NDLI: Building a better NetFlow

Content Provider	ACM Digital Library
Author	Estan, Cristian Varghese, George Moore, David Keys, Ken
Abstract	Network operators need to determine the composition of the traffic mix on links when looking for dominant applications, users, or estimating traffic matrices. Cisco's NetFlow has evolved into a solution that satisfies this need by reporting flow records that summarize a sample of the traffic traversing the link. But sampled NetFlow has shortcomings that hinder the collection and analysis of traffic data. First, during flooding attacks router memory and network bandwidth consumed by flow records can increase beyond what is available; second, selecting the right static sampling rate is difficult because no single rate gives the right tradeoff of memory use versus accuracy for all traffic mixes; third, the heuristics routers use to decide when a flow is reported are a poor match to most applications that work with time bins; finally, it is impossible to estimate without bias the number of active flows for aggregates with non-TCP traffic.In this paper we propose Adaptive NetFlow, deployable through an update to router software, which addresses many shortcomings of NetFlow by dynamically adapting the sampling rate to achieve robustness without sacrificing accuracy. To enable counting of non-TCP flows, we propose an optional Flow Counting Extension that requires augmenting existing hardware at routers. Both our proposed solutions readily provide descriptions of the traffic of progressively smaller sizes. Transmitting these at progressively higher levels of reliability allows graceful degradation of the accuracy of traffic reports in response to network congestion on the reporting path.
Starting Page	245
Ending Page	256
Page Count	12
File Format	PDF
ISSN	01464833
DOI	10.1145/1030194.1015495
Journal	ACM SIGCOMM Computer Communication Review (CCRV)
Volume Number	34
Issue Number	4
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1993-07-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Network monitoring Traffic measurement Data summarization
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Building a better NetFlow

Entropy based adaptive flow aggregation

SSH Compromise Detection using NetFlow/IPFIX

Blockmon:a high-performance composable network traffic measurement system

Entropy Based Adaptive Flow Aggregation

Toward scalable internet traffic measurement and analysis with Hadoop (CCRV, Vol. 43, Issue. 1)

Toward scalable internet traffic measurement and analysis with Hadoop (CCRV, Vol. 43, Issue. 1)

Profiling internet backbone traffic:behavior models and applications

Network traffic measurement and modeling

Building a better NetFlow

Similar Documents

Building a better NetFlow

Entropy based adaptive flow aggregation

SSH Compromise Detection using NetFlow/IPFIX

Blockmon:a high-performance composable network traffic measurement system

Entropy Based Adaptive Flow Aggregation

Toward scalable internet traffic measurement and analysis with Hadoop (CCRV, Vol. 43, Issue. 1)

Toward scalable internet traffic measurement and analysis with Hadoop (CCRV, Vol. 43, Issue. 1)

Profiling internet backbone traffic:behavior models and applications

Network traffic measurement and modeling

Building a better NetFlow