Abstract. We investigate prefix activity on peering links between a regional Internet aggregation point and two tier-1 ISPs by analyzing a 24 hour packet trace from our regional ISP. Our data shows that a small number of prefixes carry the bulk of the packets, which corroborates previous work. However, unlike previous work, which focused on traffic from backbone routers, we look at edge traffic. In addition, we look at prefix activity at fine timescales, in the order of minutes, instead of just the aggregate view, which allows us to better understand the dynamics of prefix behavior. We define two metrics to capture the dynamic behavior of prefixes: the duty cycle captures a prefix's activity, while the mean rank difference captures how busy a prefix is. This allows us to estimate not only how much traffic a prefix carries, but also how that traffic is distributed throughout the day. We expect that our work will inform new route caching strategies (to alleviate the strain from an ever expanding global routing table) and evaluation of the performance of new routing architectures such as virtual aggregation and map-n-encap.

Abstract-This paper explores the use of TCP fingerprints for identifying and blocking spammers. Evidence has shown that some bots use custom protocol stacks for tasks such as sending spam. If a receiver could effectively identify the bot TCP fingerprint, connection requests from spam bots could be dropped immediately, thus reducing the amount of spam received and processed by a mail server. Starting from a list of known spammers flagged by a commercial reputation list, we fingerprinted each spammer and found the roughly 90% have only a single known fingerprint typically associated with well known operating system stacks. For the spammers with multiple fingerprints, a particular combination of native/custom protocol stack fingerprints becomes very prominent. This allows us to extract the fingerprint of the custom stack and then use it to detect more bots that were not flagged by the commercial service. We applied our methodology to a trace captured at our regional ISP, and clearly detected bots belonging to the Srizbi botnet.

No abstract

No abstract