En Passant: predicting HTTP/1.1 traffic

Significant research on the Web is performed using logs collected from proxies and servers. Virtually all of these logs are from sites running the 1.0 version (or earlier) of HTTP. After four years a draft-standard specification of HTTP/1.1 has emerged. However, many proxies and servers still use HTTP/1.0, and most so-called HTTP/1.1 servers do not employ all of the key features available in the protocol. It is not feasible to evaluate the impact of HTTP/1.1 traffic using HTTP/1.0 logs. Thus, there is a need to examine ways of postulating HTTP/1.1 traffic from HTTP/1.0 traffic. This paper presents the En Passant architecture and a tool based on the architecture to convert HTTP/1.0 logs and traffic into plausible HTTP/1.1 traffic based on various parameters representing changes between the two versions of the protocol. The tool takes both the high-level information in HTTP/1.0 server logs and low-level information found in packet traces as input and generates a possible HTTP/1.1 log. We present the set of parameters and the actual feature changes between the protocol that impact the traffic by using a live packet trace as example