WITS: Auckland VI

Trace Format Some traces are Legacy ATM, others are Legacy Ethernet
Volume on Disk 17 GB
Number of Traces 80
Capture Start (Local) Thu May 10 16:23:11 2001
Capture End (Local) Wed Jun 13 08:54:05 2001
Total Duration 4 Days, 14 Hours, 54 Minutes and 49 Seconds
Packets Captured 844 million
Total Traffic 345 GB
Contiguity Contiguous, aside from the single trace taken in May when the DMZ was 10Mbps
Snapping Method Fixed-length 64 byte truncation.
Rotation Policy 6-hourly rotation based on Midnight local time
Anonymization IP addresses replaced using one-to-one mapping into 10.*.*.* address space. Any payload that has not been truncated is zeroed.
Download Link
Download Link (RIPE repository)

This is a continuous 4 and a half day GPS-synchronized IP header trace taken using 3 DAG 3 cards to capture traffic simulataneous at three different points in the University of Auckland Internet infrastructure.

A router connects the ISP ATM switch to a 100 Mbps Ethernet hub (Allied Telesyn CentreCOM FH812u V2i), which is linked via the firewall to a second identical hub. The very first trace, however, was taken when the DMZ was still working at 10 Mbps utilizing two 3Com hubs instead of the Allied Telesyn types. One pair of DAG 3 ATM cards tapped the link between the ISP and the ATM switch. A DAG 3 Ethernet card was connected with its port 0 to a hub outsize DMZ and with its port 1 to a hub inside DMZ. With this configuration, the entirety of the University's Internet traffic is being monitored.

Each trace file is named using the following format: yyyymmdd-HHMMSS-[format][direction].gz. The time and date refers to the local time when the capture was started. The direction refers to which half of the link is contained within the trace. Direction 0 is traffic coming into the University and direction 1 is traffic originating from the University. The Ethernet traces have their direction prefixed with the letter 'e' to signify their capture format. The ATM traces have no such letter.

All non-IP traffic has been discarded and only TCP, UDP and ICMP traffic is present in the trace. Any user payload within the 64 byte capture record has been zeroed.

The IP addresses in the traces have been replaced using a one-to-one mapping into the 10.0.0.0/8 address space. Each anonymised address was assigned sequentially so the first real-world address observed is mapped to 10.0.0.1, the next new address is 10.0.0.2 and so on. The mapping database was preserved across the entire trace set.

The recommended method for processing these traces is to use Libtrace, which we have developed. There are a number of tools included with libtrace such as a packet dumping utility, a trace format converter (for example, to convert to pcap), a trace splitting/filtering tool and a few statistic generators. We suggest you examine the Libtrace Wiki for more details on the Libtrace tools and the library itself.

Acknowledgements: Some of the information presented on this page has been sourced from the NLANR page about this traceset.

