Welcome to our network measurement data and tools repository page, UCRchive^[1]. This page has been set up primarily for providing a unified collection of links to various resources of network data traces and tools, both wireline and wireless for the benefit of researchers working in this area. Each link on this page is referenced to the external source which houses the actual trace files and software, available to the entire networking community. With each link you may find a small description regarding the project which has been the source of this data and/or software. If you wish to have your trace files/software included in UCRchive, please send an email to Anirban Banerjee, anirban@cs.ucr.edu and Michalis Faloutsos, michalis@cs.ucr.edu with a small description of what your project is about and a link to your site from where users can download traces/software. Please do let us know if you face any problems regarding dead links of any sort :) .

For Wireless Resources please scroll down, click this link for Wireline Resources. To have a look at what new projects our networking group is working on please visit http://networks.cs.ucr.edu.  

Wireless Data Resources

• The MOMENT lab has a thirty node multi-radio wireless mesh testbed deployed in a building on our campus. We have developed a  suite of open-source tools to help in the management of our testbed. Most of these tools can be reused by other organizations. As  examples, we have tools for the visualization of a wireless mesh testbed, real-time monitoring of wireless link qualities, and  efficient management of mesh relays in a testbed. Our lab also has open-source routing protocol implementations specially designed for  ad hoc and wireless mesh networks. In addition, we have a repository of wireless network traces collected at a recent IETF meeting. These  traces are particularly useful if researchers wish to analyze the behavior of the IEEE 802.11 protocol in a heavily congested wireless  network. Our tools and the trace repository are linked off http://moment.cs.ucsb.edu/

• The CONAN (Congestion Analysis of Wireless Networks) project analyzes and makes available wireless network data traces that were collected from the IETF 62 meeting held in Minneapolis in March 2005, using three sniffers (laptops) with prism2 chipset cards, operating in the RFMon mode. The data sets contain anonymised packet traces from channels 1, 6, and 11 during one day session and one evening (plenary) session. More information about the data-sets is available in the papers published using the data traces at http://moment.cs.ucsb.edu/conan.

• StarEast is a compact, stackable, multi-radio, multi-channel wireless platform which can host upto 4 wireless cards, enabling a novel multi-radio per node MESH network. To support large applications, the baseboard includes 133MHz, 256Mbytes of on-board SDRAM, and 32Mbytes of on-board Intel StrataFlash memory. The open-source (LINUX) IPW2200 drivers for Intel 2915 cards enables the dynamic tuning for different wireless parameters i.e.Channel, rate , CCA threshold, Rx sensitivity, Tx power and Contention Window in DCF protocol. Currently UW Adaptive MESH group in close collaboration with Intel Corp.  ( http://commnet.ee.washington.edu/funlab/ ) is engaged in experimental evaluaton of network performance in High Density(HD) Enterprise WLANs, vis-a-vis scalability of aggregate throughput and associated end-to-end delay via cross-layer optimization approaches.

• CRAWDAD(Community Resource for Archiving Wireless Data At Dartmouth) This will be a publicly-available community resource for collecting and working with data from wireless networks. We are hoping to include data from lots of different networks (currently mainly campus 802.11networks, more information about the archive can be found here: http://crawdad.cs.dartmouth.edu/about.php

• MOVE allows users to rapidly generate realistic mobility models for VANET simulations. MOVE is built on top of an open source micro-traffic simulator SUMO. The output of MOVE is a realistic mobility model and can be immediately used by popular network simulators such as ns-2 and qualnet. The tool can be accessed at http://www.cse.unsw.edu.au/~klan/move/

• USC wireless LAN traces archive includes six-months of association patterns of on-campus WLAN users, including VPN session logs, DHCP logs, traps at the access switch, authentication server logs, flow size traces. For USC traces, the user association is obtained through authentication servers, hence it truthfully reflects the real usage of users. These traces are used to understand and model user mobility patterns and usage of WLANs. http://nile.usc.edu/MobiLib/

• The WIRE1x is an implementation of IEEE 802.1x client. WIRE1x supports various EAP-based authentication mechanisms, including EAP-MD5, EAP-TLS, EAP-TTLS, and PEAP. It can work with various versions of MS Windows, including Windows XP, 2000, ME, and 98. It has been practically used in real-word applications to secure WLAN environments.http://wire.cs.nthu.edu.tw/wire1x/

• The bulk TCP traces at the networks lab in Chungnam National University (http://networks.cnu.ac.kr/measurement/cdma-1x-evdo/) are the first public availble packet traces collected in CDMA 1x EV-DO network, Korea. From the real packet traces, the throughput , RTT, and loss rate of TCP performance over 3G wireless network could be verified.

