Flow-Based Measurement: IPFIX Development and Deployment

Abstract

SUMMARYThis paper presents a history of the IPFIX working group, from initial chartering through development and testing, re-chartering and further development, and looking ahead to future developments. As a standardised way of exporting information about traffic flows, IPFIX has attracted a growing number of implementors, who have continued to develop it in useful ways without changing its underlying architecture. This makes it a good example of how to develop a new technology. Further, it demonstrates widespread recognition of the importance of network measurement in the development, deployment and production stages of networks and the applications that depend on them. key words: traffic flows, network data export, IPFIX

Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX

“…The first version to see wide adoption was NetFlow v5 [11], which became available to the public around 2002. Although Cisco never published any official documentation on the protocol, the widespread use was in part result of Cisco making the corresponding data format freely available [2]. NetFlow v5 was obsoleted by the more flexible NetFlow v9, the state of which as of 2004 is described in [12].…”

“…These specifications were the basis of what has become the IPFIX Internet Standard [1] in late 2013. A short history on flow export and details on development and deployment of IPFIX are provided in [2].…”

“…Features provided by controllers on these NICs (e.g., Intel 82599, Myri-10G Lanai Z8ES) include multiple receive queues by means of Receive Side Scaling to distribute packets across multiple CPUs [39], and a DMA engine to off-load CPU processing. To be able to use these features, vendors provide a set of libraries and drivers for fast packet processing, such as Intel DPDK 2 and PF RING DNA/Libzero 3 .…”

“…These common properties may include packet header fields, such as source and destination IP addresses and port numbers, packet contents, and meta-information. Initial works on flow export date back to the nineties and became the basis for modern protocols, such as NetFlow and IP Flow Information eXport (IPFIX) [2].…”

Next Generation Application-Aware Flow Monitoring

“…The NetFlow protocol originally designed by Cisco has been used for almost 20 years now [1]. The first version widely deployed was NetFlow version 5 [5].…”