Report from the Passive and Active Measurement Conference 2012

http://pam2012.ftw.at/

PAM is the oldest Internet measurement conference, started in 2000. This year’s edition took place in Vienna in March 2012.

The keynote was given by Yuval Shavitt (Tel Aviv University) on “Internet Topology Measurement: Past, Present, Future”. Topology measurements are still an active area of research, as our visibility of the Internet topology is still limited, and subject to significant biases whose impact is still being investigated by the research community.

Session on Malicious Behavior
- Detecting Pedophile Activity in Bittorent Networks: P2P networks are used for various illegal activities, such as pedophile.
- Re-Wiring Activity of Malicious Networks: Malicious networks tend to loose their connectivity when their activities are spotted. This study looks at the visibility of network re-wiring.

Session on Traffic Evolution and Analysis
- Unmasking the Growing UDP Traffic in a Campus Network: UDP traffic is becoming more and more popular, for example in China it has been reported to be as high as 80% is some networks. This paper provides similar evidence from Korea.
- Investigating IPv6 Traffic—What happened at the World IPv6 Day? Despite efforts such as the IPv6 world day, there is still little IPv6 traffic in the Internet. This paper studies what happened during the IPv6 World Day based on two vantage points, one campus network in the US and a large IXP in Germany.
- An End-Host View on Local Traffic at Home and Work: This paper compares local and wide-area traffic from end-hosts connected to different home and work networks.
- Comparison of User Traffic Characteristics on Mobile-Access versus Fixed-Access Networks: Mobile traffic is growing, and we still do not know much about how it differs from traffic seen on wired networks.

Session on Evaluation Methodology
- SyFi: A Systematic Approach for Estimating Stateful Firewall Performance: Firewalls are pervasive in today’s Internet given the need to protect networks from attacks. This paper builds a predictive model of the throughput achieved by commercial firewalls.
- OFLOPS: An Open Framework for OpenFlow Switch Evaluation: Current OpenFlow implementations have different levels of maturity. This work proposes a framework to test OpenFlow implementations capabilities.
- Probe and Pray: Using UPnP for Home Network Measurements: UPnP is nowadays becoming a popular active measurement platform. This paper studies the limitations as well as the usefulness of this platform.

Session on Large Scale Monitoring
- BackStreamDB: A Distributed System for Backbone Traffic Monitoring Providing Arbitrary Measurements in Real-Time. Distributed approaches for traffic monitoring are the future. Nice piece of work.
- A Sequence-oriented Stream Warehouse Paradigm for Network Monitoring Applications. Mining large-scale data is a pain, and networking is no exception. This paper proposes SQL extensions to ease the monitoring of networks by allowing to express sequence-oriented queries in a declarative language.
- PFQ: a Novel Engine for Multi-Gigabit Packet Capturing With Multi-Core Commodity Hardware. Unleashing the power of multi-cores to deliver amazing packet copying to user-space apps!

Session on New Measurement Initiatives
- Difficulties in Modeling SCADA Traffic: A Comparative Analysis: One of the few measurements of M2M traffic. Nothing surprising in terms of traffic properties, given the small scale of these traffic traces.
- Characterizing delays in Norwegian 3G networks: Yet another study of 3G networks. The talk generated heated comments on the limitations of the methodology.
- On 60 GHz Wireless Link Performance in Indoor Environments: Studies the use of 60 GHz wireless indoors and the conditions under which it works (LOS and NLOS). Pretty positive results…
- Geolocating IP Addresses in Cellular Data Networks: Very interesting geolocation paper that confirms previous work on the issues with geolocation databases.

Session on Reassessing Tools and Methods
- Speed Measurements of Residential Internet Access. How do bandwidth probing tools compare when using them to measure the available bandwidth of residential users?
- One-way Traffic Monitoring with iatmon. Using one-way delay measurements to track changes in traffic behavior and classifying different traffic sources.
- A Hands-on Look at Active Probing using the IP Prespecified Timestamp Option. IP options are not very widely used, despite their potential applicability. This work shows more evidence for the discrepancy between RFC and implementations.

Application Protocols
- Xunlei: Peer-Assisted Download Acceleration on a Massive Scale. A must-read: one of the pieces of the future in content delivery platforms!
- Pitfalls in HTTP Traffic Measurements and Analysis. What you should not trust from packet-level data when analyzing HTTP traces.
- A Longitudinal Characterization of Local and Global BitTorrent Workload Dynamics. Nice study of different types of content delivered through BitTorrent (file size, throughput, type of content).

Perspectives on Internet Structure and Services
- Exposing a Nation-Centric View on the German Internet – A Change in Perspective on the AS Level. Trying to define the AS-level ecosystem of Germany, still unclear whether it makes any sense, even though many defense agencies would like to be able to define it.
- Behavior of DNS’ Top Talkers, a .com/.net View. First ever analysis of the .com and .net TLD servers. Very interesting observations about IPv6 DNS, as well as the set of DNS resolvers that are the top talkers with the TLD servers. Must-read for DNS.
- The BIZ Top-Level Domain: Ten Years Later. Thinking about what will happen with the biz domain given the last 10 years or its use, especially defensive registrations. Must-read for DNS.