Revisiting the issues on netflow sample and export performance

Hamed Haddadi, Raul Landa, Andrew W. Moore, Saleem Bhatti, Miguel Rio, Xianhui Che

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    3 Citations (Scopus)

    Abstract

    The high volume of packets and packet rates of traffic on some router links makes it exceedingly difficult for routers to examine every packet in order to keep detailed statistics about the traffic which is traversing the router. Sampling is commonly applied on routers in order to limit the load incurred by the collection of information that the router has to undertake when evaluating flow information for monitoring purposes. The sampling process in nearly all cases is a deterministic process of choosing 1 in every N packets on a per-interface basis, and then forming the flow statistics based on the collected sampled statistics. Even though this sampling may not be significant for some statistics, such as packet rate, others can be severely distorted. However, it is important to consider the sampling techniques and their relative accuracy when applied to different traffic patterns. In this paper, we assess the performance of the sampling process as used in NetFlow in detail, and we discuss some techniques for the compensation of loss of monitoring detail.

    Original languageEnglish
    Title of host publication3rd International Conference on Communications and Networking in China, ChinaCom 2008
    Pages442-446
    Number of pages5
    DOIs
    Publication statusPublished - 2008
    Event3rd International Conference on Communications and Networking in China, ChinaCom 2008 - Hangzhou, China
    Duration: 25 Aug 200827 Aug 2008

    Conference

    Conference3rd International Conference on Communications and Networking in China, ChinaCom 2008
    Country/TerritoryChina
    CityHangzhou
    Period25/08/0827/08/08

    Fingerprint

    Dive into the research topics of 'Revisiting the issues on netflow sample and export performance'. Together they form a unique fingerprint.

    Cite this