# Requirements for Crafting Virtual Network Packet Captures
## 1 Introduction  
Virtual machines, virtual storage and virtual networks are the fundamentals of modern infrastructures, providing highly flexible applications, services and environments such as Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS). Cloud environments as well as modern company networks use virtualisation to provide dynamic, secure and highly customisable environments to internal and external customers. These environments have to cover various, partly conflicting challenges. Inter-networking and connections to internal and external networks are as important as the isolation and secure separation of different networks categories such as customers, management and backup. The implementation of network virtualisation overlay (NVO) is a common technique to create flexible overlay networks on top of common and hardware-based underlay networks. The software-based overlay networks use different virtual network protocols such as VXLAN [1], GENEVE or NVGRE [2] to create a flexible network structure for the different tenants. These protocols facilitate the separation of different networks on top of a single and independent underlay network by encapsulating a given network packet with new protocol information as shown in Figure 1.  
The use of encapsulating protocols provides various benefits to the providers. The encapsulation provides flexibility to static networks by adding new network traffic information to a given network packet. The idea of encapsulating network protocols has been known for a long time and is not limited to Ethernet or IP [3]. In addition to this, encapsulating protocols are not limited to local area networks (LAN), even in wide area networks (WAN) protocols such as Point-to-Point Protocol (PPP) [4] or ATM (Asynchronous Transfer Mode) use encapsulation. In modern networks, protocols such as VXLAN use a special field in the header that identifies an isolated subnet under the administration of a single customer or for a special purpose. In this way, subnets belonging to the same entity can be spread all over the physical infrastructure. If a host wants to communicate with a host located in the same subnet but on a different compute host, the network packet is encapsulated. The administration of these networks differs from the administration of pure hardware-based environments. Now, additional attack vectors such as denial-of-service attacks against network controllers [5], insider attacks against virtualised devices [6] or software crashes and buffer overflows of the software implementations are gaining increased importance. To manage the different challenges, modern techniques such as machine learning-based intrusion detection or network packet classification with deep learning are implemented, but tasks such as prediction occur as well. To train the involved algorithms, a huge amount of network traffic is needed. A common approach is the use of available datasets, but this information differs sometimes from the given network environment. To obtain proper network traffic, [7] describes six different techniques to generate network packets or traffic collection:  
1. Use of real networks,
2. Creation of a honeynet,
3. Use of a network simulator,
4. Existing traffic dumps,
5. Use of network traffic generators,
6. Combining the aforementioned techniques. The use of real network traffic seems to be a common possibility to get relevant network traffic, but this traffic lacks in attack-based network traffic or malicious packets. The creation of a honeynet as well as the network simulator is easier in virtual environments as in hardware-based environments but still a complex task. The process of implementing such an environment is done in various steps. In [8], the authors define significant planning as the first step, along with discussions of trained personnel to preserve the realistic scenario. The technical implementation is based on the installation and configuration of VMs running on compute nodes as well as the wanted network structure.