Wireline Resources
 

•   CAIDA has been actively involved in active and passive measurements of the Internet since 1997. We have accumulated comprehensive sets
    of data characterizing Internet topology, performance, workload, and security. CAIDA data sets are described in detail at http://www.caida.org/data/. 
    I.  Active measurements of Internet topology and performance.
   
    1. Raw topology and performance traces.
   
    The traceroute-like tool skitter  (http://www.caida.org/tools/measurement/skitter/) captures forward IP paths and round-trip times from a skitter host to a  specified list of destinations. CAIDA maintains 20 (was 25) monitors  around the world, each providing a unique vantage point on Internet connectivity. Both raw and aggregated datasets are available to qualified researchers. These measurements started on January 17, 1998 and are ongoing. As of February 2006, the collection consists of nearly 12 billion traces stored in more than 50 thousand files with the total volume of uncompressed data being more than 3 TB. For more information see CAIDA's IPv4 Topology Project  (http://www.caida.org/analysis/topology/macroscopic/).
  
  
    2. Adjacency matrix of the Internet AS-level graph (derived from skitter traces).
  
  An AS-level graph of the Internet can be constructed from raw traces by converting observed IP addresses to routed prefixes and then to origin ASes. Daily snapshots of links making up such an AS-level graph are available for download from  http://www.caida.org/tools/measurement/skitter/as_adjacencies.xml. These data are unrestricted, there is no AUP. The collection started on January 2, 2000 and is ongoing.
   

• 3. The adjacency matrix of the Internet router-level topology derived from skitter traces. We also offer a single instance of the Internet router-level graph derived from two weeks of topology measurements in April-May 2003: http://www.caida.org/tools/measurement/skitter/router_topology/
   
  4. Internet AS-level graphs derived from three different data sources. We derived three AS-level graphs of the Internet using skitter  measurements, BGP tables, and the RIPE WHOIS database. We calculated the most basic and commonly used statistical characteristics of these topologies. The results of this comparative analysis are published in CCR 36(1), 2006. http://www.caida.org/outreach/papers/2006/as_topology/  We release the graphs themselves and statistics tables, plots, and calculated data used to draw them in http://www.caida.org/analysis/topology/as_topo_comparisons/.
   
  5. AS ranking. 
  Using available macroscopic topology data and our own AS relationship inference algorithms we have developed a procedure to rank Autonomous Systems by their location in the Internet hierarchy http://as-rank.caida.org/. Our algorithm, rooted in economic AS relationships, ranks each AS based on the number of IP prefixes advertised by this AS, its customer ASes, their customers ASes, and so on. Starting from January 2006, we will archive and make available for download weekly inferences of AS-relationships. In other words, we will provide the complete AS-level Internet topologies enriched with AS-relationship information for every pair of neighboring ASes (AS-links). (Currently, calculations going back to January are in progress.)
   
    II. Passive measurements of Internet traffic.
   
    1. Workload data from OC48 commodity links.
   
  CAIDA has monitoring locations in several large Internet Service Providers (ISPs) in the United States where OC48 taps collect packet headers at large peering points. The resulting traces have been used for a wide variety of research projects, ranging from general attempts to characterize the global state of Internet traffic, specific studies of the prevalence of peer-to-peer filesharing traffic, to testing prototype software designed to stop the spread of Internet worms. We make these data available to the research community to the extent possible while preserving the privacy of individuals and organizations who donate data or network access (http://www.caida.org/analysis/measurement/oc48_data_request.xml). This collection started on August 14, 2002, and is largely on hold pending the deployment of OC192 monitoring hardware. As of February 2006 it consists of 1.7 TB of uncompressed data stored in more than 500 files.
  
  
    2. Security data from the UCSD Network Telescope.
  
  The UCSD Network Telescope (http://www.caida.org/data/passive/network_telescope.xml) provides a unique view of anomalous traffic with no legitimate destination carried on the Internet. In addition to misdirected traffic as a result of typographical or configuration errors, the Network Telescope monitors malicious events including Denial-of-Service attack backscatter, Internet worms, and host scanning. The Network Telescope data are available for qualified researchers (http://www.caida.org/analysis/security/telescope/backscatter_request.xml). This collection started on January 31, 2001 and is ongoing. As of February 2006, there are 37.5 TB of uncompressed data stored in more than 30 thousand files.
  
