# Requirements for Crafting Virtual Network Packet Captures
## 1 Introduction
If dynamic aspects such as VM migration have to be covered, a reconfiguration of the entire environment is necessary. While a huge number of datasets of common networks such as CICDDoS2019 [9], CSE-CIC-IDS 2018 [10] and INSecS-DCSI [11] exist, to our knowledge, there is no publicly available data set with different virtual protocols such as VXLAN or GENEVE. The use of network traffic generators provides various benefits to the provider. By defining coherent parameters, a packet generator is able to create proper network traffic which fits the involved network. In [12], the authors define packet generation as  
_the result of time-stamped series of packets arriving and departing from particular network interfaces with realistic values._  
We define network packet generation as the synthetic creation of network packets regarding different parameters. These parameters depend on the purpose of the creation process and cover various fields such as the testing of new implementations [13], troubleshooting [14], education and training [15, 16] or advanced aspects such as network forensic investigation [17, 18]. However, ad hoc traffic generation is cumbersome and error-prone and normally does not take virtualised networks into account. Packet generators are used in various  
Figure 1: Network packet encapsulation. fields of network management, security and performance optimisation. In [19], the authors describe the use of different network packet generators to implement training platforms for teaching defence techniques against denial of service attacks. With _Encapcap_[20], we have presented a first attempt to transform network traces so that they contain virtualised network traffic for specific scenarios. In the present research, we investigate systematically the requirements to be met by packet generators for virtualised networks and thus to see which direction to evolve _Encapcap_ in for use with more general scenarios. We also present some use cases that illustrate the necessity of these requirements and demonstrate the use of _Encapcap_ in application scenarios. While those use cases comprise the use of test sets for virtual networks generated by _Encapcap_, our goal is not to present a particular test set but the possibility to generate it. Our main research contributions are as follows:  
* An analysis of relevant features in traffic from virtualised networks and subsequently the derivation of a set of requirements, which is as complete as possible, as a baseline for a packet generation process targeted towards virtual environments;
* The extension of the _Encapcap_ tool to meet the above requirements;
* The presentation and evaluation of different use cases with the help of (extended) _Encapcap_. The remainder of this article is structured as follows. Section 2 discusses related work in the fields of virtual networks and packet capture generation. In Section 3, we define pertinent requirements for a valid packet generation process targeted towards virtualised networks. Section 4 presents and analyses use cases, while Section 5 presents conclusions and an outlook to future work.