Transport layer identification of P2P traffic

ABSTRACT

Since the emergence of peer-to-peer (P2P) networking in the late '90s, P2P applications have multiplied, evolved and established themselves as the leading `growth app' of Internet traffic workload. In contrast to first-generation P2P networks which used well-defined port numbers, current P2P applications have the ability to disguise their existence through the use of arbitrary ports. As a result, reliable estimates of P2P traffic require examination of packet payload, a methodological landmine from legal, privacy, technical, logistic, and fiscal perspectives. Indeed, access to user payload is often rendered impossible by one of these factors, inhibiting trustworthy estimation of P2P traffic growth and dynamics. In this paper, we develop a systematic methodology to identify P2P flows at the transport layer, i.e., based on connection patterns of P2P networks, and without relying on packet payload. We believe our approach is the first method for characterizing P2P traffic using only knowledge of network dynamics rather than any user payload. To evaluate our methodology, we also develop a payload technique for P2P traffic identification, by reverse engineering and analyzing the nine most popular P2P protocols, and demonstrate its efficacy with the discovery of P2P protocols in our traces that were previously unknown to us. Finally, our results indicate that P2P traffic continues to grow unabatedly, contrary to reports in the popular media.

REFERENCES

• 1: A.Broido, Y.Hyun, R.Gao, and kc claffy. Their share: diversity and disparity in IP traffic. In PAM, 2004.
• 2: Ares. http://www.softgap.com/.
• 3: R. Bhagwan, S. Savage, and G. Voelker. Understanding Availability. In IPTPS 03, 2003.
• 4: BitTorrent. http://bitconjurer.org/BitTorrent/.
• 5: John Borland. RIAA threat may be slowing file swapping. "http://news.com.com/2100-1027-1025684.html".
• 6: K. Claffy, H.-W. Braun, and G. Polyzos. A Parametrizable methodology for Internet traffic flow profiling. In IEEE JSAC, 1995.
• 7: Direct Connect. http://www.neo-modus.com/.
• 8: C.Fraleigh e.a. Packet-Level Traffic Measurements from the Sprint IP Backbone. In IEEE Network, 2003.
• 9: J.E.Gabeiras e.a. Estrategias para influir en el tr'afico p2p. Telefonica Investigaci'on y Desarrollo, whitepaper, 2004.
• 10: eDonkey2000. http://www.edonkey2000.com/.
• 11: eMule. http://www.emule-project.net/.
• 12: Endace, 2004. www.endace.com.
• 13: C. Gkantsidis, M. Mihail, and A. Saberi. Random Walks in Peer-to-Peer Networks. In INFOCOM, 2004.
• 14: I.Graham, M.Pearson, J.Martens, and S.Donnelly. Dag - a cell capture board for ATM measurement systems, 1997. wand.cs.waikato.ac.nz.
• 15: M. Izal, G. Urvoy-Keller, E.W. Biersack, P.A. Felber, A. Al Hamra, and L. Garc'es-Erice. Dissecting BitTorrent: Five Months in a Torrent's Lifetime. In PAM, 2004.
• 16: Joltid. http://www.joltid.com.
• 17: T. Karagiannis, A.Broido, N.Brownlee, kc claffy, and M.Faloutsos. Is P2P dying or just hiding? In IEEE Globecom 2004 - Global Internet and Next Generation Networks, 2004.
• 18: T. Karagiannis, A. Broido, N. Brownlee, kc claffy, and M. Faloutsos. File-sharing in the Internet: A characterization of P2P traffic in the backbone. Technical report., 2004. http://www.cs.ucr.edu/~tkarag.
• 19: P. Karbhari, M. Ammar, A. Dhamdhere, H.Raj, G. Riley, and E. Zegura. Bootstrapping in Gnutella: A Measurement Study. In PAM, 2004.
• 20: K. Keys, D. Moore, R. Koga, E. Lagache, M. Tesch, and k. claffy. The architecture of the CoralReef: Internet Traffic monitoring software suite. In PAM, 2001.
• 21: K.Tutschku. A Measurement-based Traffic Profile of the eDonkey Filesharing Service. In PAM, 2004.
• 22: N. Leibowitz, A. Bergman, Roy Ben-Shaul, and Aviv Shavit. Are File Swapping Networks Cacheable? Characterizing P2P Traffic. In 7th IWCW, 2002.
• 23: David Moore , Ken Keys , Ryan Koga , Edouard Lagache , K. C. Claffy, The CoralReef Software Suite as a Tool for System and Network Administrators, Proceedings of the 15th USENIX conference on System administration, December 02-07, 2001, San Diego, California
• 24: MP2P. http://www.slyck.com/mp2p.php.
• 25: W. B. Norton. The evolution of the u.s. internet peering ecosystem, 2003. http://www.equinix.com/pdf/whitepapers/PeeringEcosystem.pdf.
• 26: Pew Internet & American Life Project. Sharp decline in music file swappers: Data memo from PIP and comScore Media Metrix, January, 2004. http://www.pewinternet.org/reports/.
• 27: S. Saroiu, P. K. Gummadi, and S. D. Gribble. A Measurement Study of Peer-to-Peer File Sharing Systems. In MMCN, 2002.
• 28: Subhabrata Sen , Oliver Spatscheck , Dongmei Wang, Accurate, scalable in-network identification of p2p traffic using application signatures, Proceedings of the 13th international conference on World Wide Web, May 17-20, 2004, New York, NY, USA [doi>10.1145/988672.988742]
• 29: Subhabrata Sen , Jia Wang, Analyzing peer-to-peer traffic across large networks, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637222]
• 30: Soulseek. http://www.slsknet.org/.
• 31: tcpdump. http://www.tcpdump.org/.
• 32: WinMx. http://www.winmx.com/.
• 33: Jun Xu , Jinliang Fan , Mostafa H. Ammar , Sue B. Moon, Prefix-Preserving IP Address Anonymization: Measurement-Based Security Evaluation and a New Cryptography-Based Scheme, Proceedings of the 10th IEEE International Conference on Network Protocols, p.280-289, November 12-15, 2002

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.5 Local and Wide-Area Networks

General Terms:
Algorithms, Measurement

Keywords:
measurements, peer-to-peer, traffic classification