On Searching for Patterns in Traceroute Responses

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8362)


We study active traceroute measurements from more than 1,000 vantage points towards a few targets over 24 hours or more. Our aim is to detect patterns in the data that correspond to significant operational events. Because traceroute data is complex and noisy, little work in this area has been published to date. First we develop a measure for the differences between successive traceroute measurements, then we use this measure to cluster changes across all vantage points and assess the meaning and descriptive power of these clusters. Large-scale operational events stand out clearly in our 3D visualisations; our clustering technique could be developed further to make such events visible to the operator community in near-real time.


Edit Distance Path Change IPv4 Address Atlas Probe Route Change 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Allison, L.: Dynamic programming algorithm (dpa) for edit-distance,
  2. 2.
    King, A., Huffaker, B., Dainotti, A., Claffy, K.: A coordinated view of the temporal evolution of large-scale internet events. In: First IMC Workshop on Internet Visualization, WIV 2012 (2012),
  3. 3.
    Lad, M., Massey, D., Zhang, L.: Visualizing internet routing changes. IEEE Transactions on Visualization and Computer Graphics 12(6) (November 2006)Google Scholar
  4. 4.
    Levenshtein, V.I.: Binary Codes Capable of Correcting Deletions, Insertions and Reversals. Soviet Physics Doklady 10, 707 (1966)MathSciNetGoogle Scholar
  5. 5.
    Matteucci, M.: Hierarchical clustering algorithms,
  6. 6.
    Quan, L., Heidemann, J., Pradkin, Y.: Visualizing sparse internet events: network outages and route changes. In: First IMC Workshop on Internet Visualization, WIV 2012 (2012),
  7. 7.
    RIPE Network Coordination Centre. Ripe atlas,
  8. 8.
    Sibson, R.: Slink: An optimally efficient algorithm for the single-link cluster method. The Computer Journal 16(1), 30–34 (1973)CrossRefMathSciNetGoogle Scholar
  9. 9.
    Singhal, A.: Modern information retrieval: a brief overview. IEEE Data Engineering Bulletin 24, 35–43 (2001)Google Scholar
  10. 10.
    Taylor, J.: How did dodo break the internet? (February 24, 2012),

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  1. 1.The University of AucklandNew Zealand

Personalised recommendations