Netflow-based network traffic analysis is one of today's mainstream network traffic monitoring and analysis techniques. However, port-based traffic identification that employed in Netflow-based protocol analysis is inaccurate. Netflow cannot provide enough details for analysis of site access behaviour. In order to overcome the above limitation, we propose an enhanced Netflow data collection method combining packet capturing and flow technique for accurate application identification. Then we design and implement an enhanced Netflow data collection system, which lays a data foundation for traffic analysis. Finally, the feasibility and effectiveness of the system are verified.

The high-speed development of the Internet has brought up a huge challenge for network management. Larger network traffic and more complex applications make it difficult for the original SNMP-based network management software to meet demands of analyzing users and protocols; widespread utility of dynamic ports greatly reduces the accuracy of distinguishing application layer protocols based on tranditional static ports. Since raw NetFlow is enormous, unfit for long-term storage and low in query efficiency, multiple time granularity aggregation schemes are designed. This paper describes characteristics of both real-time and history traffic from five aspects, thus providing a clearer view of network operating conditions. Besides, as the indicator of users' web access behavior, web sites and URLs are analyzed.