Challenges in the capture and dissemination of measurements from high-speed networks

Clegg, R. E. S.; Withall, Mark S.; Moore, Andrew W.; Phillips, Iain; Parish, David J.; Rio, Miguel; Landa, Raul; Haddadi, Hamed; Kyriakopoulos, K.; Augé, Jordan; Clayton, Richard; Salmon, Derrick

doi:10.1049/iet-com.2008.0068

Cited by 10 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…NFDUMP mengumpulkan dan mengolah data dari NetFlow dengan menggunakan perintah dari command line. [12]. Untuk kepentingan ini maka digunakan sebuah tools yang disebut NFDUMP.…”

Section: Pendahuluanunclassified

NetFlow dalam Monitoring Penggunaan Internet

Paramecwari

Sastra

Wiharta

2017

JTE

View full text Add to dashboard Cite

Intisari— Network monitoring dan klasifikasi trafik merupakan hal yang penting untuk bisa mengetahui unjuk kerja suatu jaringan. Dengan adanya fungsi monitoring jaringan, kegagalan dalam jaringan akan bisa terdeteksi dengan lebih cepat sehingga dapat mengurangi dampak negatif, seperti keluhan dari para pengguna. Pada jaringan Kampus Universitas Udayana penggunaan Internet sudah cukup tinggi sehingga perlu dilakukan penelitian atau assessment terhadap kondisi jaringan eksisting. Tujuan pada penelitian ini untuk memonitoring dan memodelkan karakter dari pengguna dengan menggunakan NetFlow dan NFDUMP. Berdasarkan hasil pengamatan diperoleh bahwa protokol TCP mendominasi penggunaan jaringan, diikuti oleh protokol UDP, dan beberapa protokol lainnya. Dari sisi sumber trafik, diketahui bahwa media sosial adalah situs yang paling sering diakses oleh user. Hasil dari penelitian ini bisa digunakan sebagai bahan pertimbangan dalam re-design jaringan dan kebijakan (policy) yang diterapkan dalam kampus terkait dengan akses internet. Kata Kunci— Network Monitoring, Trafik Internet, Jaringan Kampus, NetFlow.

show abstract

“…NFDUMP mengumpulkan dan mengolah data dari NetFlow dengan menggunakan perintah dari command line. [12]. Untuk kepentingan ini maka digunakan sebuah tools yang disebut NFDUMP.…”

Section: Pendahuluanunclassified

NetFlow dalam Monitoring Penggunaan Internet

Paramecwari

Sastra

Wiharta

2017

JTE

View full text Add to dashboard Cite

show abstract

“…Pilli proposed a method that collects packets under the TCP/IP protocol to analyze the common characteristics of attacks so as to filter suspicious packets [9]. However, high data rate of network traffic creates difficulties for network forensics in the capture and preservation of all network packets [10]. Kaushik, through scanning ports, found that attackers could find potential loopholes and then use these vulnerabilities to attack hosts [11].…”

Section: Related Workmentioning

confidence: 99%

Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning

Chang

Peng

et al. 2016

Future Internet

View full text Add to dashboard Cite

As the Internet becomes larger in scale, more complex in structure and more diversified in traffic, the number of crimes that utilize computer technologies is also increasing at a phenomenal rate. To react to the increasing number of computer crimes, the field of computer and network forensics has emerged. The general purpose of network forensics is to find malicious users or activities by gathering and dissecting firm evidences about computer crimes, e.g., hacking. However, due to the large volume of Internet traffic, not all the traffic captured and analyzed is valuable for investigation or confirmation. After analyzing some existing network forensics methods to identify common shortcomings, we propose in this paper a new network forensics method that uses a combination of network vulnerability and network evidence graph. In our proposed method, we use vulnerability evidence and reasoning algorithm to reconstruct attack scenarios and then backtrack the network packets to find the original evidences. Our proposed method can reconstruct attack scenarios effectively and then identify multi-staged attacks through evidential reasoning. Results of experiments show that the evidence graph constructed using our method is more complete and credible while possessing the reasoning capability.

show abstract

“…Article from Clegg et al [5] published in 2008 comprehensively describes practical and legal aspects of monitoring of a 10 G research network. Authors also provide several data sets containing captured packet headers as a part of their contribution.…”

Section: Related Workmentioning

confidence: 99%

High-density network flow monitoring

Velan

Pus

2015

2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)

View full text Add to dashboard Cite

Abstract-Monitoring of high-speed networks is becoming a resource intensive task. There are dedicated flow monitoring probes built with commodity hardware support up to 10 G links, but multiple 10 G or even 100 G optical networks are being used for transport networks and a data center connectivity. Running and maintaining many separate probes is uneconomical and timeconsuming. Therefore, we explore the possibility to facilitate network interface cards (NICs) with multiple 10 G interfaces to build probes which can replace many existing boxes, leading to reduced management and operational costs. The monitoring performance is critical for such a high-density solution. We use two custom-built, FPGA-based NICs, each with eight 10 G interfaces to test current CPU limits and to propose improvements for the near future commodity NICs.

show abstract

Challenges in the capture and dissemination of measurements from high-speed networks

Cited by 10 publications

References 11 publications

NetFlow dalam Monitoring Penggunaan Internet

NetFlow dalam Monitoring Penggunaan Internet

Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning

High-density network flow monitoring

Contact Info

Product

Resources

About