Passive internally-sensed network tomography is the study of network characteristics and behavior based on observations of network traffic on a select subset of links inside the network. In this research, we identify the Subnet Discovery Problem as a key challenge in performing passive network tomography, and propose an alternating classification tree based algorithm for addressing it. This Subnet Discovery Algorithm clusters network end-hosts into CIDR style subnets without requiring prior information, and has applications for predicting network routes and for the detection of IP address spoofing. As a pre-processing technique, it has the potential to improve the performance of a variety of network tomography algorithms. We evaluate the performance of the algorithm in simulations and on real data gathered from the Abilene network.
展开▼
