Posted: September 13th, 2017

CNET

Paper, Order, or Assignment Requirements

Task 1: Download a packet trace from Google Drive (see notes below) and analyse it using any preferred method to determine:

• Trace characteristics: start/end, number of packets and bytes, packets and bytes rates – average values and evolution over time (max 10 points)
• Top IP addresses and transport ports (max 10 points)
• Packet size: min, max, average, standard deviation, cumulative distribution (you may want to use intervals instead of individual packet sizes; e.g. 0-64, 64-96, 96-128,128-256,256-512,512-1024,1024- bytes) (max 5 points)
• RTT: min, max, average, standard deviation, cumulative distribution (exclude zero values) (max 5 points)

Describe the commands/methods used for analysis and comment on the results. For plotting variables over time and distributions, you may use gnuplot,as well as the plot.sh and histogram.sh scripts, or any other graphing tools.

• points)

Task 2: Download a netflow trace from Google Drive (see notes below) and analyse it using any preferred method to determine:

• Identify local network and number of hosts (max 5 points)
• Evolution over time – connections, packets, and bytes rates (max 5 points)
• Top users, ports; distribution of protocols (TCP/UDP/ICMP/other) (max 10 points)
• Flow size: min, max, average, standard deviation, cumulative distribution (max 10 points)

Describe the commands/methods used for analysis and comment on the results. For plotting variables over time and distributions, you may use gnuplot,as well as the plot.sh and histogram.sh scripts, or any other graphing tools.

• points)

Task3: Generate a single web download and capture the traffic of that one TCP connection. The capture must be performed using pcap-compatible software (windump or tcpdump). The maximum size of the downloaded object must be less than 4MB. For the captured packet trace, perform the analysis tasks below:

• Describe the timeline of events within the connection (initiation, closing, transfer) using clear references to timestamps (max 10 points)
• Calculate RTT (provide three samples using SEQ/ACK matching) and bottleneck bandwidth (provide at least three samples using interarrival times) (max 10 points)
• Explain the behaviour of the sender (using the sequence of received packets), in the slow start phase; identify and explain any packet loss (max 10 points)
• Compare RTT results with tcptrace analysis output and ping/traceroute results; compare bandwidth results with speedtest.net results (max 10 points)

(40 points)