Building a better NetFlow

Computer Communication Review

Volumn 34, Issue 4, 2004, Pages 245-256

  Estan, Cristian ^a   Keys, Ken ^a   Moore, David ^a   Varghese, George ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Data summarization; Network monitoring; Traffic measurement

Indexed keywords

DATA SUMMARIZATIONS; NETWORK MONITORING; ROUTER MEMORY; TRAFFIC MEASUREMENT;

COMPUTER SOFTWARE; CONGESTION CONTROL (COMMUNICATION); DATA REDUCTION; ROUTERS; STORAGE ALLOCATION (COMPUTER); TELECOMMUNICATION LINKS; TELECOMMUNICATION TRAFFIC;

TELECOMMUNICATION NETWORKS;

EID: 21844468041     PISSN: 01464833     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1030194.1015495     Document Type: Conference Paper

References (29)

1. IPMON - packet trace analysis. http://ipmon.sprintlabs.com/packstat/ packetoverview.php.
2. Personal conversation with Dave Plonka.
3. Paul Barford, Jeffrey Kline, David Plonka, and Amos Ron. A signal analysis of network traffic anomalies. In Internet Measurement Workshop, November 2002.
4. Andy Bierman and Juergen Quittek. Packet sampling (psamp). IETF working group.
5. N. Brownlee, C. Mills, and G. Ruth. Traffic flow measurement: Architecture. RFC 2722, October 1999.
6. Nevil Brownlee and Dave Plonka. IP flow information export (ipfix). IETF working group.
7. J. Lawrence Carter and Mark N. Wegman. Universal classes of hash functions. In Journal of Computer and System Sciences, volume 18, April 1979.
8. S. Chaudhuri, R. Motwani, and V. Narasayya. Random sampling for histogram construction: How much is enough? In Proceedings of the ACM SIGMOD, 1998.
9. Baek-Young Choi, Jaesung Park, and Zhi-Li Zhang. Adaptive random sampling for load change detection. In SIGMETRICS, 2002. (extended abstract).
10. Chuck Cranor, Theodore Johnson, Oliver Spatschek, and Vladislav Shkapenyuk. Gigascope: A stream database for network applications. In Proceedings of the ACM SIGMOD, June 2003.
11. Nick Duffield and Garsten Lund. Predicting resource usage and estimation accuracy in an IP flow measurement collection infrastructure. In Internet Measurement Conference, October 2003.
12. Nick Duffield, Carsten Lund, and Mikkel Thorup. Properties and prediction of flow statistics from sampled packet streams. In SIGCOMM Internet Measurement Workshop, November 2002.
13. Nick Duffield, Carsten Lund, and Mikkel Thorup. Estimating flow distributions from sampled flow statistics. In Proceedings of the ACM SIGCOMM, August 2003.
14. Cristian Estan, Ken Keys, David Moore, and George Varghese. Building a better NetFlow: Technical report, 2004. http://www.caida.org/outreach/papers/ 2004/tr-2004-03/.
15. Cristian Estan, George Varghese, and Mike Fisk. Bitmap algorithms for counting active flows on high speed links. In Internet Measurement Conference, October 2003.
16. Anja Feldmann, Albert Greenberg, Carsten Lund, Nick Reingold, Jennifer Rexford, and Fred True. Deriving traffic demands for operational IP networks: Methodology and experience. In Proceedings of the ACM SIGCOMM, pages 257-270, August 2000.
17. Philippe Flajolet. On adaptive sampling. COMPUTG: Computing (Archive for Informatics and Numerical Computation), Springer-Verlag, 43, 1990.
18. Nicolas Hohn and Darryl Veitch. Inverting sampled traffic. In Internet Measurement Conference, 2003.
19. Ken Keys, David Moore, Ryan Koga, Edouard Lagache, Michael Tesch, and k claffy. The architecture of CoralReef: an Internet traffic monitoring software suite. In PAM2001. CAIDA, RIPE NCC, April 2001. http://www.caida.org/outreach/ papers/2001/CoralArch/.
20. Steven McCanne, Van Jacobson, and Martin Vetterli. Receiver-driven layered multicast. In ACM SIGCOMM, volume 26,4, pages 117-130, New York, August 1996. ACM Press.
21. Keith McCloghrie and Marshall T. Rose. RFC 1213, March 1991.
22. David L. Mills. RFC 1305: Network time protocol (version 3) specification, implementation, March 1992.
23. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. The spread of the sapphire/slammer worm. Technical report, 2003.
24. Cisco netflow. http://www.cisco.com/warp/public/732/Tech/netflow.
25. Vern Paxson. Bro: a system for detecting network intruders in real-time. In Computer Networks (Amsterdam, Netherlands: 1999), volume 31, pages 2435-2463, 1999.
26. Peter Phaal, Sonia Panchen, and Neil McKee. RFC 3176: sFlow, September 2001.
27. David Plonka. Flowscan: A network traffic flow reporting and visualization tool. In USENIX LISA, pages 305-317, December 2000.
28. Martin Roesch. Snort - lightweight intrusion detection for networks. In Proceedings of the 13th Systems Administration Conference. USENIX, 1999.
29. Sampled NetFlow. http://www.cisco.com/uuivercd/cc/td/doc/product/ software/ios120/120newft/120limit/120s/120s11/12s_sanf.htm.