P2P Packet Format

Methodology Based on the five-tuple key {source IP, destination IP, protocol, source port, destination port} and 64-second flow timeout, examine two primary heuristics: TCP/UDP IP pairs {IP, port} pairs

TCP/UDP IP Pairs Look for pairs of source-destination hosts that use both TCP and UDP, Excluding

{IP, Port} Pairs for the advertised destination {IP, port} pair of host A, the number of distinct IPs connected to host A will be equal to the number of distinct ports used to connect to host A. 2 IPs = 2 Ports {B, 15} {C, 10}

Exclusion For HTTP server, a client will initiate usually more than one concurrent connection in order to download objects in parallel. A higher ratio of the number of distinct ports versus number of distinct IPs 4 ports / 2 IPs = 2 {B, 15} {B, 30} {C, 10} {C, 20}

Evaluation CAIDA’s Backbone Data Kit (BDK), consisting of packet traces captured at an OC-48 link of a Tier 1 US ISP connecting POPs from San Jose, California to Seattle, Washington.

Method Captured 44 bytes of each packet, which includes IP and TCP/UDP headers and an initial 4 bytes of payload for some packets. approximately 60%-80% of the packets with an extra 4-byte MPLS label capture the February and April 2004 traces (D11 and D13) with 16 bytes of TCP/UDP payload which allows us to evaluate our non- payload methodology.

Combine and cross-validate identification methods fixed ports signature-based payload analysis transport layer dynamics

htm