Next Generation Internet Traffic Monitoring System Based on NetFlow

Liu, Yuhui; Sun, Jinshan; Rui, Sun; Wen, Yingyou

doi:10.1109/isdea.2010.337

Cited by 7 publications

(5 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Concerning non-eBPF technologies, the de-facto monitoring protocols are NetFlow and IPFIX [27], its open counterpart. A famous compliant implementation used also as evaluation metric in this paper is nProbe [5], which relies on different underlying packet processing technologies (PF_RING 5 and libpcap 6 ). However, it does not support changing the monitoring pipeline at runtime, hence extracting a constant set of features from the traffic.…”

Section: B Non-ebpf Based Approachesmentioning

confidence: 99%

“…• Second, it evaluates the fully-adaptive network monitoring methodology and compares it against nProbe [5], a NetFlow-compatible [6] implementation, and the adaptive and a non-adaptive approach in eBPF, reporting significant advantages in terms of number of network packets processed and memory consumption of adopting such methodology. The rest of the paper is structured as follows: Section II reviews and discusses related works.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Control Plane Enabling Automated and Fully Adaptive Network Traffic Monitoring With eBPF

2022

View full text Add to dashboard Cite

The extended Berkeley Packet Filter (eBPF) enables the dynamic injection of user-defined processing logic at run-time in the Linux networking stack without disrupting any active monitoring process. This enables the selective extraction of only the traffic features that are needed in a given instant of time, which is what we define fully adaptive network traffic monitoring. However, eBPF programs require adhoc control plane routines for each specific scenario in order to orchestrate the underlying data plane and export the required metrics, resulting in potentially duplicated source codes to maintain, and creating the risk of deploying, at runtime, unverified user-defined code that controls the devices running the monitoring process. This paper presents a control plane that automatically adapts both its management tasks and data extraction methodologies based on the underlying data plane provided by the user, who can merely focus on the monitoring logic definition. The paper evaluates the performance of the control plane's modules and demonstrates the advantages, in terms of processing speed and memory consumption, of a fullyadaptive monitoring approach with respect to nProbe (a state-of-the-art solution), an adaptive and a nonadaptive methodology in eBPF. Experiments prove that the control plane monitoring functionalities do not significantly affect the underlying data plane (0.15% degraded throughput) and leverage the most efficient extraction primitives (20x faster execution time), and show that the fully-adaptive monitoring leads to a higher number of processed packets (10x) and significantly lower memory occupancy (10x) when extracting the smallest set of features.

show abstract

Section: B Non-ebpf Based Approachesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Control Plane Enabling Automated and Fully Adaptive Network Traffic Monitoring With eBPF

2022

View full text Add to dashboard Cite

show abstract

“…NetFlow data has been used for intrusion detection system development [7], [10], [13], [14] and bandwidth evaluation and provisioning in both Campus [4] and public networks [9], [15].…”

Section: Related Workmentioning

confidence: 99%

I-CaN-MaMa: Integrated campus network monitoring and management

Zhao

Leftwich

Owens

et al. 2014

2014 IEEE Network Operations and Management Symposium (NOMS)

View full text Add to dashboard Cite

A campus network provides a number of services to its stakeholders. Due to the complexity of having many services, it is often difficult to pinpoint an issue quickly. The currently available tools for monitoring a campus network are often designed for a specific piece of the network. On the other hand, systems administrators running a campus network with data centers and supporting a number of internal and external applications face several challenges with the current set of tools for monitoring and management. To fill this void, we propose the I-CaN-MaMa (Integrated Campus Network Monitoring and Management) framework. Our approach takes an integrated view that was developed in consultations with issues faced by systems administrators. We present the key components in this framework and through a brief study, we show the utility of our approach.

show abstract

“…Existing research on IP network behavior analysis mainly focus on traffic pattern analysis [1][2][3][4][5][6][7][8] , anomaly detection [9][10][11][12] , traffic classification and application protocol identification [13] , user behavior analysis and model building [14 -16] , analysis system building [15][16][17][18][19][20] .…”

Section: Introductionmentioning

confidence: 99%

“…Zhang J. and Liu Y. [18][19] et al constructed NetFlow IPv6 traffic monitoring and behavior analysis system.…”

Section: Introductionmentioning

confidence: 99%

Design and implementation of IP network behaviour analysis system based on NetFlow

Hou

Zou

2012

2012 12th International Conference on Intelligent Systems Design and Applications (ISDA)

View full text Add to dashboard Cite

The high-speed development of the Internet has brought up a huge challenge for network management. Larger network traffic and more complex applications make it difficult for the original SNMP-based network management software to meet demands of analyzing users and protocols; widespread utility of dynamic ports greatly reduces the accuracy of distinguishing application layer protocols based on tranditional static ports. Since raw NetFlow is enormous, unfit for long-term storage and low in query efficiency, multiple time granularity aggregation schemes are designed. This paper describes characteristics of both real-time and history traffic from five aspects, thus providing a clearer view of network operating conditions. Besides, as the indicator of users' web access behavior, web sites and URLs are analyzed.

show abstract

Next Generation Internet Traffic Monitoring System Based on NetFlow

Cited by 7 publications

References 7 publications

A Control Plane Enabling Automated and Fully Adaptive Network Traffic Monitoring With eBPF

A Control Plane Enabling Automated and Fully Adaptive Network Traffic Monitoring With eBPF

I-CaN-MaMa: Integrated campus network monitoring and management

Design and implementation of IP network behaviour analysis system based on NetFlow

Contact Info

Product

Resources

About