Internet Traffic Analysis of an Educational Network using Bro IDS

Today, educational and research institutes heavily rely on the Internet connectivity. The bandwidth demand in these institutes is growing exponentially as students, faculty members, and research labs need Internet to find content on the world wide web. As a result, bandwidth congestion cases are frequently reported in such environments causing user dissatisfaction about Internet services. In order to mitigate such congestion problem, it is crucial to perform network traffic analysis on these networks. Such studies allow us to improve quality of service and better network planning. Moreover, it provides insights of user behavior and detect malicious activities done by students. Furthermore, network traffic analysis allows us to monitor usage of multimedia and social sites by users in order to conserve bandwidth to avoid congestion. In this paper, we have analyzed network traffic of Al-Khawarizmi Institute of Computer Science (KICS), UET, Lahore. We have carried out measurements across application, transport and network layer to find out different characteristics. Our results show that multimedia sites like "YouTube" consume considerable bandwidth throughout the working hours and it goes up to 75% of total traffic in peak hours. Similarly social media sites are the second most accessed sites during working hours and "Facebook" is the most used among them. About 91% of requested sites are hosted outside of Pakistan especially in USA. Our findings provide guidelines for network administrators to enhance network performance and bandwidth strategies at educational networks.