Requirements for IP Flow Information Export (IPFIX)

Zseby, Tanja; Quittek, Juergen; Claise, Benoît; Zander, Sebastian

doi:10.17487/rfc3917

Cited by 159 publications

(131 citation statements)

References 11 publications

Supporting

Mentioning

127

Contrasting

Unclassified

Order By: Relevance

“…IP flow [29] is a standard tool for today's large-scale network monitoring. A flow is a series of IP packets sharing the same source, destination address, associated ports, and protocols.…”

Section: Flow Monitoringmentioning

confidence: 99%

See 1 more Smart Citation

BotTrack: Tracking Botnets Using NetFlow and PageRank

Jérôme

Wang

State

et al. 2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. With large scale botnets emerging as one of the major current threats, the automatic detection of botnet traffic is of high importance for service providers and large campus network monitoring. Faced with high speed network connections, detecting botnets must be efficient and accurate. This paper proposes a novel approach for this task, where NetFlow related data is correlated and a host dependency model is leveraged for advanced data mining purposes. We extend the popular linkage analysis algorithm PageRank [27] with an additional clustering process in order to efficiently detect stealthy botnets using peer-to-peer communication infrastructures and not exhibiting large volumes of traffic. The key conceptual component in our approach is to analyze communication behavioral patterns and to infer potential botnet activities.

show abstract

“…IP flow [29] is a standard tool for today's large-scale network monitoring. A flow is a series of IP packets sharing the same source, destination address, associated ports, and protocols.…”

Section: Flow Monitoringmentioning

confidence: 99%

“…Almost all modern commercial-grade routers support flow record export. In this paper, we use without any distinction the terms IP flow [29] and NetFlow [7] which reflects different standards. …”

Section: Flow Monitoringmentioning

confidence: 99%

BotTrack: Tracking Botnets Using NetFlow and PageRank

Jérôme

Wang

State

et al. 2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…"Architecture for IP Flow Information Export" [RFC5470] defines the architecture for the export of measured IP flow information out of an IPFIX Exporting Process to an IPFIX Collecting Process, and the basic terminology used to describe the elements of this architecture, per the requirements defined in "Requirements for IP Flow Information Export" [RFC3917]. The IPFIX Protocol document [RFC5101] then covers the details of the method for transporting IPFIX Data Records and Templates via a congestion-aware transport protocol from an IPFIX Exporting Process to an IPFIX Collecting Process.…”

Section: Ipfix Documents Overviewmentioning

confidence: 99%

IP Flow Anonymization Support

Trammell¹,

Boschi²

2011

View full text Add to dashboard Cite

This document describes anonymization techniques for IP flow data and the export of anonymized data using the IP Flow Information Export (IPFIX) protocol. It categorizes common anonymization schemes and defines the parameters needed to describe them. It provides guidelines for the implementation of anonymized data export and storage over IPFIX, and describes an information model and Optionsbased method for anonymization metadata export within the IPFIX protocol or storage in IPFIX Files.

show abstract

“…A flow is defined as a set of packets sharing common properties and passing through an observation point [8]. Flow monitoring is supported by various software tools, as well as by network equipment [9].…”

Section: Introductionmentioning

confidence: 99%

Towards Bandwidth Estimation Using Flow-Level Measurements

Schmidt

Sperotto

Sadre

et al. 2012

Dependable Networks and Services

View full text Add to dashboard Cite

Abstract. Bandwidth estimation is one of the prerequisite for efficient link dimensioning. In the past, several approaches to bandwidth estimation have been proposed, ranging from rules-of-thumb providing over-provisioning guidelines to mathematically backed-up provisioning formulas. The limitation of such approaches, in our eyes, is that they largely rely on packet-based measurements, which are almost unfeasible considering nowadays load and speed (1-10 Gbps). In this context, flow-based measurements seems to be a suitable alternative, addressing both data aggregation as well as scalability issues. However, flows pose a challenge for bandwidth estimation, namely the coarser data granularity compared to packet-based approaches, which can lead to a lower precision in the estimation of the needed bandwidth. In this paper, we investigate what is the impact of flow-based measurements on bandwidth estimation. In particular, we are interested in quantifying the impact of flows on main statistical traffic characteristics, in particular the traffic rate variance. Our approach is validated on real traffic traces captured from 2002 to 2011 at the University of Twente.

show abstract

Requirements for IP Flow Information Export (IPFIX)

Abstract: Requirements for IP Flow Information Export (IPFIX) Status of this Memo This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Cited by 159 publications

References 11 publications

BotTrack: Tracking Botnets Using NetFlow and PageRank

BotTrack: Tracking Botnets Using NetFlow and PageRank

IP Flow Anonymization Support

Towards Bandwidth Estimation Using Flow-Level Measurements

Contact Info

Product

Resources

About