Analysis of traffic traces for stateful applications

Traffic traces are important for many kinds of network research. For reasons of confidentiality, however, publicly available traffic traces are nor-mally anonymized. This stripping of information discards vital properties of the captured traffic, rendering the traces unusable for certain network studies. Stateful networking applications are an emerg-ing class of applications in the Network Proces-sors area. The packet processing procedure for this class of applications differs significantly from that for stateless applications; thus, different sets of traffic properties are required for representative packet trace analysis. In this paper we study the differences in re-sults between analysis based on sanitized traces and real traces processed by Snort, as an exam-ple of a stateful networking application. Our re-sults demonstrate that there is, in fact, no signifi-cant difference. In addition, we analyze the impact of flow locality on the memory workload generated by Snort processing. 1