2

Do any sample data sets exist for IPv6 traffic, e.g. Apache logs or traffic analysis logs? Alternatively does anyone have any ideas how to generate one or - optimistically - an existing tool to generate data? Ideally I would like sample addresses from real deployed ranged in proportion to how many addresses are in that range and / or expected traffic volume to / from those ranges, i.e. representative of the traffic that would go through a real-world router or web proxy or web server access log.

We're adding an IPv6 lookup to an existing project (matching subnets / address prefixes) and I was hoping to find realistic-looking IPv6 data to test / tune the implementation with. I've seen this question about lookup structures for IPv6 and skimmed the papers linked but apart from a few graphs there's little information on their test data.

I considered taking IPv4 traffic logs, reverse-DNSing all the IP(v4) addresses then perfoming an AAAA lookup on the hostnames to try and catch some IPv6 but I think the coverage would be vanishingly small - even for Google there's no IPv6 on www.google.com, you need to use ipv6.google.com instead. I could always just generate random numbers but I'd prefer to use more realistic data if possible. We don't have an IPv6-capable network of our own.

Thanks! I realise that I'm unlikely to find genuine traffic data since there's obviously privacy issues in releasing that but some sites do release IPv4 logs and I'm surprised I can't find anything.

Community
  • 1
  • 1
Rup
  • 33,765
  • 9
  • 83
  • 112
  • IPv6, DNS AAAA lookups, HTTP? This is a bit confusing, you are not explaining why ipv6.google.com is a problem. – Steve-o Sep 01 '11 at 13:04
  • @Steve-o I mean sets of IPv6 addresses showing realistic traffic patterns, ideally with sample addresses from real deployed ranged in proportion to how many addresses are in that range and / or expected traffic volume to / from those ranges. ipv6.google.com only AAAA-resolves to a single IP address as far as I can tell (or maybe a round-robin, but I'm stuck on a single address). I mentioned ipv6.google as an example reason I can't mechanically convert an IPv4 dataset into IPv6 to use. – Rup Sep 01 '11 at 13:16
  • But you are after interactive traffic? I can easily provide traffic from a one-way multicast source but it isn't an exciting pattern. – Steve-o Sep 01 '11 at 13:23
  • @Steve-o representative of the traffic that would go through a real-world router or web proxy or web server access log - i.e. an exciting pattern. – Rup Sep 01 '11 at 13:26
  • Ctrl+F for 'IPv6' on this page: http://wiki.wireshark.org/SampleCaptures – Jeremy Visser Sep 02 '11 at 03:28
  • @Jeremy Thanks - yes, I'd found that but it's mostly HTTP traffic and there's very few addresses in there. – Rup Sep 02 '11 at 09:21
  • Were you ever able to find a data set of IPv6 traffic? I'm looking for a variable dataset around 1M packets. Thanks. – vy32 Apr 17 '13 at 14:34
  • @vy32 Sorry, no. We just left the code treating all IPv6 prefixes equally and moved on to other things. – Rup Apr 17 '13 at 14:51
  • Ugh. Okay. Well, good news for me, I was able to get the data I needed from CAIDA. – vy32 Apr 18 '13 at 01:31
  • @vy32 Great - back when I looked originally the signing up seemed fairly onerous and I wasn't sure they had what I wanted anyway. – Rup Apr 18 '13 at 05:49
  • @Rup, it's not onerous — just a web form — but the data are anonymized and don't have payloads, just headers. So it's not what I need, but it did let me find a crashing bug in my program. Still looking for a source of full-content. I may need to make one. Want to help? – vy32 Apr 18 '13 at 22:59
  • @vy32 Oh, OK. I remember it being print out this form, get it signed by your CEO and fax it back. I might have it mixed up with something else. Help: I'm not sure I can, I no longer work for that company and have no access to an IPv6 network sorry. – Rup Apr 19 '13 at 08:42

2 Answers2

1

The Cooperative Association for Internet Data Analysis (CAIDA) offers a range of Anonymized packet traces from various points on the Internet. Some of the data requires signing a data sharing agreement. For more information, see http://www.caida.org/data/overview/

vy32
  • 28,461
  • 37
  • 122
  • 246
1

I doubt that such data is publicly available because of privacy concerns. Anything that is available will probably have some bits set to 0, and that will make it useless for your lookups...

Sander Steffann
  • 9,509
  • 35
  • 40
  • Well I'm mostly interested in matching address ranges / subnets so it makes no odds to me if lower bits are zeroed or randomised. – Rup Sep 01 '11 at 13:19
  • As it happened the requirement went away so I never got around to asking CAIDA. Accepting as a helpful but still unproven answer - thanks! – Rup Mar 20 '12 at 10:47