NLANR MOAT PMA -- Passive Measurements and Analysis

Passive Measurement and Analysis

Go directly to Traces

Search for Traces
based on a subset of statistics (preliminary version)

More Information on PMA

Specific Topology of PMA sites

Keep in Touch - For Trace Users

Email dgcheney(at)nlanr.net to give feedback

Related information:

Description of the OC3mon hardware
OC3mon data collection software
FAQ on data formats
Packet based analysis

Data cube Database Query
A front end to a database containing the Data cube files. This allows queries against site, project, and date of Data cube files. There is also a feature to allow the download of all the files which match your query at once.
packet header trace formats
There are a few legacy formats, which were used for early traces. Recent traces are more standardized. Most traces are in .fr, .fr+, .crl, or .tsh format.
Packet header related analysis sample write-up
An example of one of the many analyses that can be done on traces.
Packets/Bit/Host based analysis
Some important insights regarding non-flow based analyses.
Raw packet length data for 19981117
Analysis of TCP flags
Having to do with types of TCP traffic.
DNS related
DNS packet length distributions.
specific packet length run lengths
highest throughput transactions seen
Flow analysis tools
- tsh tools
  Some helpful scripts for converting and processing files in the tsh format.
- MBET tsh2ta perl script
  This is Bo Ryu's Measurement based Binary Exponential Timeout algorithm for flows analyses implemented to generate Transaction Analyses from Time Sequence Header files. (see the Data Format FAQ and the tsh2ta README for more information).
  C implementation of tsh2ta
  This rewrite was done by David Cheney to improve the performance of translation analyses on NLANR monitors.
- fr and crl capable tcpdump, requires:
  - the included savefile.c be copied/used in libpcap
  - the included tcpdump.c be copied/used in tcpdump
  - the program be started with -w to write binary files
  - the binary file name starts with either
    - na- for fr format output files, or
    - crl- for crl format output files
  (tested with FreeBSD 2.2.6 on a Pentium II platform, not necessarily working in other environments)
- fs2flows flow analyzer
  Version 1.0; uses "fr" input format;
  should work on at least Linux, FreeBSD, Digital Alpha (OSF1)