TNT Dataset

The different files in the dataset are in the binary warts format. This format is used by scamper, the measurement tool in which TNT is implemented.

The dataset for calibrating TNT has been collected on three Ark monitors. They were located in Europe (Belgium), North America (San Diego), and Asia (Tokyo). TNT was run on April 6^th, 2018 in towards a set of 30,000 destinations (randomly chosen among the whole set of Archipelago destinations list). The target list was evenly divided among the 3 monitors without any overlapping (10K per measurement point).

In this dataset, RTLA and FRPLA threshold values vary between 0 and 4 A full measurement campaign was launched for each combination of the two parameter thresholds (thus, a total of 25 measurement runs).

TNT was run in brute force mode, meaning the tool tried to reveal MPLS tunnels between IP pairs, even in none of the trigger or indicator was positive.

The dataset has the following architecture: dataset_20180406/< ij >/< VP >/< VP >-< ij >.warts, where

VP is the name of the monitor (Vantage Point)
i the FRPLA threshold value
j the RTLA threshold value

These warts files can only be read by TNT in dump mode. For more information, refer to TNT's README file and implementation.

We also collected data by deploying TNT on 28 Ark monitors on April 23^rd, 2018 with parameters FRPLA and RTLA set respectively to 3 and 1. The monitors were scattered all around the world: 9 were in Europe, 11 in North America, 1 in South America, 4 in Asia, and 3 in Australia. The overall set of destinations, nearly 2,800,000 IP addresses, was inherited from Ark's IPv4 routed /24 topology dataset, and spread over the set of measurement points (to speed up the probing process).

The dataset has the following architecture: dataset_20180423/< VP >/< VP_cycle >.warts, where

VP is the name of the monitor (Vantage Point)
VP_cycle is a measurement cycle performed by the VP. It has the following naming scheme: < unix_timestamp >.< VP >.l9.t1.20180423 with unix_timestamp being the Unix timestamp at which the measurements started.

Post-processing Python scripts are available (see the Tools page).

We also provide all GNS3 configuration files that were used for validating TNT.

Wormhole Tunnels (IMC 2017)

We provide GNS3 configuration files for the topology used to validate Hidden Hops Discovery (BRPR and DPR) algorithms. This dataset refers to work done in our IMC 2017 paper.

We also provide the data collected for detecting MPLS invisible tunnels using Hidden Hops Number techniques (FRPLA and RTLA) and Hidden Hops Discovery (BRPR and DPR).

The data has been collected, from PlanetLab, between November and December 2016.

The archive contains:

A file named ip2dns.txt mapping IP addresses observed during the campaign to their DNS name (if possible)
Five directories named groupX, with X being the number of the VP group, containing the data collected by the PlanetLab nodes

Each group contains a directory per PlanetLab VP. For each VP, the scamper warts files are located in the data directory.

Different warts files are available for each VP. Each warts file contains traces to the destinations, and pings to each intermediate hop, for obtaining routers signature (i.e., fingerprinting).

The names of the files are in the form : < vp_name >_x.warts.gz:

x = 0: traces to the HDN neighbors, and the neighbors of the HDN neighbors.
x = 1: traces to the egress nodes.
x > 2: traces to the set of IP addresses revealed at the previous step

For step x = 0, the VPs may have spread the measurement results into several warts files. In this situation, the file names for step 0 become:

< vp_name >_0.warts.gz // First set of traces
< vp_name >_0_part1.warts.gz // Second set of traces
< vp_name >_0_part2.warts.gz // Third set of traces
...