Experiences of Internet traffic monitoring with tstat

Abstract

Network monitoring has always played a key role in understanding telecommunication networks since the pioneering time of the Internet. Today, monitoring traffic has become a key element to characterize network usage and users' activities, to understand how complex applications work, to identify anomalous or malicious behaviors. In this paper, we present our experience in engineering and deploying Tstat, a free open source passive monitoring tool that has been developed in the past ten years. Started as a scalable tool to continuously monitor packets that flow on a link, Tstat has evolved into a complex application that gives to network researchers and operators the possibility to derive extended and complex measurements via advanced traffic classifiers. After discussing Tstat capabilities and internal design, we present some examples of measurements collected deploying Tstat at the edge of several ISP networks in the past years. We then discuss the scalability issues that software based tools have to cope with when deployed in real networks, showing the importance of properly identifying bottlenecks.

Characterizing the file hosting ecosystem: A view from the edge

“…In response, Hotfile started terminating accounts of publishers suspected of repeated copyright infringement. Recent measurements from a Polish and a Hungarian ISP suggest a migration away from popular services such as RapidShare [9]. This migration, potentially due to changes in the reward policies, may suggest that users are migrating to other file hosting services and/or to new variants of P2P services, including UDP-based BitTorrent applications [9].…”

“…Recent measurements from a Polish and a Hungarian ISP suggest a migration away from popular services such as RapidShare [9]. This migration, potentially due to changes in the reward policies, may suggest that users are migrating to other file hosting services and/or to new variants of P2P services, including UDP-based BitTorrent applications [9]. This behaviour is reminiscent of the stickiness property of Web sites, where users will stick to a site that serves them adequately until another competitive site offers better alternatives [32].…”

Unveiling network and service performance degradation in the wild with mplane

“…In addition, mPlane offers support for passive and hybrid measurements. For instance, in this paper we leverage passive measurements collected by Tstat [5] to compare with active test (see Sec. V-A) and to feed the anomaly detection algorithms with rich information about the status of complex platforms, as the YouTube infrastructure (see Sec.…”

“…In more details, the passive probe used in all fixed-line scenarios is Tstat [5]. Tstat is an open source packet analyzer capable of monitoring links up to several Gb/s speed using commodity hardware.…”

Online Traffic Measurement and Analysis in Big Data: Comparative Research Review

“…Tstat is an open-source traffic analysis tool which comprises of an application-level classification component, Founded on deep packet inspection (Finamore et al, 2011). Contrary to other tools, Tstat does not aim at classification as major goal.…”