Recent studies observed video download platforms which contribute a large share to the overall traffic mix in today's operator networks. Traffic related to video downloads has reached a level where operators, network equipment vendors, and standardization organizations such as the IETF start to explore methods in order to reduce the traffic load in the network. Success or failure of these techniques depend on caching potentials of the target applications' traffic patterns. Our work aims at providing detailed insight into caching potentials of one of the leading video serving platforms: YouTube. We monitored interactions of users of a large operator network with the YouTube video distribution infrastructure for the time period of one month. From these traffic observations, we examine parameters that are relevant to the operation and effectiveness of an in-network cache deployed in an edge-network. Furthermore, we use our monitoring data as input for a simulation and determine the caching benefits that could have been observed if caching had been deployed.

The performance of a mesh network is mainly affected by the utilized routing protocol and its capability to detect topology changes and to select stable and reliable routes. In real-world scenarios, a high fraction of links have asymmetric characteristics which has to be concerned by routing protocols in order to find optimized routes. The latest version of the Better Approach to Mobile Adhoc Networking protocol (B.A.T.M.A.N.) introduces its own routing metric, addressing the problem of integrating asymmetric links efficiently in the network topology. In this work, we compare version III and IV of the B.A.T.M.A.N protocol in terms of delivery ratio, average end-to-end hop count and generated overhead in two scenarios with a high fraction of asymmetric links to assess the quality of the newly introduced mechanisms on the performance of the protocol.

The SSL and TLS infrastructure used in important protocols like HTTPs and IMAPs is built on an X.509 public-key infrastructure (PKI). X.509 certificates are thus used to authenticate services like online banking, shopping, e-mail, etc. However, it always has been felt that the certification processes of this PKI may lack in stringency, resulting in a deployment where many certificates do not meet the requirements of a secure PKI.

Capturing network traffic with commodity hardware has become a feasible task: Advances in hardware as well as soft- ware have boosted off-the-shelf hardware to performance levels that some years ago were the domain of expensive special-purpose hardware. However, the capturing hardware still needs to be driven by a well-performing software stack in order to minimise or avoid packet loss. Improving the capturing stack of Linux and FreeBSD has been an extensively covered research topic in the past years. Although the majority of the proposed enhancements have been backed by evaluations, these have mostly been conducted on different hardware platforms and software versions, which renders a comparative assessment of the various approaches difficult, if not impossible.

During the last years the application areas and corresponding requirements for Wireless Sensor Networks (WSN) raised due to limited resources of devices and requirements of the application. The scenarios (e.g. home networks) call for an integration of a WSN into an existing IP-based infrastructure which is realized by 6LoW-PAN. To save resources and to ensure a long life time of the WSN resource consuming tasks such as transmissions must be reduced. Therefore, we present a Compressed IPFIX protocol. It optimizes the transmission by reducing the packet size and the transmission amount by separation between meta information and data. Additional tasks can be performed on top of IPFIX to optimize the efficient usage of the limited resources.

Malware and botnets pose a steady and growing threat to network security. Therefore, packet analysis systems examine network traffic to detect active botnets and spreading worms. However, with the advent of multi-gigabit link speeds, capturing and analysing header and payload of every packet requires enormous amounts of computational resources and is therefore not feasible in many situations. We address this problem by presenting an efficient packet sampling algorithm that picks a small number of packets from the beginning of every TCP connection. Bloom filters are used to store the required connection state information with constant amount of memory. Our analysis of worm and botnet traffic shows that the large majority of attack signatures is actually found in these packets. Thus, our sampling algorithm can be deployed in front of a detection system to reduce the amount of inspected packets without degrading the detection results significantly.