{"id":2061,"date":"2013-01-17T11:20:49","date_gmt":"2013-01-17T18:20:49","guid":{"rendered":"http:\/\/blog.caida.org\/best_available_data\/?p=2061"},"modified":"2013-01-17T16:11:55","modified_gmt":"2013-01-17T23:11:55","slug":"packet-loss-metrics-from-darknet-traffic","status":"publish","type":"post","link":"https:\/\/blog.caida.org\/best_available_data\/2013\/01\/17\/packet-loss-metrics-from-darknet-traffic\/","title":{"rendered":"Packet Loss Metrics from Darknet Traffic"},"content":{"rendered":"<p>At the <a href=\"http:\/\/conferences.sigcomm.org\/co-next\/2012\/workshops\/student\/index.html\">CoNEXT Student Workshop<\/a>, in Nice, France on December 10, 2012, CAIDA shared recent research on Internet outages in a poster entitled &#8220;Gaining Insight Into AS-Level Outages through Analysis of Internet Background Radiation.&#8221;<\/p>\n<p><!--more--><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/www.caida.org\/publications\/posters\/eps\/dals-2012-dec-packetloss-poster.pdf\"><img loading=\"lazy\" class=\"aligncenter size-full wp-image-2080\" style=\"border: 1px solid black;\" title=\"dals-2012-dec-packetloss-poster\" src=\"http:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/dals-2012-dec-packetloss-poster.png\" alt=\"\" width=\"206\" height=\"291\" srcset=\"https:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/dals-2012-dec-packetloss-poster.png 429w, https:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/dals-2012-dec-packetloss-poster-212x300.png 212w\" sizes=\"(max-width: 206px) 100vw, 206px\" \/><\/a><\/p>\n<p>An initial task of our NSF-funded <a href=\"http:\/\/www.caida.org\/funding\/dals-satc\/\">DALS SaTC<\/a> project is to refine and extend indicators to support real-time detection and rapid characterization of Internet connectivity outage events. We used several darknet-based metrics in our studies of\u00a0<a href=\"http:\/\/www.caida.org\/publications\/papers\/2011\/outages_censorship\/\">country-wide censorship\u00a0<\/a>and the <a href=\"http:\/\/www.caida.org\/publications\/papers\/2012\/extracting_benefit_from_harm\/\">impact of political and geophysical events<\/a>.  This latest metric\u00a0characterizes the number of TCP SYN packets sent from selected networks to the UCSD Network Telescope, to help determine whether packet loss (e.g., because of congestion) is associated with the outage. \u00a0Since the UCSD Network Telescope receives traffic sent to unassigned IP addresses but does not respond, TCP connection attempts are comprised of only SYN packets. Conficker-like packets comprise the vast majority of these packets, known as Internet Background Radiation. \u00a0Conficker-infected hosts <a href=\"http:\/\/www.caida.org\/research\/security\/ms08-067\/conficker.xml\">are known to send two SYN packets per connection attempt<\/a>, a consistent behavior that allows us to infer packet loss when the number of packets per connection attempt decreases for this type of traffic.<\/p>\n<p>The poster highlights two case studies. In the <a href=\"http:\/\/bgpmon.net\/?p=554\">&#8220;Dodo-Telstra&#8221; Routing Leakage<\/a>, caused by a BGP leak, the metric\u00a0\u03b3 decreases significantly, consistent with a bottleneck\u00a0preceding the outage.<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/telstra_poster.png\"><img loading=\"lazy\" class=\"aligncenter size-full wp-image-2083\" title=\"telstra_poster\" src=\"http:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/telstra_poster.png\" alt=\"\" width=\"346\" height=\"194\" srcset=\"https:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/telstra_poster.png 540w, https:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/telstra_poster-300x167.png 300w\" sizes=\"(max-width: 346px) 100vw, 346px\" \/><\/a><\/p>\n<p>However, during the Libyan Internet Blackout of 2011, <a href=\"http:\/\/www.caida.org\/publications\/papers\/2011\/outages_censorship\/outages_censorship.pdf\">where the Libyan government used packet filtering to implement country wide censorship<\/a>, the value of\u00a0\u00a0\u03b3 did not change when a few hosts were allowed through the &#8220;firewall&#8221;. \u00a0This behavior is consistent with filtering decreasing the number of sources sending traffic without changing its per-flow characteristics.<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/libya_poster.png\"><img loading=\"lazy\" class=\"aligncenter size-full wp-image-2084\" title=\"libya_poster\" src=\"http:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/libya_poster.png\" alt=\"\" width=\"340\" height=\"190\" srcset=\"https:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/libya_poster.png 540w, https:\/\/blog.caida.org\/best_available_data\/wp-content\/uploads\/2013\/01\/libya_poster-300x167.png 300w\" sizes=\"(max-width: 340px) 100vw, 340px\" \/><\/a><\/p>\n<p>Our poster was voted as one of the top 8 of the student workshop; these 8 were presented at the main CoNEXT conference.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>At the CoNEXT Student Workshop, in Nice, France on December 10, 2012, CAIDA shared recent research on Internet outages in a poster entitled &#8220;Gaining Insight Into AS-Level Outages through Analysis of Internet Background Radiation.&#8221;<\/p>\n","protected":false},"author":16,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,10],"tags":[],"coauthors":[],"_links":{"self":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts\/2061"}],"collection":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/comments?post=2061"}],"version-history":[{"count":27,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts\/2061\/revisions"}],"predecessor-version":[{"id":2105,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts\/2061\/revisions\/2105"}],"wp:attachment":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/media?parent=2061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/categories?post=2061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/tags?post=2061"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/coauthors?post=2061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}