Operation of the IP Flow Information Export (IPFIX) Protocol on IPFIX Mediators

Abstract

This document specifies the operation of the IP Flow Information Export (IPFIX) protocol specific to IPFIX Mediators, including Template and Observation Point management, timing considerations, and other Mediator-specific concerns.

Dynamic Core VNT Adaptability Based on Predictive Metro-Flow Traffic Models

“…3 presents the proposed architecture that allows this exchange of information. In the architecture, we assume that every controller includes a data analytics module capable of collating monitoring data form the nodes; the IPFIX protocol [18] can be used to that end. The data analytics module processes monitored data and estimates traffic predictive models [13].…”

ITCM: A Real Time Internet Traffic Classifier Monitor

“…Traffic monitoring Systems generally make use of flow information. Examples are NetFlow [2] or IETF IPFIX [3], which defines a standard to exporting flow information by routers and switches. Such systems are widely used in network service providers and corporations to gain knowledge about critical business applications, analyze communication patterns prevalent in traffic, collect data for account, or detect anomalous traffic patterns [4].…”

Anomaly detection in SCADA systems : a network based approach

“…Network/Anomaly based D'Antonio et al [45] propose the use of flow-level information (e.g., IPFIX [41]) to detect anomalies using a "context extraction algorithm". However, only the general architecture is described and details about the context extraction algorithm are not given.…”

“…The flow creation described above can be easily modified to deal with flow-level records, such as generated by Netflow [40] or IPFIX [41] exporters, instead of connections generated in the connection creation phase. In this context, a flow is defined as a set of IP packets passing an observation point in the network during a certain time interval, that share a certain set of common properties (e.g., fields in the packet header), termed flow key.…”

“…In this context, a flow is defined as a set of IP packets passing an observation point in the network during a certain time interval, that share a certain set of common properties (e.g., fields in the packet header), termed flow key. Flow records contain measured information about a specific flow (e.g., total number of packets) [41]. Typically, a distinction is made between unidirectional, i.e., one record for each connection direction (e.g., traffic from client to server and from server to client), or bidirectional flows, i.e., a single record for both directions.…”