The University of Florida is located at Gainesville. This system was installed in 2003 and went live early May 2004. It replaces an earlier OC3MON system at the same location, see below.

With the UFL monitor we are looking at all the information entering and leaving the university campus, including a number of satellite locations. Unfortunately, the exact topology is no longer public, if you need more details please be in contact with us or with UFL network services to request further information.

The link monitored is an OC12c circuit landing remotely at the Qwest facility in Atlanta, where peering arrangements for legacy Internet as well as Internet2 (Abilene) exist. The link deploys so called Frame-over-SONET encapsulation, which is another form of HDLC using a slightly different header. This header is compliant with RFC 1490, Section 8 - IP over Frame Relay - with the NLPID value indicating IP. Two different DLCI values are used - 16 for legacy communications and 512 for Abilene/Internet2 traffic. Please see Section 7 of RFC 1490 on page 21 for the exact details on how the DLCI/Q.922 address is encapsulationed. The corresponding hexadecimal values to be found in the trace file are 0x040103cc and 0x800103cc. For the purposes of trace analysis you can assume that 0x03cc is yet another EtherType value which encapsulates IP in the same manner as 0x0800. Please contact us if you want help to convert existing utilities, such as tcpdump for use with this trace file format.

Traffic on port 0 (direction 1) is outbound UFL, traffic on port 1 (direction 2) is inbound UFL.