Large-Scale Geolocation for NetFlow

Pavel Celeda, Petr Velan, Martin Rabek, R.J. Hofstede, Aiko Pras

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    4 Citations (Scopus)
    130 Downloads (Pure)

    Abstract

    The importance of IP address geolocation has increased significantly in recent years, due to its applications in business advertisements and security analysis, among others. Current approaches perform geolocation mostly on-demand and in a small-scale fashion. As soon as geolocation needs to be performed in real-time and in high-speed and large-scale networks, these approaches are not scalable anymore. To solve this problem, we propose two approaches to large-scale geolocation. Firstly, we present an exporter-based approach, which adds geolocation data to flow records in a way that is transparent to any flow collector. Secondly, we present a flow collector-based approach, which adds native geolocation to NetFlow data from any flow exporter. After presenting prototypes for both approaches, we demonstrate the applicability of large-scale geolocation by means of use cases. Our prototypes have shown to be scalable enough for deployment on the 10 Gbps Internet connection of the Masaryk University.
    Original languageUndefined
    Title of host publicationProceedings of the 13th IFIP/IEEE International Symposium on Integrated Network Management, IM 2013
    Place of PublicationUSA
    PublisherIEEE Communications Society
    Pages1015-1020
    Number of pages6
    ISBN (Print)978-1-4673-5229-1
    Publication statusPublished - May 2013
    Event13th IFIP/IEEE International Symposium on Integrated Network Management, IM 2013 - Ghent, Belgium
    Duration: 27 May 201331 May 2013
    Conference number: 13
    http://dl.ifip.org/db/conf/im/im2013/index.html

    Publication series

    Name
    PublisherIEEE Communications Society

    Conference

    Conference13th IFIP/IEEE International Symposium on Integrated Network Management, IM 2013
    Abbreviated titleIM 2013
    CountryBelgium
    CityGhent
    Period27/05/1331/05/13
    Internet address

    Keywords

    • EWI-23547
    • METIS-297751
    • IR-87076

    Cite this