Subject: Re: [IMRG] Measurement TCPs

From: Vern Paxson <[email-masked]>
Date: Mon, 16 Sep 2002 09:51:11 -0700

> If we want repeatability, then having the raw data can be very useful.
> Any group that wants to do something related, can re-use the old data to
> calibrate their code and verify the old result.  If the result is the
> same, then this adds to the credibility of the new results, if the old
> result cannot be reproduced, there is a problem which then has to be
> investigated.

There's another significant utility to having access to the raw data and
analysis programs/scripts, which is that they allow you to understand what
exactly a particular number/plot/finding means.  Sometimes it's simply not
clear from a paper just what precisely was analyzed; if the code or scripts
are comprehensible (not always the case!), then you can figure it out.
Even without the code/scripts, you can use the raw data to generate what
you *think* the paper reports, and see if you can get it.

		Vern
_______________________________________________
IMRG mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/imrg

---

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Mon, 30 Sep 2002 14:13:07 -0500

> > One of the issues with releasing raw data is privacy of users.
> > 
> > I'm wondering if people out there have standard tools or
> > algorithms for anonymization of packet traces? Preferably while
> > keeping the tcpdump file format?

Minshall's tcpdpriv is commonly used anonymizer to remove privacy information
from tcpdump raw data. It requires a basic lidpcap utility. I dont know 
how much the prefix preserving anonymization serves the purpose. It is the 
standard tool used both by WIDE and NLANR for anonymizing their traces. 
It had some problems with -A50 option but dont know whether they have 
fixed now.

http://ita.ee.lbl.gov/html/contrib/tcpdpriv.html 

Some other related tools: 
http://ita.ee.lbl.gov/html/contrib/sanitize.html
http://irg.cs.ohiou.edu/~eblanton/tcpurify/

People also use MD5 message digest algorithms.

> there are a couple of nice papers from last year's SIGCOMM Internet
> Measurement Workshop that offer solutions to this problem.

Jun Ju et all.,"On the Design and Performance of PrefixPreserving IP 
Traffic Trace Anonymization ," Proceedings of IMW-2001.
http://www.icir.org/vern/imw-2001/imw2001-papers/69.pdf
( It uses a crypto-based solution to allow tcpdpriv use in a large
 scalable system.)

Markus Peuhkuri., "A Method to Compress and Anonymize Packet Traces,"
proceedings of IMW-2001.
http://www.icir.org/vern/imw-2001/imw2001-papers/32.pdf
( It used data compression technique to not only save space but also
anonimize prefix)