Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX (Short Paper)

Elich, Martin; Gregr, Matej; Čeleda, Pavel

doi:10.1007/978-3-642-20305-3_6

Cited by 5 publications

(6 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To perform a thorough inspection of tunneled traffic, we need to decapsulate packet headers of inner packets. We use the same flow-based framework as in [7] which has been further modified [8] to extract more detailed information from tunneled data. The main part of the framework is a plug-in which replaces input and processing parts of existing flow generator INVEA FlowMon Exporter [10].…”

Section: Methodology and Measurement Setupmentioning

confidence: 99%

See 1 more Smart Citation

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Elich

Velan

Jirsík

et al. 2013

38th Annual IEEE Conference on Local Computer Networks - Workshops

Self Cite

View full text Add to dashboard Cite

The exhaustion of IPv4 address space increases pressure on network operators and content providers to continue the transition to IPv6. The IPv6 transition mechanisms such as Teredo and 6to4 allow IPv4 hosts to connect to IPv6 hosts. On the other hand, they increase network complexity and render ineffective many methods to observe IP traffic. In this paper, we modified our flow-based measurement system to involve transition mechanisms information to provide full IPv6 visibility. Our traffic analysis focuses on IPv6 tunneled traffic and uses data collected over one week in the Czech national research and education network. The results expose various traffic characteristics of native and tunneled IPv6 traffic, among others the TTL and HOP limit distribution, geolocation aspect of the traffic, and list of Teredo servers used in the network. Furthermore, we show how the traffic of IPv6 transition mechanisms has evolved since 2010.

show abstract

Section: Methodology and Measurement Setupmentioning

confidence: 99%

“…The overall statistics of IPv6 and tunneled traffic are mentioned. We provide a historical comparison to our previous measurement [7].…”

Section: Evaluation Of Ipv6 Adoptionmentioning

confidence: 99%

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Elich

Velan

Jirsík

et al. 2013

38th Annual IEEE Conference on Local Computer Networks - Workshops

Self Cite

View full text Add to dashboard Cite

show abstract

“…As studies closely related to this research, we introduce studies on observing and classifying traffic [1,2,6,[9][10][11][12][13][14][15], anomaly detection based primarily on traffic analysis [16][17][18][19][20][21][22][23][24][25][26][27][28][29][30], and traffic generation [31][32][33][34][35][36][37][38][39]. The taxonomy of traffic measurements and time-series traffic analyses, which are particularly relevant to this study, is presented in Table I.…”

Section: Related Workmentioning

confidence: 99%

Network Anomaly Detection Through IP Traffic Analysis With Variable Granularity

Kamamura,

Takei,

Nishiguchi

et al. 2023

IEEE Access

View full text Add to dashboard Cite

A network anomaly detection method is proposed for large-scale, wide-range Internet Protocol (IP) networks. Because network behavior is projected onto communication traffic, anomaly detection can be achieved by properly analyzing the communication traffic flows. However, in wide-area IP networks, communication traffic flows are encapsulated by headers assigned by communication carriers and thus are observed as more macroscopic information. Therefore, accurately detecting the occurrence of anomalies in individual communication flows is difficult because the flow observation results obtained by flow measurement protocols such as IP Flow Information Export (IPFIX) are the result of superimposing various communication flows with different characteristics. In this study, we propose an anomaly-detection method based on time-series traffic flows. First, we decompose superimposed traffic flows into individual flows using our implemented system called the Fast xFlow Proxy, which can decompose traffic flows to a fine granularity. Our method detects anomalies in the decomposed flows based on a simple correlation analysis and dynamic threshold configuration. Our extensive simulation shows that, if we observe individual flows using the Fast xFlow Proxy, our method can detect anomalies caused by service failures with almost 100% accuracy. Our method can achieve an accuracy of approximately 80%-90% even in more difficult detection cases, such as small traffic fluctuations or noisy situations.

show abstract

“…To perform a thorough inspection of tunneled traffic of the IPv6 transition mechanisms, we need to decapsulate packet headers of inner packets. In [2], we extend the approach described in [19] and modify it to extract more detailed information from tunneled data. Resulting IP flow records provide us with information about the encapsulated source and destination addresses, ports and transport protocol, which is a common five-tuple used to distinguish individual flows.…”

Section: A Network Traffic Tunnelingmentioning

confidence: 99%

Cyber Situation Awareness via IP Flow Monitoring

Jirsík

Čeleda

2020

NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

Cyber situation awareness has been recognized as a vital requirement for effective cyber defense. Cyber situation awareness allows cybersecurity operators to identify, understand, and anticipate incoming threats. Achieving and maintaining the cyber situation awareness is a challenging task given the continuous evolution of the computer networks, increasing volume and speeds of the data in a network, and rising number of threats to network security. Our work contributes to the continuous evolution of cyber situation awareness by the research of novel approaches to the perception and comprehension of a computer network. We concentrate our research efforts on the domain of IP flow network monitoring. We propose improvements to the IP flow monitoring techniques that enable the enhanced perception of a computer network. Further, we conduct detailed analyses of network traffic, which allows for an in-depth understanding of host behavior in a computer network. Last but not least, we propose a novel approach to IP flow network monitoring that enables real-time cyber situation awareness.

show abstract

Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX (Short Paper)

Cited by 5 publications

References 10 publications

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Network Anomaly Detection Through IP Traffic Analysis With Variable Granularity

Cyber Situation Awareness via IP Flow Monitoring

Contact Info

Product

Resources

About