Measurement Artifacts in NetFlow Data

R.J. Hofstede, Idilio Drago, Anna Sperotto, R. Sadre, Aiko Pras

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    13 Citations (Scopus)
    235 Downloads (Pure)

    Abstract

    Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.
    Original languageUndefined
    Title of host publication14th International Conference on Passive and Active Measurement, PAM 2013
    EditorsMatthew Roughan, Rocky Chang
    Place of PublicationBerlin
    PublisherSpringer
    Pages1-10
    Number of pages10
    ISBN (Print)978-3-642-36515-7
    DOIs
    Publication statusPublished - Mar 2013
    Event14th International Conference on Passive and Active Measurement, PAM 2013 - Hong Kong, Hong Kong
    Duration: 18 Mar 201319 Mar 2013
    Conference number: 14
    http://pam2013.comp.polyu.edu.hk/

    Publication series

    NameLecture Notes in Computer Science
    PublisherSpringer Verlag
    Volume7799
    ISSN (Print)0302-9743
    ISSN (Electronic)1611-3349

    Conference

    Conference14th International Conference on Passive and Active Measurement, PAM 2013
    Abbreviated titlePAM
    CountryHong Kong
    CityHong Kong
    Period18/03/1319/03/13
    Internet address

    Keywords

    • EWI-23200
    • METIS-296371
    • IR-85418

    Cite this

    Hofstede, R. J., Drago, I., Sperotto, A., Sadre, R., & Pras, A. (2013). Measurement Artifacts in NetFlow Data. In M. Roughan, & R. Chang (Eds.), 14th International Conference on Passive and Active Measurement, PAM 2013 (pp. 1-10). (Lecture Notes in Computer Science; Vol. 7799). Berlin: Springer. https://doi.org/10.1007/978-3-642-36516-4_1
    Hofstede, R.J. ; Drago, Idilio ; Sperotto, Anna ; Sadre, R. ; Pras, Aiko. / Measurement Artifacts in NetFlow Data. 14th International Conference on Passive and Active Measurement, PAM 2013. editor / Matthew Roughan ; Rocky Chang. Berlin : Springer, 2013. pp. 1-10 (Lecture Notes in Computer Science).
    @inproceedings{d754017904a94d64996cf1ded1299f2a,
    title = "Measurement Artifacts in NetFlow Data",
    abstract = "Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.",
    keywords = "EWI-23200, METIS-296371, IR-85418",
    author = "R.J. Hofstede and Idilio Drago and Anna Sperotto and R. Sadre and Aiko Pras",
    note = "10.1007/978-3-642-36516-4_1",
    year = "2013",
    month = "3",
    doi = "10.1007/978-3-642-36516-4_1",
    language = "Undefined",
    isbn = "978-3-642-36515-7",
    series = "Lecture Notes in Computer Science",
    publisher = "Springer",
    pages = "1--10",
    editor = "Matthew Roughan and Rocky Chang",
    booktitle = "14th International Conference on Passive and Active Measurement, PAM 2013",

    }

    Hofstede, RJ, Drago, I, Sperotto, A, Sadre, R & Pras, A 2013, Measurement Artifacts in NetFlow Data. in M Roughan & R Chang (eds), 14th International Conference on Passive and Active Measurement, PAM 2013. Lecture Notes in Computer Science, vol. 7799, Springer, Berlin, pp. 1-10, 14th International Conference on Passive and Active Measurement, PAM 2013, Hong Kong, Hong Kong, 18/03/13. https://doi.org/10.1007/978-3-642-36516-4_1

    Measurement Artifacts in NetFlow Data. / Hofstede, R.J.; Drago, Idilio; Sperotto, Anna; Sadre, R.; Pras, Aiko.

    14th International Conference on Passive and Active Measurement, PAM 2013. ed. / Matthew Roughan; Rocky Chang. Berlin : Springer, 2013. p. 1-10 (Lecture Notes in Computer Science; Vol. 7799).

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    TY - GEN

    T1 - Measurement Artifacts in NetFlow Data

    AU - Hofstede, R.J.

    AU - Drago, Idilio

    AU - Sperotto, Anna

    AU - Sadre, R.

    AU - Pras, Aiko

    N1 - 10.1007/978-3-642-36516-4_1

    PY - 2013/3

    Y1 - 2013/3

    N2 - Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.

    AB - Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.

    KW - EWI-23200

    KW - METIS-296371

    KW - IR-85418

    U2 - 10.1007/978-3-642-36516-4_1

    DO - 10.1007/978-3-642-36516-4_1

    M3 - Conference contribution

    SN - 978-3-642-36515-7

    T3 - Lecture Notes in Computer Science

    SP - 1

    EP - 10

    BT - 14th International Conference on Passive and Active Measurement, PAM 2013

    A2 - Roughan, Matthew

    A2 - Chang, Rocky

    PB - Springer

    CY - Berlin

    ER -

    Hofstede RJ, Drago I, Sperotto A, Sadre R, Pras A. Measurement Artifacts in NetFlow Data. In Roughan M, Chang R, editors, 14th International Conference on Passive and Active Measurement, PAM 2013. Berlin: Springer. 2013. p. 1-10. (Lecture Notes in Computer Science). https://doi.org/10.1007/978-3-642-36516-4_1