Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.

Measurement Artifacts in NetFlow Data

DRAGO, IDILIO;
2013-01-01

Abstract

Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.
2013
14th International Conference Passive and Active Measurement (PAM 2013)
Hong Kong, China
March 18-19, 2013
Passive and Active Measurement
SPRINGER
7799
1
10
978-3-642-36515-7
http://link.springer.com/chapter/10.1007/978-3-642-36516-4_1
Network management; measurements; NetFlow; artifacts
Hofstede, Rick; DRAGO, IDILIO; Sperotto, Anna; Sadre, Ramin; Pras, Aiko
File in questo prodotto:
File Dimensione Formato  
camera_ready.pdf

Accesso riservato

Dimensione 385.23 kB
Formato Adobe PDF
385.23 kB Adobe PDF   Visualizza/Apri   Richiedi una copia

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/2318/1767101
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 20
  • ???jsp.display-item.citation.isi??? ND
social impact