Flow Information Storage Assessment Using IPFIXcol

Velan, Petr; Krejčí, Radek

doi:10.1007/978-3-642-30633-4_21

Cited by 11 publications

(4 citation statements)

References 7 publications

(6 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All measured lines are at least 10 Gbit/s and together transport about 80,000 flows/s during work hours, which results in total traffic of 15.4 Gbit/s. We use IPFIXcol [15] framework to collect the extended flow data over TCP and to store them. New elements can therefore be defined and used without any further difficulties or limitations.…”

Section: Methodology and Measurement Setupmentioning

confidence: 99%

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Elich

Velan

Jirsík

et al. 2013

38th Annual IEEE Conference on Local Computer Networks - Workshops

Self Cite

View full text Add to dashboard Cite

The exhaustion of IPv4 address space increases pressure on network operators and content providers to continue the transition to IPv6. The IPv6 transition mechanisms such as Teredo and 6to4 allow IPv4 hosts to connect to IPv6 hosts. On the other hand, they increase network complexity and render ineffective many methods to observe IP traffic. In this paper, we modified our flow-based measurement system to involve transition mechanisms information to provide full IPv6 visibility. Our traffic analysis focuses on IPv6 tunneled traffic and uses data collected over one week in the Czech national research and education network. The results expose various traffic characteristics of native and tunneled IPv6 traffic, among others the TTL and HOP limit distribution, geolocation aspect of the traffic, and list of Teredo servers used in the network. Furthermore, we show how the traffic of IPv6 transition mechanisms has evolved since 2010.

show abstract

Section: Methodology and Measurement Setupmentioning

confidence: 99%

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Elich

Velan

Jirsík

et al. 2013

38th Annual IEEE Conference on Local Computer Networks - Workshops

Self Cite

View full text Add to dashboard Cite

show abstract

“…Figure 4 shows the configuration of our testing environment. IPFIXsend and IPFIXcol [15] were used for replaying the IPFIX data in real-time. The flow data were received by the flow scatter and also directly by the node 0 which was used as a reference single instance (it processes all flow data without any splitting).…”

Section: Testing Environmentmentioning

confidence: 99%

Making Flow-Based Security Detection Parallel

Švepeš¹,

Čejka

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Flow based monitoring is currently a standard approach suitable for large networks of ISP size. The main advantage of flow processing is a smaller amount of data due to aggregation. There are many reasons (such as huge volume of transferred data, attacks represented by many flow records) to develop scalable systems that can process flow data in parallel. This paper deals with splitting a stream of flow data in order to perform parallel anomaly detection on distributed computational nodes. Flow data distribution is focused not only on uniformity but mainly on successful detection. The results of an experimental analysis show that the proposed approach does not break important semantic relations between individual flow records and therefore it preserves detection results. All experiments were performed using real data traces from Czech National Education and Research Network.

show abstract

“…Set is similar to HashSet<T> in C# in its functionality [18], albeit the syntax is different. Table is similar to Dictionary<TKey,TValue> in C# [29] with the difference that C# allows only one key while Bro allows multiple keys. Vector is a table indexed by count.…”

Section: ) Bromentioning

confidence: 99%

“…IPFIXcol [29] is an IPFIX collector designed for highthroughput networks. IPFIXcol claims to be flexible.…”

Section: ) Flow Collectorsmentioning

confidence: 99%

A Survey on Network Security Monitoring Systems

Ghafir

Přenosil

Svoboda

et al. 2016

2016 IEEE 4th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW)

View full text Add to dashboard Cite

Abstract-Network monitoring is a difficult and demanding task that is a vital part of a network administrator's job. Network administrators are constantly striving to maintain smooth operation of their networks. If a network were to be down even for a small period of time, productivity within a company would decline, and in the case of public service departments the ability to provide essential services would be compromised. There are different network security approaches. This paper provides the readers with an overview of concrete software implementations of the current network monitoring approaches. In addition, it presents a comparison between those implementations.

show abstract

Flow Information Storage Assessment Using IPFIXcol

Cited by 11 publications

References 7 publications

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Making Flow-Based Security Detection Parallel

A Survey on Network Security Monitoring Systems

Contact Info

Product

Resources

About