Host Measurement of Network Traffic

In modern passive network measurement, flow-based analyses have been widely used. In this paper, we regard 'hosts' as aggregations of flows, and investigate host rather than flow-based measurements. We show that analyzing host behaviors contribute significantly to better understanding of network behavior, thus it is a feasible study that should be of interest to both researchers and network operators. By empirically exploring two university edge networks, our findings suggest that up to 40% of the unique hosts re-enters the network, and many of those tend to do so within three hours. Furthermore, at least 20% of all hosts are active for between 0.1s and 10s, and only a quarter of the hosts stay in the network for more than 10s. Additionally, many hosts are identified as abnormal, producing many flows despite being short-lived. Lastly, we examine the correlations between numerous host attributes to find relationships; for instance, host size and size-rate are highly positive-correlated.