Att en hemsida tar extra lång tid att ladda är inte ovanligt och kan bero på att trafiken från en klient tar en helt annan väg till hemsidans server än den som är geografiskt närmast. Orsaken bakom problemet är att DNS-förfrågningarna färdas onödigt långa sträckor. NetNod är ett företag som tillhandahåller dessa internettjänster, bland annat rotservrar runt om i världen. De vill ta reda på varför trafik från olika klienter inte alltid går den geografiskt närmaste vägen till deras anycastnoder Problemställningen för examensarbetet är att analysera varifrån trafik till företagets anycastnod i Miami kommer. Realiseringen av detta gjordes genom att utveckla en programkod som markerade geografisk placering av olika klienter utifrån deras IP-adress. Förinspelade trafikdata från NetNod analyserades. Detta gjordes för att visa på vilka problem som observeras i peering och anycastrouting mellan internetprotokoll. Resultatet redovisades med en karta med markeringar av de IP-adresser där deras trafik analyserades för att se hur det transporterades till anycastnoden. Utifrån detta har resultatet visat på vilka avvikelser och mönster som uppstått inom BGP-routing när trafiken färdas till anycastnoden. De avvikelser som hittats är hur olika routingregler manipulerat trafikens transport till anycastnoden och gör att trafiken från klienterna inte tar den geografiskt närmaste vägen till anycastnoden. / The fact that a website takes an unusually long time to load is not uncommon. This can be due to a client taking a different path to the websites server than one that is geographically closer. One reason behind this problem is that DNS-queries travel unnecessarily long distances. NetNod is a company that provides internet services and maintains one of the few root-servers around the world. The company wants to know why traffic from different clients do not always go via the geographically closest route to anycast nodes. The objective of the thesis is to analyze where traffic to NetNods anycast node in Miami geographically originates from. In order to do this, a computer program was developed in which plots the geographical location of different clients from their IP-address. Pre-recorded data from the company was used as a data source for the program. This was done to show different challenges in peering and anycast routing between internet protocols. The result is presented via a map with plots of where the IP-addresses are geographically coming from to the anycast node in Miami, it was generated by the developed program. The generated map showed anomalies and patterns of how the traffic is transported in large junctions as well as how routing rules are applied, this is one reason to why the traffic does not always go the geographically closest route.

The thesis discusses about modern geolocation methods and it describes the basic principles of their work. The work is divided into 2 parts - the theoretical one and the practical one. The first part of the thesis is focused on the description of these methods and on the explanation of its basic concepts which are used for determining of the physical position of the station according to its IP address. The second more extensive part of the work focuses on the description of the realization of algorithm in the Octant method in the programming language of Java and its use in the experimental net of PlanetLab. One important thing is to create a set of reference points and targets, which are necessary for the testing of the whole algorithm of the Octant Method. The results of estimated accuracy of target location obtained by the Octant method and their comparison with the results obtained by active methods of CBG, SOI and with the passive method of GeoIP are listed at the end of this work.

This thesis is focused on finding the physical location of stations by the passive geolocation techniques, particularly using the registration database of IP addresses. The first two part are focused on a theoretical analysis of this problem, the next two parts of this thesis deal with the solution of this problem and discussion of the results.

Automatic classification of devices in computer network can be used for detection of anomalies in a network and also it enables application of security policies per device type. The key to creating a device classifier is a quality data set, the public availability of which is low and the creation of a new data set is difficult. The aim of this work is to create a tool, that will enable automated annotation of the data set of network devices and to create a classifier of network devices that uses only basic data from network flows. The result of this work is a modular tool providing automated annotation of network devices using system ADiCT of Cesnet's association, search engines Shodan and Censys, information from PassiveDNS, TOR, WhoIs, geolocation database and information from blacklists. Based on the annotated data set are created several classifiers that classify network devices according to the services they use. The results of the work not only significantly simplify the process of creating new data sets of network devices, but also show a non-invasive approach to the classification of network devices.