WITS: NZIX-II
| Trace Format | Legacy Ethernet, captured using a DAG 3 card. |
| Volume on Disk | 28 GB |
| Number of Traces | 16 |
| Capture Start (Local) | Tue Jun 27 18:33:03 2000 |
| Capture End (Local) | Mon Jul 10 15:29:05 2000 |
| Total Duration | 7 Days, 3 Hours, 45 Minutes and 7 Seconds |
| Packets Captured | 1,226 million |
| Total Traffic | 272 GB |
| Contiguity | 5 days of contiguous trace, plus a few extra non-contiguous traces thrown in. |
| Snapping Method | All records are 64 bytes long, but any data beyond the transport header is zeroed. |
| Rotation Policy | Files rotated every 12 hours, based on Midnight local time |
| Anonymization | IP addresses all mapped non-reversibly into 10.X.X.X address space |
This is a collection of GPS-synchronized IP header traces captured using a DAG32E at the New Zealand Internet Exchange. NZIX was hosted by the ITS department at the University of Waikato and served as a peering point among a number of larger New Zealand ISPs. When the measurements were taken in July 2000, the following parties were connected:
- Telecom New Zealand
- Clear Communications
- Telstra New Zealand
- Asia Online New Zealand (ICONZ)
- AT&T New Zealand
- University of Waikato, including a number of smaller organizations
At the time, NZIX consisted of two Cisco 2926 26 port 10/100 autosensing Ethernet switches running spanning tree for redundancy. Each ISP had their own WAN circuits back to their respective locations, either in Auckland or Wellington. The DAG monitor was connected to a SPAN port via 100BaseTx FastEthernet.
As a result, timestamps in the traces are skewed compared to their arrival or departure times at the input/output ports of the switch as the total capacity of the switch is higher than the monitoring uplink. Packets arriving from different ports at the same time needed to be queued (or dropped) before being delivered to the SPAN port. It is possible that traffic was lost before being monitored, but we estimate that the chance of this is fairly low because the total bandwidth at the switch peaked at around 10-12 MBits/sec.
Each trace file is named using the following format: yyyymmdd-HHMMSS.gz. The time and date refers to the local time when the capture was started. Both directions are contained within the trace but the legacy DAG formats do not support differentiating between directions.
All non-IP traffic has been discarded and only TCP, UDP and ICMP traffic is present in the trace. Any user payload within the 64 byte capture record has been zeroed.
The traces have been anonymized by mapping the IP addresses into network 10.X.X.X in a non-reversible way. This mapping is preserved across all the traces in the dataset, so IP addresses that are identical in the real world are identical in different traces. Checksums are not anonymized in any way.
The recommended method for processing these traces is to use Libtrace, which we have developed. There are a number of tools included with libtrace such as a packet dumping utility, a trace format converter (for example, to convert to pcap), a trace splitting/filtering tool and a few statistic generators. We suggest you examine the Libtrace Wiki for more details on the Libtrace tools and the library itself.
| Name | Local Start Time | Duration | Total Packets | Compressed Size |
|---|---|---|---|---|
| 20000627-183303 | Tue Jun 27 18:33:03 2000 | 3:39:03 | 33 million | 791 MB |
| 20000627-221321 | Tue Jun 27 22:13:21 2000 | 3:58:44 | 32 million | 701 MB |
| 20000630-143348 | Fri Jun 30 14:33:48 2000 | 0:55:50 | 11 million | 319 MB |
| 20000703-163000 | Mon Jul 3 16:28:05 2000 | 20:56:37 | 145 million | 3,461 MB |
| 20000704-171000 | Tue Jul 4 17:11:43 2000 | 22:14:51 | 162 million | 4,424 MB |
| 20000705-152900 | Wed Jul 5 15:29:00 2000 | 8:30:59 | 83 million | 2,020 MB |
| 20000706-000000 | Thu Jul 6 00:00:00 2000 | 12:00:00 | 66 million | 1,530 MB |
| 20000706-120000 | Thu Jul 6 12:00:00 2000 | 12:00:00 | 124 million | 3,011 MB |
| 20000707-000000 | Fri Jul 7 00:00:00 2000 | 12:00:00 | 65 million | 1,484 MB |
| 20000707-120000 | Fri Jul 7 12:00:00 2000 | 12:00:00 | 116 million | 2,806 MB |
| 20000708-000000 | Sat Jul 8 00:00:00 2000 | 12:00:00 | 51 million | 1,111 MB |
| 20000708-120000 | Sat Jul 8 12:00:00 2000 | 12:00:00 | 88 million | 2,028 MB |
| 20000709-000000 | Sun Jul 9 00:00:00 2000 | 12:00:00 | 46 million | 992 MB |
| 20000709-120000 | Sun Jul 9 12:00:00 2000 | 12:00:00 | 95 million | 2,194 MB |
| 20000710-000000 | Mon Jul 10 00:00:00 2000 | 12:00:00 | 64 million | 1,459 MB |
| 20000710-120000 | Mon Jul 10 12:00:00 2000 | 3:29:06 | 41 million | 1,025 MB |