Inhalt des Dokuments
Es gibt keine deutsche Übersetzung dieser Webseite.
The time machine is a joint project of the Technische Universität Berlin, the Technische Universität München , and the ICSI  (University of California Berkeley). It is open-source and published under the BSD license.
times when it would be extraordinarily convenient to record the
entire contents of a high-volume network traffic stream, in
order to later "travel back in time" and inspect
activity that has only become interesting in retrospect. Two
examples are security forensics—determining just how an
attacker compromised a given machine—and network
trouble-shooting, such as inspecting the precursors to a fault
after the fault.
To perform this task efficiently, the packets are first stored in a ring buffer in the memory (RAM), later the packets are copied to (hard) disk. This allows the time machine to smoothen capture bandwidth peaks in memory and store huge amounts of traffic on disk, covering several days of network traffic. The time machine is designed to work in Gbps environments.
Since it is not feasible to capture the complete load of a fully utilized Gbps link to disk, the time machine utilizes a mechanism called "connection cutoff" to reduce the the amount of data to process. This "connection cutoff" only records the first X bytes of every monitored connection (identified via the 5-tupel of source and destination IP and Port and the transport protocol). Indeed this approach it does not impair the analysis capabilities (unless the cutoff is set to low) because most of the "interessting" data is located in the first few packets of a connection. The effiency of this approach comes from leveraging the heavy-tailed nature of network traffic: because the bulk of the traffic in high-volume streams comes from just a few connections.
To take full advantage of this recording it is import to be able to quickly locate certain packets. For example one might be interested in all packets of a specific connection or all packets from one IP address. This is achieved by indexing stored packets. The indexes to create can be specified, for example one could create indexes for the connection 5-tupel, for IP address pairs, for IP addresses, etc. One can than issue a queries for a specific index to the time machine and the time machine will lookup the query in its index and will return all stored packets matching the query.
To further streamline the analysis capabilities we have coupled the TimeMachine with the Bro network intrusion detection system (IDS) (www.bro-ids.org ). Thus the IDS can directly interact with the TimeMachine and request historic traffic to represent it to a security analyst or to do retrospective analysis.
- current: How to use the time
machine is explained here.
Gregor Maier, Time Machine HowTo 
- Aug 2008: In this the
TimeMachine is evaluated and coupled with a Network
Intrusion Detection System.
Gregor Maier, Robin Sommer, Holger Dreger, Anja Feldmann, Vern Paxson, Fabian Schneider. Enriching Network Security Analysis with Time Travel , Proceedings of the ACM SIGCOMM 2008
- Feb 2007:
Concept Poster: Time Machine Project
Gregor Maier, Stefan Kornexl (TUM), Anja Feldmann, Vern Paxson (ICSI), Robin Sommer (ICSI), Fabian Schneider, Bernhard Ager, Holger Dreger (TUM) Poster from Scientific Advisory Board Meeting (DT Labs) Time Machine (PS , PDF )
Oct 2005: This paper summarizise the concept of the
Stefan Kornexl, Vern Paxson, Holger Dreger, Anja Feldmann and Robin Sommer, Building a Time Machine for Efficient Recording and Retrieval of High-Volume Network Traffic , Proceedings of the 5th ACM SIGCOMM Internet Measurement Conference, 2005
- Jan 2005: The master
thesis explains the concepts and the design of the Time
Stefan Kornexl, High-Performance Packet Recording for Network Intrusion Detection , Master Thesis (Diplomarbeit), 2005
Please note, that the current release of the time machine is in an early development stage. Bug reports and comments on the functionality and handling of the time machine and its documentation are appreciated. Please do not hesitate to send an email with your question or comment to tmlists.net.t-labs.tu-berlin.de. Developer release: Download tm-20090206-0.tar.gz  Most notable changes since 20080206:
- Bugfixes in broccoli communication code
- GCC 4.3 compatability
Most notable changes since 20061220:
- Many bugfixes
and performance improvements.
- New connection table code (with less locking)
- New index hash tables
- Disk write performance
- Coupling with IDS through broccoli.
- Support for dynamic classes: The TM can be instructed to (temporarily) assign a particular host to a different storage class (e.g., if an IDS detected suspicious behavior from that host)
- Better logging facilities.
- Subscription support for all indexes.
Most notable changes since 20061111:
increase in performance due to
- Changes in internal data structures
- Index generation and aggregation
- using ptmalloc on FreeBSD
- Thread scheduling
- Documentation Updates
- Support for running tm in the background as a daemon
(Be sure to subscribe to
- Download tm-20080814-0.tar.gz 
- tm-20061220-0.tar.gz , Time Machine HowTo 
- tm-20061111-0.tar.gz , Time Machine HowTo 
If you are experiencing packet losses, you might perhaps want to take a look at our recommendations for best packet capturing systems.
For up-to-date Informations on the Time Machine project, new versions, and improvments please be sure to subscribe to tm-announce mailinglist subscription page 
- Gregor Maier  (TU Berlin / DT Laboratories)
- Stefan Kornexl (TU München)
- Holger Dreger (TU München)
- Anja Feldmann  (TU Berlin / DT Laboratories)
- Vern Paxson  (ICSI)
- Fabian Schneider  (TU Berlin / DT Laboratories)
- Robin Sommer  (ICSI)
All of us can be reached via the time machine list: email@example.com .
|Autor||Kornexl, Stefan and Paxson, Vern and Dreger, Holger and Feldmann, Anja and Sommer, Robin|
|Buchtitel||IMC '05: Proceedings of the 5th ACM SIGCOMM Internet Measurement Conference|
|Ort||Berkeley, CA, USA|
|Adresse||New York, NY, USA|
|Zusammenfassung||There are times when it would be extraordinarily convenient to record the entire contents of a high-volume network traffic stream, in order to later ''travel back in time'' and inspect activity that has only become interesting in retrospect. Two examples are security forensics–determining just how an attacker compromised a given machine–and network trouble-shooting, such as inspecting the precurso rs to a fault after the fault. We describe the design and implementation of a Time Machine to efficiently support such recording and retrieval. The efficiency o f our approach comes from leveraging the heavy-tailed nature of network traffic: because the bulk of the traffic in high-volume streams comes from just a few co nnections, by constructing a filter that records only the first N bytes of each connection we can greatly winnow down the recorded volume while still retaining both small connections in full, and the beginnings of large connections (which often suffices). The system is designed for operation in Gbps environments, running on commodity hardware. It can hold a few minutes of a high volume stream in RAM, and many hours to days on disk; the user can flexibly configure its operation to suit the site's nature. We present simulation and operational results from three distinct Gbps production environments exploring the feasibility and efficiency of a Time Machine implementation. The system has already proved useful in enabling analysis of a break-in at one of the sites.|