Citation Context

...dhence connection arrival processes), durations, TCP protocol, participating hosts, and data bytes transferred in each direction. The BC and UCB traces are analyzed in depth in [DJCME92], and also in =-=[P94a], and-=- the UCB trace forms the basis of the connection characteristics used for Tcplib [DJ91]. The NC, UK, and DEC traces are analyzed in [P94a], and the LBL traces are analyzed in [P94a, P94b]. The "D...

Citation Context

...in all cases they were. 2.2.1 Testing for Infinite Variance There is evidence that, over their entire range, many of the distributions we study may be well characterized using lognormal distributions =-=[19]-=-. However, lognormal distributions do not have infinite variance, and hence are not heavy-tailed. In our work, we are not concerned with distributions over their entire range--only their tails. As a r...

Citation Context

...ly-functioning TCP will always retransmit the same data as originally sent, so any disagreement is either due to a broken TCP, undetected data corruption (i.e., corruption the checksum fails to catch), or an attack. We have argued that the monitor must retain a record of previously transmitted data, both in-sequence and out-ofsequence. The question now arises as to how long the monitor must keep this data around. If it keeps it for the lifetime of the connection, then it may require prodigious amounts of memory any time it happens upon a particularly large connection; these are not infrequent [Pa94]. We instead would like to discard data blocks as soon as possible, to reclaim the associated memory. Clearly, we cannot safely discard blocks above a sequencing hole, as we then lose the opportunity to scan the text that crosses from the sequence hole into the block. But we would like to determine when it is safe to discard in-sequence data. Here we can make use of our assumption that the attacker controls only one of the connection endpoints. Suppose the stream of interest flows from host A to host B. If the attacker controls B, then they are unable to manipulate the data packets in a subter...

Citation Context

... and Claffy [4]. A more rigourous study shows that the observed file size distributions match well with the Pareto distribution [11, 17], for ff ! 1. This observation has been noted in the literature =-=[6, 16]-=-, and is confirmed in all six of our data sets. In particular, the tails of the distributions (for file sizes larger than 1024 bytes) are Pareto with 0:40sffs0:63. This characteristic is present in al...

Citation Context

...sions to pathchar's techniques using the same data. Our example paths, and the 11 links that comprise them, are not intended to be a statistical sample of the Internet (cf. Paxson's empirical studies =-=[3, 4]-=-). But the structure of these paths is probably typical of many---a fast local network connected through a comparatively slow link to the Internet proper, connected to the destination site through ano...

Citation Context

...her unintended phase effects as well.) Synchronization to an external clock. Two processes can become synchronized with each other simply by both being synchronized to an external clock. For example, =-=[Pa93a]-=- shows DECnet traffic peaks on the hour and half-hour intervals; [Pa93b] shows peaks in ftp traffic as several users fetch the most recent weather map from Colorado every hour on the hour. Client-serv...

Citation Context

... provides the cumulative frequency histogram of the unique file sizes. We have applied a logarithmic transformation to the file sizes to enable us to identify patterns across the wide range of values =-=[32]-=-. For a log 2 transformation, bin i includes values in the range 2 i ≤ x<2 i+1 -1. Similarly, for a log 10 transformation, bin i includes values in the range 10 i ≤ x<10 i+1 -1. Figure 3(a) indicates ...