Identifying Skype Traffic in a Large-Scale Flow Data Repository

Abstract

We present a novel method for identifying Skype clients and supernodes on a network using only flow data, based upon the detection of certain Skype control traffic. Flow-level identification allows long-term retrospective studies of Skype traffic as well as studies of Skype traffic on much larger scale networks than existing packet-based approaches. We use this method to identify Skype hosts and connection events to the network in a historical flow data set containing 182 full days of data over the six years from 2004 to 2009, in order to explore the evolution of the Skype network in general and a large observed portion thereof in particular. This represents, to the best of our knowledge, the first long-term retrospective analysis of the behavior of the Skype network based solely on flow data, and the first successful application of a Skype detection algorithm to flow data collected from a production network

A tale of two outages: A study of the Skype network in distress

“…Packet-level classification techniques for Skype traffic [4], [5] followed from these. snack [10], used by this work for detecting Skype connection events using only unadorned flow data, is inspired by Adami et al [1], who built a packet-level real-time Skype traffic classifier based on reverse engineering of the protocol. Rossi et.…”

“…Normally, the number of connections per distinct client per hour, as shown in Figure 4, stays reasonably close to one, indicating little client reconnection or connection retry. Using the same data set examined in [10], we measured a long term trend in the 95th percentile of this metric from about 2.13 in 2004 to 1.31 in 2009, indicating increasing network stability over time. During the week of the outage (Tuesday 14 August through Monday 20 August, inclusive), however, the 95th percentile is 26.3 connections per client per hour.…”

“…This work uses the snack flow-based Skype detection algorithm [10]. Snack detects connection events between clients and supernodes; its output is a set of assertions that client c contacted supernode s at time t. It does this by detecting the acknowledgment of a UDP Probe flow from supernode to client, followed by a TCP handshake flow back to the supernode.…”

“…The method in [10] detects these to associations in order to detect Skype clients and supernodes in flow data. In this work, we apply this method to a flow data set from a national scale network to examine the behavior of the Skype network during two outage events.…”

“…On any given day more than twenty million users are connected to the network 1 . Given its importance, and its proprietary nature, the authors developed a lightweight method for detecting connected Skype clients using only flow data, applicable both to on-line detection or retrospective analysis in large-scale flow data sets [10].…”