TY - GEN
T1 - On the Power and Limitations of Detecting Network Filtering via Passive Observation
AU - Sargent, Matthew
AU - Czyz, Jakub
AU - Allman, Mark
AU - Bailey, Michael
N1 - Funding Information:
We would like to thank Christian Kreibich for the Netalyzr data, Phillip Porras for the Conficker sinkhole data, and Vern Paxson for comments on an earlier draft. This work is sponsored by NSF grants CNS-1213157, CNS-1237265, CNS-1505790 and CNS-1111699.
Publisher Copyright:
© Springer International Publishing Switzerland 2015.
PY - 2015
Y1 - 2015
N2 - Network operators often apply policy-based traffic filtering at the egress of edge networks. These policies can be detected by performing active measurements; however, doing so involves instrumenting every network one wishes to study. We investigate a methodology for detecting policy-based service-level traffic filtering from passive observation of traffic markers within darknets. Such markers represent traffic we expect to arrive and, therefore, whose absence is suggestive of network filtering. We study the approach with data from five large darknets over the course of one week. While we show the approach has utility to expose filtering in some cases, there are also limits to the methodology.
AB - Network operators often apply policy-based traffic filtering at the egress of edge networks. These policies can be detected by performing active measurements; however, doing so involves instrumenting every network one wishes to study. We investigate a methodology for detecting policy-based service-level traffic filtering from passive observation of traffic markers within darknets. Such markers represent traffic we expect to arrive and, therefore, whose absence is suggestive of network filtering. We study the approach with data from five large darknets over the course of one week. While we show the approach has utility to expose filtering in some cases, there are also limits to the methodology.
UR - http://www.scopus.com/inward/record.url?scp=84924386414&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84924386414&partnerID=8YFLogxK
U2 - 10.1007/978-3-319-15509-8_13
DO - 10.1007/978-3-319-15509-8_13
M3 - Conference contribution
AN - SCOPUS:84924386414
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 165
EP - 178
BT - Passive and Active Measurement - 16th International Conference, PAM 2015, Proceedings
A2 - Liu, Yong
A2 - Mirkovic, Jelena
PB - Springer
T2 - 16th International Conference on Passive and Active Measurement, PAM 2015
Y2 - 19 March 2015 through 20 March 2015
ER -