Revisiting the issues on netflow sample and export performance

Hamed Haddadi, Raul Landa, Andrew W. Moore, Saleem Bhatti, Miguel Rio, Xianhui Che

Research output: Chapter in Book/Report/Conference proceedingConference contribution

3 Citations (Scopus)

Abstract

The high volume of packets and packet rates of traffic on some router links makes it exceedingly difficult for routers to examine every packet in order to keep detailed statistics about the traffic which is traversing the router. Sampling is commonly applied on routers in order to limit the load incurred by the collection of information that the router has to undertake when evaluating flow information for monitoring purposes. The sampling process in nearly all cases is a deterministic process of choosing 1 in every N packets on a per-interface basis, and then forming the flow statistics based on the collected sampled statistics. Even though this sampling may not be significant for some statistics, such as packet rate, others can be severely distorted. However, it is important to consider the sampling techniques and their relative accuracy when applied to different traffic patterns. In this paper, we assess the performance of the sampling process as used in NetFlow in detail, and we discuss some techniques for the compensation of loss of monitoring detail.

Original languageEnglish
Title of host publication3rd International Conference on Communications and Networking in China, ChinaCom 2008
Pages442-446
Number of pages5
DOIs
Publication statusPublished - 1 Dec 2008
Externally publishedYes
Event3rd International Conference on Communications and Networking in China, ChinaCom 2008 - Hangzhou, China
Duration: 25 Aug 200827 Aug 2008

Other

Other3rd International Conference on Communications and Networking in China, ChinaCom 2008
CountryChina
CityHangzhou
Period25/8/0827/8/08

Fingerprint

Routers
statistics
Sampling
Statistics
traffic
performance
monitoring
information flow
Monitoring

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering
  • Communication

Cite this

Haddadi, H., Landa, R., Moore, A. W., Bhatti, S., Rio, M., & Che, X. (2008). Revisiting the issues on netflow sample and export performance. In 3rd International Conference on Communications and Networking in China, ChinaCom 2008 (pp. 442-446). [4685060] https://doi.org/10.1109/CHINACOM.2008.4685060

Revisiting the issues on netflow sample and export performance. / Haddadi, Hamed; Landa, Raul; Moore, Andrew W.; Bhatti, Saleem; Rio, Miguel; Che, Xianhui.

3rd International Conference on Communications and Networking in China, ChinaCom 2008. 2008. p. 442-446 4685060.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Haddadi, H, Landa, R, Moore, AW, Bhatti, S, Rio, M & Che, X 2008, Revisiting the issues on netflow sample and export performance. in 3rd International Conference on Communications and Networking in China, ChinaCom 2008., 4685060, pp. 442-446, 3rd International Conference on Communications and Networking in China, ChinaCom 2008, Hangzhou, China, 25/8/08. https://doi.org/10.1109/CHINACOM.2008.4685060
Haddadi H, Landa R, Moore AW, Bhatti S, Rio M, Che X. Revisiting the issues on netflow sample and export performance. In 3rd International Conference on Communications and Networking in China, ChinaCom 2008. 2008. p. 442-446. 4685060 https://doi.org/10.1109/CHINACOM.2008.4685060
Haddadi, Hamed ; Landa, Raul ; Moore, Andrew W. ; Bhatti, Saleem ; Rio, Miguel ; Che, Xianhui. / Revisiting the issues on netflow sample and export performance. 3rd International Conference on Communications and Networking in China, ChinaCom 2008. 2008. pp. 442-446
@inproceedings{e76c9ada472c41fc8a4236c2f524fb17,
title = "Revisiting the issues on netflow sample and export performance",
abstract = "The high volume of packets and packet rates of traffic on some router links makes it exceedingly difficult for routers to examine every packet in order to keep detailed statistics about the traffic which is traversing the router. Sampling is commonly applied on routers in order to limit the load incurred by the collection of information that the router has to undertake when evaluating flow information for monitoring purposes. The sampling process in nearly all cases is a deterministic process of choosing 1 in every N packets on a per-interface basis, and then forming the flow statistics based on the collected sampled statistics. Even though this sampling may not be significant for some statistics, such as packet rate, others can be severely distorted. However, it is important to consider the sampling techniques and their relative accuracy when applied to different traffic patterns. In this paper, we assess the performance of the sampling process as used in NetFlow in detail, and we discuss some techniques for the compensation of loss of monitoring detail.",
author = "Hamed Haddadi and Raul Landa and Moore, {Andrew W.} and Saleem Bhatti and Miguel Rio and Xianhui Che",
year = "2008",
month = "12",
day = "1",
doi = "10.1109/CHINACOM.2008.4685060",
language = "English",
isbn = "9781424423736",
pages = "442--446",
booktitle = "3rd International Conference on Communications and Networking in China, ChinaCom 2008",

}

TY - GEN

T1 - Revisiting the issues on netflow sample and export performance

AU - Haddadi, Hamed

AU - Landa, Raul

AU - Moore, Andrew W.

AU - Bhatti, Saleem

AU - Rio, Miguel

AU - Che, Xianhui

PY - 2008/12/1

Y1 - 2008/12/1

N2 - The high volume of packets and packet rates of traffic on some router links makes it exceedingly difficult for routers to examine every packet in order to keep detailed statistics about the traffic which is traversing the router. Sampling is commonly applied on routers in order to limit the load incurred by the collection of information that the router has to undertake when evaluating flow information for monitoring purposes. The sampling process in nearly all cases is a deterministic process of choosing 1 in every N packets on a per-interface basis, and then forming the flow statistics based on the collected sampled statistics. Even though this sampling may not be significant for some statistics, such as packet rate, others can be severely distorted. However, it is important to consider the sampling techniques and their relative accuracy when applied to different traffic patterns. In this paper, we assess the performance of the sampling process as used in NetFlow in detail, and we discuss some techniques for the compensation of loss of monitoring detail.

AB - The high volume of packets and packet rates of traffic on some router links makes it exceedingly difficult for routers to examine every packet in order to keep detailed statistics about the traffic which is traversing the router. Sampling is commonly applied on routers in order to limit the load incurred by the collection of information that the router has to undertake when evaluating flow information for monitoring purposes. The sampling process in nearly all cases is a deterministic process of choosing 1 in every N packets on a per-interface basis, and then forming the flow statistics based on the collected sampled statistics. Even though this sampling may not be significant for some statistics, such as packet rate, others can be severely distorted. However, it is important to consider the sampling techniques and their relative accuracy when applied to different traffic patterns. In this paper, we assess the performance of the sampling process as used in NetFlow in detail, and we discuss some techniques for the compensation of loss of monitoring detail.

UR - http://www.scopus.com/inward/record.url?scp=58049166177&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=58049166177&partnerID=8YFLogxK

U2 - 10.1109/CHINACOM.2008.4685060

DO - 10.1109/CHINACOM.2008.4685060

M3 - Conference contribution

SN - 9781424423736

SP - 442

EP - 446

BT - 3rd International Conference on Communications and Networking in China, ChinaCom 2008

ER -