Collected
traces (info about IP packets, collected
with TCPDUMP) starting in
May 1999, download data files periodically through firewall
Some gaps (June, August/September)
due to technical problems
Paper based on traces for June 1 to Dec. 31, 1999
Limitations:
- payload is encrypted
- IP addresses dynamically
assigned
- no additional information