  
  
    III. DatCat - Internet Measurement Data Catalog.
  
    We are implementing the Internet Measurement Data Catalog (DatCat) which will be a repository to archive meta-data for many heterogeneous
    data sets. The main goals for the DatCat are: a) facilitate searching for and sharing of data among researchers; and b) promote the reproducibility of network analysis results. The DatCat is a database architecture completed with an annotation system that fits existing and future Internet data sets. As of February  2006 we are populating and testing this database with our own annotated  data sets.  Upon completion of this testing phase, we will contact owners of large Internet data sets and collaborate with them to catalog their data. We expect to open this catalog for public browsing in the summer of  2006.  External researchers making use of the DatCat will have web access to a user interface. They can then query for specific signatures in data sets and will receive answers pointing them to the locations of the data they are interested in. Note that the DatCat will contain only "data about data", but will not actually store copies of the datasets. We realize that data ownership and stewardship are complex and highly charged issues with legal, social, political, liability, and security implications. The means to a globally usable solution   for the social, security, and liability problems are not at hand. However, by publishing information about the existence of Internet datasets while leaving control of those datasets in the hands of their owners, we document data access policies and let researchers abide by or arrange exceptions to these policies on a case-by-case basis.

• In a research framework on Internet Traffic Modeling, at University of Napoli "Federico II", we developed open source tools for traffic  capture, analysis and generation, and to perform active measurements of QoS parameters. We called them Plab and D-ITG. Our software and archives with some of our traffic and data traces are publicly and freely available at http://www.grid.unina.it/Traffic. How these archives can possibly help other people: Some interesting features of the data we make available, are that measurements of QoS parameters are made over a wide range of real heterogeneous end-to-end paths. As for traffic traces, they include full optional TCP headers (e.g. MSS options).

• NVision-IP <http://security.ncsa.uiuc.edu/distribution/NVisionIPDownLoad.html> NVisionIP is a network state visualization tool providing an operator a multi-level view into a Class B address space using NetFlows source data. At the highest level, a "Galaxy View (GV)" shows an overview of an entire Class B address space on one screen with each IP address being color-coded and shaped dots representing NetFlow traffic state in terms of user configurable statistics. Using your mouse in the GV to highlight an area of interest invokes a "Small Multiple View (SMV)" facilitating visually browsing of subnet activity across the Class B address space. Again using your mouse to drill-down to a specific IP address within the SMV, the "Machine View" shows attributes about an individual IP address such as connection and data transfer statistics per protocol or per port as well as the associated raw NetFlow data. NVisionIP is currently used for security event monitoring but has many other network management uses including network profiling.

• VisFlowConnect-IP <http://security.ncsa.uiuc.edu/distribution/VisFlowConnectDownLoad.html> VisFlowConnect-IP is a tool for visualizing network traffic connectivity using NetFlows as source data. It can be used to see connectivity between an edge network and the Internet or solely within an internal network. The framework builds on link analysis using the parallel axes paradigm to show source and destinations as points and links between them as lines. The tool is scalable since it uses a configurable time window that only animates traffic within the time window and no state is kept outside of the time window. VisFlowConnect-IP is currently used for security monitoring but has many other network management uses including network profiling.

• CANINE <http://security.ncsa.uiuc.edu/distribution/CanineDownLoad.html> CANINE is a Converter and ANonymizer for Investigating Netflow Events. The motivation behind CANINE is to solve two problems that current NetFlow tools often struggle with: (1) NetFlows come in many different, incompatible formats, and (2) the sensitivity of data within NetFlow logs can hinder the sharing of these logs and thus make it difficult for developers to get real data to use. CANINE can convert between the following NetFlow formats: Cisco NetFlow v5, v7; NFDUMP; and Argus. As an anonymizer, CANINE provides independent anonymization for each the following NetFlows fields: IP address, timestamp, port number, protocol number, byte count, and the anonymization options for each field are multi-level.

• NETI@home (NETwork Intelligence at home) is an open-source software package that collects network performance statistics from end-systems. It is named after the popular SETI@home and uses a similar distributed approach to gather these statistics. NETI@home is designed to run on end-user machines and collect various statistics about Internet performance. These statistics are then sent to a server at the Georgia Institute of Technology (Georgia Tech), where they are collected, studied, and anonymized to be made publicly available. This tool gives researchers much needed data on the end-to-end performance of the Internet, as measured from the unique perspective of end-users. Our basic approach is to sniff packets sent from or received by the monitored host and infer performance metrics based on these observed packets. NETI@home users are able to select a privacy level that will determine what types of data will be gathered, and what will not be reported. NETI@home is designed to be an unobtrusive software system that runs quietly in the background with little or no intervention by the user, and using few resources. http://www.neti.gatech.edu

