Subject: RE: [IMRG] Measurement TCPs

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Sun, 15 Sep 2002 15:45:31 -0500

> > However, I am not convinced that measurement repositories are an
> > absolute necessaity for good science.

I guess, Our discussion is not on the same page. 

1. Measurement repositories for sharing of Data.      
2. Submission of both traces along with the paper.    
3. Repeatability
4. Release of raw data  

Last three may not be possible or not necessary. But, we should 
still discuss the first one. We should take it a part of our work 
and as said by Brian Tierney, we can even get some pointers from 
grid systems research for working on a scalable repository.

> so why do you think people would be interested in the raw 
> data i used for
> my work. 99.9% of the times it is not to do what i did with 
> it - that way
> they cannot publish unless they prove me wrong. its not 
> repeatability the
> world (at least not our community, i feel)  cares about.

I accept your point. It is more applicable to research involving
simulations.
 
> i think the real value of raw data lies in the fact that 
> different people
> would be able to do different things with it. data ends up 
> being used in
> various ways that original collectors never imagined. look at 
> route-views
> - who would have imagined all the uses it is being put to now. 

Your statement holds ONLY for BGP data, which is publicly available.

As a side note, researh on DNS measurements is on progress in some 
research labs. But, I remember, 52 IETF had a BOF regarding this issue
but later concluded that it will be a research effort rather than a 
standardization work. I presume, lot have to be explored in this side.
Will this group work on some of these issues too?
_______________________________________________
IMRG mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/imrg

---

From: Mark Allman <[email-masked]>
Date: Sun, 15 Sep 2002 23:20:41 -0400

> As a side note, researh on DNS measurements is on progress in
> some=20 research labs. But, I remember, 52 IETF had a BOF
> regarding this issue but later concluded that it will be a
> research effort rather than a=20 standardization work. I presume,
> lot have to be explored in this side.  Will this group work on
> some of these issues too?

My understanding of the DNSmeas BOF is that noting gelled together
afer the BOF.  The work would certainly be within the scope of the
charter for this RG, I think.  However, I will not presume to speak
for the IRTF chair on whether another group should/would be formed
to deal specifically with DNS measurement.  So,

I would encouarge anyone interested to start a discussion and/or let
me know and we can think about pursuing it within this RG.

And, I would invite the IRTF chair to fill in the current thinking
on this topic.

Thanks,
allman

--
Mark Allman -- NASA GRC/BBN -- http://roland.grc.nasa.gov/~mallman/
_______________________________________________
IMRG mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/imrg

---

From: Remco van de Meent <[email-masked]>
Date: Mon, 16 Sep 2002 17:55:19 +0200

> 2. Submission of both traces along with the paper.    

One of the issues with releasing raw data is privacy of users.

I'm wondering if people out there have standard tools or algorithms for
anonymization of packet traces? Preferably while keeping the tcpdump
file format?

regards,
Remco.

---

From: adg <[email-masked]>
Date: Mon, 16 Sep 2002 19:04:33 +0200

> anonymization of packet traces? Preferably while keeping the tcpdump

Greg Minshall at Ipsilon Networks developed in 1996 an utility called
tcpdpriv. It permit to hide payloads and scramble addresses (using
pcap to process tcpdump output files).

ciao,
alfonso

---

From: Ethan Blanton <[email-masked]>
Date: Mon, 16 Sep 2002 13:23:37 -0500

> anonymization of packet traces? Preferably while keeping the tcpdump

I can't claim it's standard, or even that anyone but a few people at
Ohio University use it, but I have a simple tool at
http://irg.cs.ohiou.edu/~eblanton/tcpurify/ that is intended to do
just this.  The anonymization algorithm currently distributed with it
is, unfortunately, too weak for many uses; I have plans for several
more powerful algorithms, but they are all held up by either
intellectual property (who patents crypto? :-P) or computational
complexity issues.  In the miraculous chance that I should get some
free time, some strong-crypto-based anonymization methods will be
going in there.

At any rate, in the meantime it is a simple-to-use framework if
nothing else.
Ethan

-- 
And if I claim to be a wise man / it surely means that I don't know.
                -- Kansas, "Carry on Wayward Son"

---

From: Kenjiro Cho <[email-masked]>
Date: Tue, 17 Sep 2002 14:30:58 +0900 (JST)

> pcap to process tcpdump output files).

FYI:
The WIDE Poject is maintaining a public traffic repository at
http://mawi.wide.ad.jp/mawi/

A modified version of tcpdpriv (to support IPv6) is used to remove
privacy info from traces.
The repository contains tcpdump data files from the WIDE backbone for
the last 3 years, and the total data size is about 200GB.

-Kenjiro

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 17 Sep 2002 08:31:45 -0400

My current list of traces is at 
http://www.cs.columbia.edu/~hgs/internet/traces.html

Corrections and additions are appreciated.

---

From: Mark Allman <[email-masked]>
Date: Mon, 30 Sep 2002 13:13:10 -0400

> I'm wondering if people out there have standard tools or
> algorithms for anonymization of packet traces? Preferably while
> keeping the tcpdump file format?

I'm offline and can't look up the exact papers right now, but there
are a couple of nice papers from last year's SIGCOMM Internet
Measurement Workshop that offer solutions to this problem.

allman