This is a continuous short capture taken from the University of Leipzig Internet access link. A pair of DAG 3.2 cards were used to monitor the OC3 Packet-over-Sonet connection to the German research network (G-WiN). A diagram of the capture configuration can be found here.

Each trace file is named using the following format: yyyymmdd-HHMMSS-[direction].gz. The time and date refers to the local time when the capture was started. The direction refers to the half of the link that was monitored. It is not clear which directions correlate to incoming and outgoing traffic, unfortunately. Both traces can be combined to create a full bidirectional trace.

All non-IP traffic has been discarded and only TCP, UDP and ICMP traffic is present in each trace. Any user payload within the capture record has been zeroed.

The IP addresses in the traces have been replaced using a one-to-one mapping into the 10.0.0.0/8 address space. Each anonymised address was assigned sequentially so the first real-world address observed is mapped to 10.0.0.1, the next new address is 10.0.0.2 and so on. The mapping database was preserved across the entire trace set.

The recommended method for processing these traces is to use Libtrace, which we have developed. There are a number of tools included with libtrace such as a packet dumping utility, a trace format converter (for example, to convert to pcap), a trace splitting/filtering tool and a few statistic generators. We suggest you examine the Libtrace Wiki for more details on the Libtrace tools and the library itself.

Acknowledgements: Some of the information presented on this page has been sourced from the NLANR page about this trace, which no longer exists.