• IGen is a network topology generator. We designed it to study the construction of a router-level Internet topology. Unlike BRITE or GT-ITM, IGen belongs to the family of structural topology generators. It relies on network design heuristics and operational practice to build the internal structure of each domain. We explored the utilization of network design heuristics such as MENTOR (which resembles the HOT approach), MENTour, TwoTrees and Delaunay triangulation. IGen is quite experimental but it can be obtained from the following website:
  http://www.info.ucl.ac.be/~bqu/igen

• TOTEM - A Toolbox of Traffic Engineering Methods This open-source toolbox provides a fully integrated set of traffic engineering (TE) methods for intra-domain, inter-domain, IP-based and MPLS-based TE. They are suitable for network optimisation, load balancing, protection/restoration, etc. The toolbox is designed to be used off-line in simulation mode and on-line. URL: http://totem.run.montefiore.ulg.ac.be/

• The GeoLIM project aims at providing the geographic location of an Internet host using solely its IP address. The key element of GeoLIM is its ability to transform delay measurements between landmarks (probe machines) and a target host into geographic distance constraints. Then it uses multilateration---alike GPS---to estimate the geographic location of the target host. http://planetlab-01.ipv6.lip6.fr:10000/cbg.php

• C-BGP is a BGP routing solver that can be used with large-scale topologies. By BGP routing solver, we understand a tool that computes the routes known and selected by each router in the topology once BGP has converged. C-BGP accurately reproduces the BGP decision process and it allows the definition of complex routing policies. We currently use it to reproduce the routing in an ISP (we applied it successfully on Abilene, Geant and a large french tier-1) and to evaluate what-if  scenarios such as link and router failures. We also use it to perform simulations on topologies composed of tens of thousands of routers for the purpose of evaluating BGP-based traffic engineering techniques.
  Finally, we recently used it to compute the intradomain traffic matrices of the GEANT network, starting from an IS-IS capture, the BGP routing tables and Netflow collected on all the external interfaces. http://cbgp.info.ucl.ac.be

• The IETF NSIS Working Group is developing an extensible IP signaling framework which can be used to manage various control states in network nodes for end-to-end communications, which intends to be a replacement of the current Resource Reservation Protocol (RSVP). This site provides an open source implementation for the NSIS protocol suite, released under GPL and assisted with a user manual. From 1) this GIST implementation is able to support more than 50,000 sessions simulteneously in a low-end PC testbed. http://user.informatik.uni-goettingen.de/~nsis

• GoCASP is an implementation of the Cross-Application Signaling Protocol (CASP) on the Linux operating system at the Georg-August University of Goettingen. Together with QoS signaling client protocol, it forms the  generic signaling framework which was developed by researchers from Columbia University, Siemens and University of Goettingen. It is released under the GNU General Public License and user manual is provided. GoCASP is the first publically available prototype of the generic CASP signaling framework for general purpose signaling, which was later further developed as the NSIS framework. 3) justifies the critical CASP design choices with study on performance aspects. http://user.informatik.uni-goettingen.de/~casp/

• This software provides a measurement environment to analyze network performance of Linux kernel 2.6.9 network stack. It includes a kernel patch and a packet generator, assisted with a user manual. The code is released under GPL. http://user.informatik.uni-goettingen.de/~kperf/

• Open Source Implementation of Context Transfer Protocol Using GIST: http://user.informatik.uni-goettingen.de/~nsis/release/cxtp/ This experimental software provides a Linux implementation for the Internet draft "Context Transfer Using GIST". It is based on the GIST Implementation at University of Goettingen.

• TKN Hierarchical Mobile IPv6 Implementation on Linux http://www.tkn.tu-berlin.de/research/hmip/ This experimental software provides a first open source implementation for the IETF Hierarchical MIPv6 protocol. It is based on the MIPL  implementation. MAP discovery is based on the Linux IPv6 router advertisement daemon (radvd).

• Tstat provides information about classic and novel performance indexes and statistical data about Internet traffic. From pure passive measurements, Tstat collects indexes at both the network (IP) layer and transport (TCP/UDP) layer. Real time protocols (RTP/RTCP) are also analyzed, allowing you to get statistical measurements on VOIP traffic, for example. Tstat analyzes either real-time captured packet traces, or previously recorded packet-level traces in various dump formats. Thanks to the integration with a RRD database, Tstat can be used to persistently monitor links. Results can be browsed from a simple web interface. http://tstat.tlc.polito.it

• The video trace library at http://trace.eas.asu.edu provides a large publicly available library of traces of encoded (compressed) video. The traces have been generated from encodings of over 50 videos of typically one hour length each. For each video, the library includes traces for approximately 60 different encodings in MPEG-4 (both in a single layer and two layers), H.261, and H.263, for a total of over 3000 hours worth of traces of encoded video.