Name Local Start Time Duration Total Packets Compressed Size
20010510-162311-0 Thu May 10 16:23:11 2001 1:00:01 3 million 72 MB
20010510-162311-1 Thu May 10 16:23:11 2001 1:00:01 3 million 67 MB
20010510-162311-e0 Thu May 10 16:23:11 2001 1:00:01 5 million 123 MB
20010510-162311-e1 Thu May 10 16:23:11 2001 1:00:01 5 million 121 MB
20010608-185916-0 Fri Jun 8 18:59:16 2001 5:00:43 7 million 147 MB
20010608-185916-1 Fri Jun 8 18:59:16 2001 5:00:43 7 million 146 MB
20010608-185916-e0 Fri Jun 8 18:59:16 2001 5:00:43 13 million 277 MB
20010608-185916-e1 Fri Jun 8 18:59:16 2001 5:00:43 13 million 278 MB
20010609-000000-0 Sat Jun 9 00:00:00 2001 6:00:00 3 million 69 MB
20010609-000000-1 Sat Jun 9 00:00:00 2001 6:00:00 3 million 73 MB
20010609-000000-e0 Sat Jun 9 00:00:00 2001 6:00:00 6 million 137 MB
20010609-000000-e1 Sat Jun 9 00:00:00 2001 6:00:00 6 million 137 MB
20010609-060000-0 Sat Jun 9 06:00:00 2001 6:00:00 5 million 107 MB
20010609-060000-1 Sat Jun 9 06:00:00 2001 6:00:00 5 million 104 MB
20010609-060000-e0 Sat Jun 9 06:00:00 2001 6:00:00 9 million 196 MB
20010609-060000-e1 Sat Jun 9 06:00:00 2001 6:00:00 9 million 195 MB
20010609-120000-0 Sat Jun 9 12:00:00 2001 6:00:00 11 million 233 MB
20010609-120000-1 Sat Jun 9 12:00:00 2001 6:00:00 10 million 210 MB
20010609-120000-e0 Sat Jun 9 12:00:00 2001 6:00:00 18 million 385 MB
20010609-120000-e1 Sat Jun 9 12:00:00 2001 6:00:00 18 million 377 MB
20010609-180000-0 Sat Jun 9 18:00:00 2001 6:00:00 6 million 126 MB
20010609-180000-1 Sat Jun 9 18:00:00 2001 6:00:00 6 million 131 MB
20010609-180000-e0 Sat Jun 9 18:00:00 2001 6:00:00 11 million 241 MB
20010609-180000-e1 Sat Jun 9 18:00:00 2001 6:00:00 11 million 240 MB
20010610-000000-0 Sun Jun 10 00:00:00 2001 6:00:00 2 million 56 MB
20010610-000000-1 Sun Jun 10 00:00:00 2001 6:00:00 3 million 60 MB
20010610-000000-e0 Sun Jun 10 00:00:00 2001 6:00:00 5 million 104 MB
20010610-000000-e1 Sun Jun 10 00:00:00 2001 6:00:00 5 million 103 MB
20010610-060000-0 Sun Jun 10 06:00:00 2001 6:00:00 3 million 77 MB
20010610-060000-1 Sun Jun 10 06:00:00 2001 6:00:00 4 million 79 MB
20010610-060000-e0 Sun Jun 10 06:00:00 2001 6:00:00 7 million 147 MB
20010610-060000-e1 Sun Jun 10 06:00:00 2001 6:00:00 7 million 146 MB
20010610-120000-0 Sun Jun 10 12:00:00 2001 6:00:00 10 million 215 MB
20010610-120000-1 Sun Jun 10 12:00:00 2001 6:00:00 10 million 212 MB
20010610-120000-e0 Sun Jun 10 12:00:00 2001 6:00:00 18 million 391 MB
20010610-120000-e1 Sun Jun 10 12:00:00 2001 6:00:00 18 million 385 MB
20010610-180000-0 Sun Jun 10 18:00:00 2001 6:00:00 8 million 167 MB
20010610-180000-1 Sun Jun 10 18:00:00 2001 6:00:00 8 million 171 MB
20010610-180000-e0 Sun Jun 10 18:00:00 2001 6:00:00 15 million 319 MB
20010610-180000-e1 Sun Jun 10 18:00:00 2001 6:00:00 15 million 312 MB
20010611-000000-0 Mon Jun 11 00:00:00 2001 6:00:00 2 million 56 MB
20010611-000000-1 Mon Jun 11 00:00:00 2001 6:00:00 2 million 58 MB
20010611-000000-e0 Mon Jun 11 00:00:00 2001 6:00:00 5 million 103 MB
20010611-000000-e1 Mon Jun 11 00:00:00 2001 6:00:00 4 million 99 MB
20010611-060000-0 Mon Jun 11 06:00:00 2001 6:00:00 11 million 242 MB
20010611-060000-1 Mon Jun 11 06:00:00 2001 6:00:00 10 million 214 MB
20010611-060000-e0 Mon Jun 11 06:00:00 2001 6:00:00 18 million 390 MB
20010611-060000-e1 Mon Jun 11 06:00:00 2001 6:00:00 18 million 387 MB
20010611-120000-0 Mon Jun 11 12:00:00 2001 6:00:00 20 million 422 MB
20010611-120000-1 Mon Jun 11 12:00:00 2001 6:00:00 18 million 377 MB
20010611-120000-e0 Mon Jun 11 12:00:00 2001 6:00:00 31 million 698 MB
20010611-120000-e1 Mon Jun 11 12:00:00 2001 6:00:00 31 million 693 MB
20010611-180000-0 Mon Jun 11 18:00:00 2001 6:00:00 9 million 202 MB
20010611-180000-1 Mon Jun 11 18:00:00 2001 6:00:00 9 million 200 MB
20010611-180000-e0 Mon Jun 11 18:00:00 2001 6:00:00 17 million 365 MB
20010611-180000-e1 Mon Jun 11 18:00:00 2001 6:00:00 17 million 361 MB
20010612-000000-0 Tue Jun 12 00:00:00 2001 6:00:00 3 million 67 MB
20010612-000000-1 Tue Jun 12 00:00:00 2001 6:00:00 3 million 70 MB
20010612-000000-e0 Tue Jun 12 00:00:00 2001 6:00:00 6 million 130 MB
20010612-000000-e1 Tue Jun 12 00:00:00 2001 6:00:00 6 million 128 MB
20010612-060000-0 Tue Jun 12 06:00:00 2001 6:00:00 11 million 239 MB
20010612-060000-1 Tue Jun 12 06:00:00 2001 6:00:00 10 million 214 MB
20010612-060000-e0 Tue Jun 12 06:00:00 2001 6:00:00 18 million 396 MB
20010612-060000-e1 Tue Jun 12 06:00:00 2001 6:00:00 18 million 388 MB
20010612-120000-0 Tue Jun 12 12:00:00 2001 6:00:00 20 million 421 MB
20010612-120000-1 Tue Jun 12 12:00:00 2001 6:00:00 17 million 371 MB
20010612-120000-e0 Tue Jun 12 12:00:00 2001 6:00:00 31 million 696 MB
20010612-120000-e1 Tue Jun 12 12:00:00 2001 6:00:00 31 million 692 MB
20010612-180000-0 Tue Jun 12 18:00:00 2001 6:00:00 10 million 215 MB
20010612-180000-1 Tue Jun 12 18:00:00 2001 6:00:00 9 million 199 MB
20010612-180000-e0 Tue Jun 12 18:00:00 2001 6:00:00 15 million 340 MB
20010612-180000-e1 Tue Jun 12 18:00:00 2001 6:00:00 15 million 336 MB
20010613-000000-0 Wed Jun 13 00:00:00 2001 6:00:00 3 million 69 MB
20010613-000000-1 Wed Jun 13 00:00:00 2001 6:00:00 3 million 70 MB
20010613-000000-e0 Wed Jun 13 00:00:00 2001 6:00:00 6 million 129 MB
20010613-000000-e1 Wed Jun 13 00:00:00 2001 6:00:00 6 million 129 MB
20010613-060000-0 Wed Jun 13 06:00:00 2001 2:54:04 3 million 63 MB
20010613-060000-1 Wed Jun 13 06:00:00 2001 2:54:05 2 million 56 MB
20010613-060000-e0 Wed Jun 13 06:00:00 2001 2:54:04 5 million 106 MB
20010613-060000-e1 Wed Jun 13 06:00:00 2001 2:54:04 5 million 104 MB