J 2014

Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX

HOFSTEDE, Rick, Pavel ČELEDA, Brian TRAMMELL, Idilio DRAGO, Ramin SADRE et. al.

Basic information

Original name

Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX

Authors

HOFSTEDE, Rick (528 Netherlands), Pavel ČELEDA (203 Czech Republic, guarantor, belonging to the institution), Brian TRAMMELL (840 United States of America), Idilio DRAGO (76 Brazil), Ramin SADRE (528 Netherlands), Anna SPEROTTO (380 Italy) and Aiko PRAS (528 Netherlands)

Edition

IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, PISCATAWAY, IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC, 2014, 1553-877X

Other information

Language

English

Type of outcome

Article in a journal

Field of Study

Informatics

Country of publisher

United States of America

Confidentiality degree

is not subject to a state or trade secret

References:

URL URL

RIV identification code

RIV/00216224:14610/14:00073220

Organization

Ústav výpočetní techniky – Repository – Repository

UT WoS

000345570200013

Keywords in English

Flow export; network monitoring; Internet measurements; NetFlow; IPFIX

Links

VG20132015103, research and development project.
Changed: 1/9/2020 20:03, RNDr. Daniel Jakubík

Abstract

V originále

Flow monitoring has become a prevalent method for monitoring traffic in high-speed networks. By focusing on the analysis of flows, rather than individual packets, it is often said to be more scalable than traditional packet-based traffic analysis. Flow monitoring embraces the complete chain of packet observation, flow export using protocols such as NetFlow and IPFIX, data collection, and data analysis. In contrast to what is often assumed, all stages of flow monitoring are closely intertwined. Each of these stages therefore has to be thoroughly understood, before being able to perform sound flow measurements. Otherwise, flow data artifacts and data loss can be the consequence, potentially without being observed. This paper is the first of its kind to provide an integrated tutorial on all stages of a flow monitoring setup. As shown throughout this paper, flow monitoring has evolved from the early 1990s into a powerful tool, and additional functionality will certainly be added in the future. We show, for example, how the previously opposing approaches of deep packet inspection and flow monitoring have been united into novel monitoring approaches.
Displayed: 21/5/2025 12:53