Appmon: An Application for Accurate Per-Application Network Traffic Characterization

Accurate per-application network traffic characterization is becoming in-creasingly difficult in the face of emerging applications that use dynami-cally negotiated port numbers. At the same time, information about the contribution of different network applications and services to the traffic mix is highly demanded by network administrators for facilitating effective net-work management and traffic engineering. In this thesis we present appmon, a passive monitoring application for per-application network traffic classification. Appmon uses deep packet inspection to accurately attribute traffic flows to the applications that gen-erate them, and reports in real time the network traffic breakdown through a Web-based GUI. Appmon manages to classify traffic up to Gigabit speeds and shows a steady performance when monitoring a real network environ-ment. Appmon is easy to configure and deploy, and is publicly available as an open source application. Using appmon deployed sensors we were able to collect a large amount of traffic data. We present the results extracted from the analysis of data collected from the academic networks of three different countries and try to understand the trends in real world networks. Supervisor: Professor Evangelos Markatos iii iv GR v v