



CAIDA's passive traces dataset contains traces collected from high-speed monitors on a commercial backbone link. The data collection started in April 2008 and ended in January 2019. These data are useful for research on the characteristics of Internet traffic, including application breakdown, security events, geographic and topological distribution, flow volume and duration. For an overview of all traces see the trace statistics page)
The CAIDA Anonymized Internet Traces 2008 Dataset
This dataset contains anonymized passive traffic traces from CAIDA's equinix-chicago and equinix-sanjose monitors on OC192 Internet backbone links. This data is useful for research on the characteristics of Internet traffic, including application breakdown, security events, topological distribution, and flow volume and duration.
Traffic traces in this dataset are anonymized using CryptoPan prefix-preserving anonymization. All traces in this dataset are anonymized with the same key. In addition, the payload has been removed from all packets.
The traces can be read with any software that reads the pcap (tcpdump) format, including the CoralReef Software Suite, tcpdump, Wireshark, and many others.
The first traffic trace available is a 1 hour traffic trace collected during the DITL 2008 measurement event. This trace contains anonymized packet headers in pcap format on a single direction of the bidirectional OC192 link at equinix-chicago from approximately 2008-03-19 19:00 to 20:00 UTC. The hardware monitoring the other direction of the link was not functioning properly at the time of the traffic capture, so only data for a single direction was captured.
Additionally, a 6 hour traffic trace was also collected during DITL 2008 on the same single direction of the bidirectional OC192 link from 2008-03-19 00:00 to 06:00 UTC. Due to the volume of this trace (almost 400 GiB compressed) we have not (yet) made this trace part of this dataset.
For the equinix-chicago monitor, the first monthly bidirectional traffic trace was taken on April 30 2008, and added to the Anonymized 2008 Internet Trace dataset in June 2008. This 1 hour trace resulted in 83 GB of compressed pcap files. The first monthly bidirectional traffic trace from the equinix-sanjose monitor was taken on July 17 2008.
We are aware that some data in this dataset contains more then trivial amounts of packet loss; this has especially been an issue for equinix-chicago direction B. Due to the way the monitoring equipment is set up the synchronization between directions we don't know how well-aligned both directions of a single link are. We plan to provide more metadata on synchronization between directions and packet loss in the traces in the near future.
CAIDA makes near-realtime traffic reports available from its passive monitors.
Acceptable Use Agreement
Access to these data is subject to the terms of the following CAIDA Acceptable Use Agreement (printable version in PDF format)
When referencing this data (as required by the AUA), please use:
The CAIDA UCSD Anonymized Internet Traces 2008 - <insert dates used here>Also, please, report your publication to CAIDA.
https://www.caida.org/data/passive/passive_2008_dataset.xmlRequest Data Access
Request Access to the CAIDA Anonymized Internet Traces 2008 Dataset and other Anonymized Internet Traces Datasets
Anonymized Internet Traces Datasets
Restricted Datasets (available through CAIDA)
- Anonymized Internet Traces Dataset (April 2008 - January 2019)
- Anonymized Internet Traces on IPv6 Day and IPv6 Launch Day Dataset
- Anonymized Industry Evaluation Internet Traces Dataset
Publicly Available Datasets
- Summary statistical information for all anonymized internet traces
- Anonymized OC48 Peering Point Traces Dataset
The Data Collection Monitors