This is a laboratory and experimental course in the field of Internet traffic measurements. Most of the classes are given in laboratories, with few introductory lessons for each field. Students will have to setup experiments to run active or passive measurement tools in real networks, and to apply methodologies learned in previous classes, or that will be explained during the course. Both passive traffic analysers, and active traffic generators will be used to characterise the network and control the load. During the course, students will face lab sessions of increasing complexity, maturing a critical approach and scientific methodology toward the understanding of complex systems such as computer networks are. Students will learn how to use Linux systems, how to configure the network, and how to properly use machine learning approaches using Python, and Scikit-learn in particular.

1. Detailed knowledge of the analysis of Internet protocols like IP, TCP, UDP, HTTP, DNS. 2. Detailed understanding of performance related problems in local and wide area networks – Delay and Throughput measurements 3. Ability to process real traffic traces and to extract information related to both performance and troubleshooting issues from actual traces. 4. Ability to use Machine Learning tools to solve some classic problems, e.g., using Python and Scikit-learn to solve traffic classification problems. The ability to apply the gained knowledge will be verified by the preparation of lab reports, and that will be discussed during an oral examination at the end of the course.

Students must have very good knowledge of the protocols and mechanisms normally used in the Internet. In particular, students must be familiar with LAN protocols (Ethernet IEEE 802.3, WiFi IEEE 802.3, CSMA/CD, direct and indirect delivery, LAN interconnections), of network (IP) and transport (TCP/UDP) protocols, and application layer protocols (DNS, HTTP, HTTPS, multimedia streaming protocols, etc.). Traffic models will be also used and students must be familiar with basic traffic modeling techniques (Poisson models, Markovian models, hypothesis tests, confidence interval evaluation).

Students will work in groups of three people during the laboratories using PCs running Linux OS. Using Ethernet switches and WiFi Access Points, students will setup experiments configuring LANs. Each group of students will use 3 PCs -- one for student -- to generate and observe traffic. Real traffic traces will be used to allow students to deal with more realistic scenarios. • Configuration of hosts in Local Area Networks, IP addresses management, subnetting/supernetting (2 hours) • Traffic monitoring using sniffers in LAN: TCP, UDP and HTTP (6 hours) • Performance measurement for file transfers and impact of delay and packet losses (8 hours) • Performance measurement for file transfers in WiFi setup (6 hours) • Generation and analysis of network attacks using nmap (3 hours) • Analysis of traffic traces collected from real networks and development of post-processing tools using Python to extract information out of the raw data (15 hours) • Introduction to Machine Learning methods and Data Mining techniques and applications to traffic analysis to find correlations and solve classification problems (20 hours)

The course is organised in a number of laboratory activities on the topics of Internet and networks. Students will work in groups of three colleagues during labs. Students perform these laboratory activities at the the Basic Informatics Laboratory (LAIB), using additional devices like access points, switches, WiFi interfaces, etc. Student are welcome to use their own laptop, provided it can run a Unix/Linux operating system. Each laboratory will be introduced in classes, where the fundamentals of technologies and methodologies will be presented before applying them during the labs.

The teaching material will be made available by the class teacher on the Didattica web portal. Description of the lab experiments will be provided, and reference documentation will be available to students. No textbook is available. Students must be familiar with Internet protocol and applications which can be found for example in - A. Pattavina: Reti di telecomunicazioni, Mc.Graw-Hill (in Italian) - J.F. Kurose, K.W. Ross: Computer Networking: A Top-Down Approach Featuring the Internet, Pearson (in English)

Modalità di esame: Prova orale obbligatoria; Elaborato scritto individuale; Elaborato scritto prodotto in gruppo;

Exam: Compulsory oral exam; Individual essay; Group essay;

... Students will work in groups of three people. The evaluation involves three parts: GROUP REPORTS: Each group is required to write a group report on the selected laboratory experiences. The topics will be indicated during lessons by the professor. Reports must be prepared and uploaded on the didattica website by the deadline, which is the same as the day and time of the student registration for the exam (data scadenza prenotazione esame) for each exam session. The group report will be valid for all members of the group, and will be valid for one years. Group reports will be evaluated and all students in the same group will get the same mark. Group report evaluates the understanding of the experiments done during the laboratories, and the ability of the student to work in groups. INDIVIDUAL REPORT: Each student will have to prepare an individual report, that has to be uploaded as above by the same deadline of the student registration for the exam. The maximin grade for the group laboratory report is 30 cum laude. The individual report evaluates the understanding of the single student of the topics faced during the class. ORAL EXAM: Each student will be asked to discuss the content of the reports (both group and individual) during the oral exam. The oral exam is individual, and students will be asked to answer questions about both the practical and theoretical part of the course. The maximum grade for the oral exam is 30 cum laude. The oral part must be sufficient to pass the exam. The oral exam evaluates the contribution of each student to the group reports, and the understanding of the student of the course topics. FINAL VOTE: The final vote will be a weighted average between the evaluations of the group report (70%), the individual report (15%) and oral examination (15%).

Gli studenti e le studentesse con disabilità o con Disturbi Specifici di Apprendimento (DSA), oltre alla segnalazione tramite procedura informatizzata, sono invitati a comunicare anche direttamente al/la docente titolare dell'insegnamento, con un preavviso non inferiore ad una settimana dall'avvio della sessione d'esame, gli strumenti compensativi concordati con l'Unità Special Needs, al fine di permettere al/la docente la declinazione più idonea in riferimento alla specifica tipologia di esame.