• Open-source IP spoofing tester active-measurement tool used to collect data from around the Internet: http://spoofer.csail.mit.edu The results of our study are both academically and operationally relevant to current work in network architecture, policy and security. To this end, we have anonymized our data set for the wider community: http://ana.lcs.mit.edu/spoofer/

• FabiHTTP: an Open Source Implementation of HTTP/1.0 Webserver http://user.informatik.uni-goettingen.de/~teleprak/SS2005/webperf/ This HTTP/1.0 Webserver implementation is available for both Windows and  Linux versions. The code is free software and released under the GNU General Public License (GPL). Its performance has been preliminary evaluated and compared with other implementations.

• BGP++ simulation module www.ece.gatech.edu/research/labs/MANIACS/BGP++/ : The BGP++ simulation module provides a BGP implementation for ns-2 and GTNetS network simulators. BGP++ is based on Zebra bgpd, which is modified to work in simulated ns-2 and GTNetS routers. As such, it provides a full-versed implementation of BGP that supports most of the features of Zebra bgpd including the Zebra CISCO-like configuration language. Moreover, BGP++ is designed with scalability in mind. It supports parallel distributed simulations and employs efficient memory sharing data structures, which enable its user to perform detailed simulations of up to few thousands of BGP speakers.

• AS taxonomy repository http://www.ece.gatech.edu/research/labs/MANIACS/as_taxonomy/ : The AS taxonomy repository provides:
  I) a classification of ASes into one of the following classes:
       1) large ISPs,
       2) small ISPs,
       3) customer networks,
       4) universities,
       5) Internet exchange points, and
       6) network information centers; and
  II) the following set of AS attributes calculated for every AS:
       1) organization description records,
       2) advertised IP prefixes, and
       3) inferred relationship with neighboring ASes.
  The classification in Part I is a result of application of machine learning techniques to the attributes in Part II. The latter are extracted from CAIDA, RouteViews, and Internet Routing Registries data. Users of the repository can view it as a source of the Internet AS-level topology enriched with information related to the Internet economy. As such, the repository aims to promote deeper analysis of the macroscopic Internet structure and to inspire more adequate Internet modeling.

• Link-Rank BGP visualization: http://linkrank.cs.ucla.edu :Link-Rank is an open source tool developed to visualize BGP routing dynamics. Link-Rank weighs inter-AS links by the number of routes carried and produces compact visual graphs representing AS link level dynamics. The visualization not only summarizes the impact of thousands of BGP updates in one graph, but also helps identify the possible origins of the routing changes. One can also use Link-Rank to assess the impact of known events such as fiber cuts and network outages on the global routing.

• 1. Implementation of BGP in a network simulator: ns-BGP 2.0 http://www.ensc.sfu.ca/~ljilja/cnl/projects/BGP/
  ns-BGP is an implementation of BGP-4 in  ns-2 network simulator. ns-BGP was developed by porting the BGP-4 model of SSFNet to ns-2. SSFNet is a Java-based simulator for modeling large communication networks. The implementation of the BGP-4 model in the SSFNet network simulation package is called SSF.OS.BGP4. ns-BGP maintains most of the SSF.OS.BGP4 functionality, while incorporating the model into the ns-2 simulation environment.
  ns-BGP 2.0 was tested on Redhat Linux 9.0 and ns version 2.27.
  
  2. Route Flap Damping and Adaptive Minimal Route Advertisement Interval: http://www.ensc.sfu.ca/~ljilja/cnl/projects/RFD-AMRAI/ Route flap damping (RFD) is a mechanism used in BGP routers to limit the widespread propagation of unstable BGP routing information. We implemented RFD algorithms in ns-BGP 2.0 by porting the BGP-4 model of  SSFNet. Our implementation includes the two damping algorithms already implemented in SSFNet  BGP-4 v1.5.0:  Original RFD and  Selective RFD. We also implemented three additional damping algorithms: RFD+,  Modified RFD+, and  Combined RFD.
  
  The duration of the Minimal Route Advertisement Interval (MRAI) and the implementation of MRAI timers have a significant impact on the BGP convergence time. The adaptive MRAI is a mechanism that we proposed to reduce the BGP convergence time through the adaptive adjustment of MRAI values and the adoption of reusable MRAI timers. We have implemented the adaptive MRAI algorithm and the BGP processing delays (based on reported measurements) in ns-BGP 2.0.
  
   

Webmaster: Anirban Banerjee, anirban@cs.ucr.edu

[1] UCRchive coined by Dr. Michalis Faloutsos