The traces released here contain all incoming anonymous FTP
connections (i.e. to port 21) to public FTP servers at the Lawrence
Berkeley National Laboratory during a ten-day period.
The traces are in
The trace ran from Jan 10-19, 2003, containing 22 thousand connections
and 3.2 million packets. The connections are between 320 distinct
servers and 5832 distinct clients.
The traces have been "sanitized" using the Bro anonymizer to
remove private information, such as passwords and remote client
The description of the tool can be found in the publication below, and
the detailed anonymization scheme is described here.
The traces were made by Ruoming Pang (firstname.lastname@example.org)
and Vern Paxson (email@example.com).
please include an appropriate citation to the paper mentioned below.
The effort of anonymizing these traces is described in the paper:
Ruoming Pang, Vern Paxson.
A High-level Programming Environment for Packet Trace Anonymization
. Proc. ACM SIGCOMM 2003.
The traces may be freely redistributed.
Available from the Archive as
- 16 separate trace files, each spanning either approximately a day
(e.g., lbnl.anon-ftp.03-01-10 spans January 10, 2003) or in a pair
spanning a day (e.g., lbnl.anon-ftp.03-01-12A and lbnl.anon-ftp.03-01-12B
together span January 12, 2003, with the 'A' trace being followed after
a short gap by the 'B' trace):
- One glued-together trace file (which has some gaps, as the traces
don't quite overlap):
lbnl.anon-ftp.Jan10-19.2003 (84 MB; 310 MB uncompressed).
Traces In The Internet Traffic