CSTeller: Client or Server is a Question

Abstract

Network measurement is of great significance for network management, network optimization, and attack detection. Client–server distinction issue, as a part of network measurement, is particularly important for network management. The existing solution mostly based on the connection establishment process, which cannot work for non-connectivity protocols (such as User Datagram Protocol) or traffic that missing connection information. In this paper, we propose a coarse-grained approach to identify servers and clients by using DNS protocols, and further, we put forward a fine-grained approach named CSTeller (tell client from the server) to solve the problem using simple machine learning classification algorithms. We test the correctness of CSTeller under two different datasets and analyze the test results. Finally, CSTeller is currently used by a large Internet service provider (ISP) of China as part of network measurement platform and has been proved to achieve high performance.