NLANR network traffic traces

NLANR network traffic packet header traces


IMPORTANT NOTE

In certain environments (especially Window's Internet Explorer, but probably others as well) the gzip-ed files get trashed by inserting line feed characters on your machine. If you have problems with the trace file, try either FTPing, or use this perl program instead (Note: if you get the NZ traces you need to change the 'print S "GET /Traces/Traces/$filename\n";' line to 'print S "GET /Traces/Kiwitraces/Traces/$filename\n";').

Also, the analysis software available are just prototype programs, usually working under Linux and FreeBSD on x86 platforms. If you use other platforms you may have byte swapping and/or other issues. The programs tend to be purposely short anyway, and should be easily adjustable by you to your specific needs.

There are some issues with the .crl format. One being with the time stamps, the other that the data is not sequenced in time across multiple interfaces. It comes out in about 1MB blocks per interface. I would recommend you convert to tsh (time sequenced headers) with crl2tsh.pl, which is supposed to fix those issues. crl2tsh.pl creates tsh formal files. The TSH directory has prototype converters and analysis routines for the format. But beware, they don't pay much attention to byte swapping for multiple machine architectures. They are usable with FreeBSD or Linux in an x86 environment.


NLANR is making network packet header traces available for network analysis research within the Internet community. These traces are generally in one of the following three formats:

privacy enhancing encoders, used to create the .enc files:


NLANR packet header traces
Long traces from the New Zealand (Auckland) to US link
Comments, questions or suggestion can be made via the feedback form.