WITS: NZIX-II

Trace Format Legacy Ethernet, captured using a DAG 3 card.
Volume on Disk 22 GB
Number of Traces 21
Capture Start (Local) Wed Jul 5 15:29:00 2000
Capture End (Local) Mon Jul 10 14:56:27 2000
Total Duration 4 Days, 23 Hours, 27 Minutes and 27 Seconds
Packets Captured 835 million
Total Traffic 200 GB
Contiguity 5 days of contiguous trace
Snapping Method All records are 64 bytes long, but any data beyond the transport header is zeroed.
Rotation Policy Files rotated every 12 hours, based on Midnight local time
Anonymization IP addresses all mapped non-reversibly into 10.X.X.X address space
Download Link
Download Link (RIPE repository)

This is a collection of GPS-synchronized IP header traces captured using a DAG32E at the New Zealand Internet Exchange. NZIX was hosted by the ITS department at the University of Waikato and served as a peering point among a number of larger New Zealand ISPs. When the measurements were taken in July 2000, the following parties were connected:

  • Telecom New Zealand
  • Clear Communications
  • Telstra New Zealand
  • Asia Online New Zealand (ICONZ)
  • AT&T New Zealand
  • University of Waikato, including a number of smaller organizations

At the time, NZIX consisted of two Cisco 2926 26 port 10/100 autosensing Ethernet switches running spanning tree for redundancy. Each ISP had their own WAN circuits back to their respective locations, either in Auckland or Wellington. The DAG monitor was connected to a SPAN port via 100BaseTx FastEthernet.

As a result, timestamps in the traces are skewed compared to their arrival or departure times at the input/output ports of the switch as the total capacity of the switch is higher than the monitoring uplink. Packets arriving from different ports at the same time needed to be queued (or dropped) before being delivered to the SPAN port. It is possible that traffic was lost before being monitored, but we estimate that the chance of this is fairly low because the total bandwidth at the switch peaked at around 10-12 MBits/sec.

Each trace file is named using the following format: yyyymmdd-HHMMSS.gz. The time and date refers to the local time when the capture was started. Both directions are contained within the trace but the legacy DAG formats do not support differentiating between directions.

All non-IP traffic has been discarded and only TCP, UDP and ICMP traffic is present in the trace. Any user payload within the 64 byte capture record has been zeroed.

The traces have been anonymized by mapping the IP addresses into network 10.X.X.X in a non-reversible way. This mapping is preserved across all the traces in the dataset, so IP addresses that are identical in the real world are identical in different traces. Checksums are not anonymized in any way.

The recommended method for processing these traces is to use Libtrace, which we have developed. There are a number of tools included with libtrace such as a packet dumping utility, a trace format converter (for example, to convert to pcap), a trace splitting/filtering tool and a few statistic generators. We suggest you examine the Libtrace Wiki for more details on the Libtrace tools and the library itself.

Name Local Start Time Duration Total Packets Compressed Size
20000705-152900 Wed Jul 5 15:29:00 2000 2:30:59 29 million 852 MB
20000705-180000 Wed Jul 5 18:00:00 2000 6:00:00 53 million 1,480 MB
20000706-000000 Thu Jul 6 00:00:00 2000 6:00:00 22 million 586 MB
20000706-060000 Thu Jul 6 06:00:00 2000 6:00:00 43 million 1,196 MB
20000706-120000 Thu Jul 6 12:00:00 2000 6:00:00 70 million 2,011 MB
20000706-180000 Thu Jul 6 18:00:00 2000 6:00:00 53 million 1,472 MB
20000707-000000 Fri Jul 7 00:00:00 2000 6:00:00 23 million 580 MB
20000707-060000 Fri Jul 7 06:00:00 2000 6:00:00 41 million 1,150 MB
20000707-120000 Fri Jul 7 12:00:00 2000 6:00:00 65 million 1,882 MB
20000707-180000 Fri Jul 7 18:00:00 2000 6:00:00 50 million 1,364 MB
20000708-000000 Sat Jul 8 00:00:00 2000 6:00:00 24 million 612 MB
20000708-060000 Sat Jul 8 06:00:00 2000 6:00:00 26 million 697 MB
20000708-120000 Sat Jul 8 12:00:00 2000 6:00:00 45 million 1,220 MB
20000708-180000 Sat Jul 8 18:00:00 2000 6:00:00 43 million 1,148 MB
20000709-000000 Sun Jul 9 00:00:00 2000 6:00:00 21 million 530 MB
20000709-060000 Sun Jul 9 06:00:00 2000 6:00:00 24 million 636 MB
20000709-120000 Sun Jul 9 12:00:00 2000 6:00:00 45 million 1,222 MB
20000709-180000 Sun Jul 9 18:00:00 2000 6:00:00 49 million 1,336 MB
20000710-000000 Mon Jul 10 00:00:00 2000 6:00:00 19 million 475 MB
20000710-060000 Mon Jul 10 06:00:00 2000 6:00:00 45 million 1,229 MB
20000710-120000 Mon Jul 10 12:00:00 2000 2:56:27 34 million 989 MB