Measurement Artifacts in NetFlow Data

R.J. Hofstede; Idilio Drago; Anna Sperotto; R. Sadre; Aiko Pras

doi:10.1007/978-3-642-36516-4_1

Measurement Artifacts in NetFlow Data

R.J. Hofstede, Idilio Drago, Anna Sperotto, R. Sadre, Aiko Pras

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

20 Citations (Scopus)

462 Downloads (Pure)

Abstract

Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.

Original language	Undefined
Title of host publication	14th International Conference on Passive and Active Measurement, PAM 2013
Editors	Matthew Roughan, Rocky Chang
Place of Publication	Berlin
Publisher	Springer
Pages	1-10
Number of pages	10
ISBN (Print)	978-3-642-36515-7
DOIs	https://doi.org/10.1007/978-3-642-36516-4_1
Publication status	Published - Mar 2013
Event	14th International Conference on Passive and Active Measurement, PAM 2013 - Hong Kong, Hong Kong Duration: 18 Mar 2013 → 19 Mar 2013 Conference number: 14 http://pam2013.comp.polyu.edu.hk/

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer Verlag
Volume	7799
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	14th International Conference on Passive and Active Measurement, PAM 2013
Abbreviated title	PAM
Country/Territory	Hong Kong
City	Hong Kong
Period	18/03/13 → 19/03/13
Internet address	http://pam2013.comp.polyu.edu.hk/

Keywords

EWI-23200
METIS-296371
IR-85418

Access to Document

10.1007/978-3-642-36516-4_1

Cite this

@inproceedings{d754017904a94d64996cf1ded1299f2a,

title = "Measurement Artifacts in NetFlow Data",

abstract = "Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts{\textquoteright} presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.",

keywords = "EWI-23200, METIS-296371, IR-85418",

author = "R.J. Hofstede and Idilio Drago and Anna Sperotto and R. Sadre and Aiko Pras",

note = "10.1007/978-3-642-36516-4_1 ; 14th International Conference on Passive and Active Measurement, PAM 2013 ; Conference date: 18-03-2013 Through 19-03-2013",

year = "2013",

month = mar,

doi = "10.1007/978-3-642-36516-4_1",

language = "Undefined",

isbn = "978-3-642-36515-7",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "1--10",

editor = "Matthew Roughan and Rocky Chang",

booktitle = "14th International Conference on Passive and Active Measurement, PAM 2013",

address = "Germany",

url = "http://pam2013.comp.polyu.edu.hk/",

}

Hofstede, RJ, Drago, I, Sperotto, A, Sadre, R & Pras, A 2013, Measurement Artifacts in NetFlow Data. in M Roughan & R Chang (eds), 14th International Conference on Passive and Active Measurement, PAM 2013. Lecture Notes in Computer Science, vol. 7799, Springer, Berlin, pp. 1-10, 14th International Conference on Passive and Active Measurement, PAM 2013, Hong Kong, Hong Kong, 18/03/13. https://doi.org/10.1007/978-3-642-36516-4_1

Measurement Artifacts in NetFlow Data. / Hofstede, R.J.; Drago, Idilio; Sperotto, Anna et al.
14th International Conference on Passive and Active Measurement, PAM 2013. ed. / Matthew Roughan; Rocky Chang. Berlin: Springer, 2013. p. 1-10 (Lecture Notes in Computer Science; Vol. 7799).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Measurement Artifacts in NetFlow Data

AU - Hofstede, R.J.

AU - Drago, Idilio

AU - Sperotto, Anna

AU - Sadre, R.

AU - Pras, Aiko

N1 - Conference code: 14

PY - 2013/3

Y1 - 2013/3

N2 - Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.

AB - Flows provide an aggregated view of network traffic by grouping streams of packets. The resulting scalability gain usually excuses the coarser data granularity, as long as the flow data reflects the actual network traffic faithfully. However, it is known that the flow export process may introduce artifacts in the exported data. This paper extends the set of known artifacts by explaining which implementation decisions are causing them. In addition, we verify the artifacts’ presence in data from a set of widely-used devices. Our results show that the revealed artifacts are widely spread among different devices from various vendors. We believe that these results provide researchers and operators with important insights for developing robust analysis applications.

KW - EWI-23200

KW - METIS-296371

KW - IR-85418

U2 - 10.1007/978-3-642-36516-4_1

DO - 10.1007/978-3-642-36516-4_1

M3 - Conference contribution

SN - 978-3-642-36515-7

T3 - Lecture Notes in Computer Science

SP - 1

EP - 10

BT - 14th International Conference on Passive and Active Measurement, PAM 2013

A2 - Roughan, Matthew

A2 - Chang, Rocky

PB - Springer

CY - Berlin

T2 - 14th International Conference on Passive and Active Measurement, PAM 2013

Y2 - 18 March 2013 through 19 March 2013

ER -