WITS: NZIX-II
| Trace Format | Legacy Ethernet, captured using a DAG 3 card. |
| Volume on Disk | 22 GB |
| Number of Traces | 21 |
| Capture Start (Local) | Wed Jul 5 15:29:00 2000 |
| Capture End (Local) | Mon Jul 10 14:56:27 2000 |
| Total Duration | 4 Days, 23 Hours, 27 Minutes and 27 Seconds |
| Packets Captured | 835 million |
| Total Traffic | 200 GB |
| Contiguity | 5 days of contiguous trace |
| Snapping Method | All records are 64 bytes long, but any data beyond the transport header is zeroed. |
| Rotation Policy | Files rotated every 12 hours, based on Midnight local time |
| Anonymization | IP addresses all mapped non-reversibly into 10.X.X.X address space |
| Download | Link |
| Download | Link (RIPE repository) |
This is a collection of GPS-synchronized IP header traces captured using a DAG32E at the New Zealand Internet Exchange. NZIX was hosted by the ITS department at the University of Waikato and served as a peering point among a number of larger New Zealand ISPs. When the measurements were taken in July 2000, the following parties were connected:
- Telecom New Zealand
- Clear Communications
- Telstra New Zealand
- Asia Online New Zealand (ICONZ)
- AT&T New Zealand
- University of Waikato, including a number of smaller organizations
At the time, NZIX consisted of two Cisco 2926 26 port 10/100 autosensing Ethernet switches running spanning tree for redundancy. Each ISP had their own WAN circuits back to their respective locations, either in Auckland or Wellington. The DAG monitor was connected to a SPAN port via 100BaseTx FastEthernet.
As a result, timestamps in the traces are skewed compared to their arrival or departure times at the input/output ports of the switch as the total capacity of the switch is higher than the monitoring uplink. Packets arriving from different ports at the same time needed to be queued (or dropped) before being delivered to the SPAN port. It is possible that traffic was lost before being monitored, but we estimate that the chance of this is fairly low because the total bandwidth at the switch peaked at around 10-12 MBits/sec.
Each trace file is named using the following format: yyyymmdd-HHMMSS.gz. The time and date refers to the local time when the capture was started. Both directions are contained within the trace but the legacy DAG formats do not support differentiating between directions.
All non-IP traffic has been discarded and only TCP, UDP and ICMP traffic is present in the trace. Any user payload within the 64 byte capture record has been zeroed.
The traces have been anonymized by mapping the IP addresses into network 10.X.X.X in a non-reversible way. This mapping is preserved across all the traces in the dataset, so IP addresses that are identical in the real world are identical in different traces. Checksums are not anonymized in any way.
The recommended method for processing these traces is to use Libtrace, which we have developed. There are a number of tools included with libtrace such as a packet dumping utility, a trace format converter (for example, to convert to pcap), a trace splitting/filtering tool and a few statistic generators. We suggest you examine the Libtrace Wiki for more details on the Libtrace tools and the library itself.
| Name | Local Start Time | Duration | Total Packets | Compressed Size |
|---|---|---|---|---|
| 20000705-152900 | Wed Jul 5 15:29:00 2000 | 2:30:59 | 29 million | 852 MB |
| 20000705-180000 | Wed Jul 5 18:00:00 2000 | 6:00:00 | 53 million | 1,480 MB |
| 20000706-000000 | Thu Jul 6 00:00:00 2000 | 6:00:00 | 22 million | 586 MB |
| 20000706-060000 | Thu Jul 6 06:00:00 2000 | 6:00:00 | 43 million | 1,196 MB |
| 20000706-120000 | Thu Jul 6 12:00:00 2000 | 6:00:00 | 70 million | 2,011 MB |
| 20000706-180000 | Thu Jul 6 18:00:00 2000 | 6:00:00 | 53 million | 1,472 MB |
| 20000707-000000 | Fri Jul 7 00:00:00 2000 | 6:00:00 | 23 million | 580 MB |
| 20000707-060000 | Fri Jul 7 06:00:00 2000 | 6:00:00 | 41 million | 1,150 MB |
| 20000707-120000 | Fri Jul 7 12:00:00 2000 | 6:00:00 | 65 million | 1,882 MB |
| 20000707-180000 | Fri Jul 7 18:00:00 2000 | 6:00:00 | 50 million | 1,364 MB |
| 20000708-000000 | Sat Jul 8 00:00:00 2000 | 6:00:00 | 24 million | 612 MB |
| 20000708-060000 | Sat Jul 8 06:00:00 2000 | 6:00:00 | 26 million | 697 MB |
| 20000708-120000 | Sat Jul 8 12:00:00 2000 | 6:00:00 | 45 million | 1,220 MB |
| 20000708-180000 | Sat Jul 8 18:00:00 2000 | 6:00:00 | 43 million | 1,148 MB |
| 20000709-000000 | Sun Jul 9 00:00:00 2000 | 6:00:00 | 21 million | 530 MB |
| 20000709-060000 | Sun Jul 9 06:00:00 2000 | 6:00:00 | 24 million | 636 MB |
| 20000709-120000 | Sun Jul 9 12:00:00 2000 | 6:00:00 | 45 million | 1,222 MB |
| 20000709-180000 | Sun Jul 9 18:00:00 2000 | 6:00:00 | 49 million | 1,336 MB |
| 20000710-000000 | Mon Jul 10 00:00:00 2000 | 6:00:00 | 19 million | 475 MB |
| 20000710-060000 | Mon Jul 10 06:00:00 2000 | 6:00:00 | 45 million | 1,229 MB |
| 20000710-120000 | Mon Jul 10 12:00:00 2000 | 2:56:27 | 34 million | 989 MB |