Measurement and Diagnosis of Address Misconfigured P2P Traffic

Misconfigured P2P traffic caused by bugs in volunteer-developed P2P software or by attackers is prevalent. It influences both end users and ISPs. In this paper, we discover and study address-misconfigured P2P traffic, a major class of such misconfiguration. P2P address misconfiguration is a phenomenon in which a large number of peers send P2P file downloading requests to a "random" target on the Internet. On measuring three Honeynet datasets spanning four years and across five different /8 networks, we find address-misconfigured P2P traffic on average contributes 38.9% of Internet background radiation, increasing by more than 100% every year. In this paper, we design the P2PScope, a measurement tool, to detect and diagnose such unwanted traffic. After analyzing about two TB data and tracking millions of peers, We find, in all the P2P systems, address misconfiguration is caused by resource mapping contamination, i.e., the sources returned for a given file ID through P2P indexi...

• Type: Journal
• Year: 2010
• Where: INFOCOM
• Authors: Zhichun Li, Anup Goyal, Yan Chen, Aleksandar Kuzmanovic
• Keywords: Communications, INFOCOM 2010, P2P Address Misconfiguration, P2P Systems, P2P Traffic