Exporting IP flows using IPFIX

Todays computer networks are continuously expanding both in size and capacity to accommodate the demands of the traffic they are designed to handle. Depending on the needs of the network operator, different aspects of this traffic needs to be measured and analyzed. Processing the full amount of data on the network would be a daunting task, and to avoid this only certain statistics describing the individual packets are collected. This data is then aggregated into ”flows”, based on criteria from the network operator. IPFIX is a recent IETF effort to standardize a protocol for exporting such flows to a central node for analyzation. But to effectively utilize a system implementing this protocol, one needs to know the impact of the protocol itself on the underlying network and consequently the traffic that flows through it. This document will explore the performance, capabilities and limitations of the IPFIX protocol. A packet-capture system utilizing the IPFIX protocol for flow export, will be set up in a controlled environment, and traffic will be generated in a predictable manner. Measurements indicate IPFIX to be a fairly flexible protocol for exporting various traffic characteristics, but that it also has scalability issues when deployed in larger, high-capacity networks.Master i nettverks- og systemadministrasjo

Exporting IP flows using IPFIX : Master Thesis

Todays computer networks are continuously expanding both in size and capacity to accommodate the demands of the traffic they are designed to handle. Depending on the needs of the network operator, different aspects of this traffic needs to be measured and analyzed. Processing the full amount of data on the network would be a daunting task, and to avoid this only certain statistics describing the individual packets are collected. This data is then aggregated into "flows", based on criteria from the network operator. IPFIX is a recent IETF effort to standardize a protocol for exporting such flows to a central node for analyzation. But to effectively utilize a system implementing this protocol, one needs to know the impact of the protocol itself on the underlying network and consequently the traffic that flows through it. This document will explore the performance, capabilities and limitations of the IPFIX protocol. A packet-capture system utilizing the IPFIX protocol for flow export, will be set up in a controlled environment, and traffic will be generated in a predictable manner. Measurements indicate IPFIX to be a fairly flexible protocol for exporting various traffic characteristics, but that it also has scalability issues when deployed in larger, high-capacity networks

On traffic classification and its applications in the Internet

In this work, the methods and applications of traffic classification in the Internet are examined in detail. First, we define and discuss the conceptual environment of traffic classification. We then discuss the performance issues of traffic classification and define a method of visualization to compare the performance of traffic classification implementations. Previously introduced methods of traffic classification: the static applications, the packet count and the list classifiers are compared with each other. We find these methods to perform quite well when analyzed as performing in an IP router, but to be rather ambiguous as to the effect they cause to the user. We introduce an implementation of dynamic traffic classification to two classes using learning vector quantization (LVQ) for flow analysis data and find it to perform well in a simulated environment using flow analysis made on traffic measurements. In comparison to the previous methods of traffic classification, we see that the LVQ classifier has adequate performance. We also study a method of traffic classification using consecutive flow analysis with varying values of the parameters of the flow and find that we are able to classify traffic to 2 or 3 different classes. Within the classes the applications are similar in measured behavior and thus may provide help in realizing some advanced Internet service architectures. Finally, we also observe the application of the dynamic classifier in an Internet router and in the Internet itself. We argue that the implementation of the dynamic classification method is feasible in the network.reviewe