Self-Management of Hybrid Networks: Can We Trust NetFlow Data?

Tiago Fioreze, Lisandro Zambenedetti Granville, L. Granville, Aiko Pras, Anna Sperotto, R. Sadre

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    9 Citations (Scopus)
    119 Downloads (Pure)


    Network measurement provides vital information on the health of managed networks. The collection of network information can be used for several reasons (e.g., accounting or security) depending on the purpose the collected data will be used for. At the University of Twente (UT), an automatic decision process for hybrid networks that relies on collected network information has been investigated. This approach, called self-management of hybrid networks requires information retrieved from measuring processes in order to automatically decide on establishing/releasing lambda-connections for IP flows that are long in duration and big in volume (known as elephant flows). Nonetheless, the employed measurement technique can break the self-management decisions if the reported information does not accurately describe the actual behavior and characteristics of the observed flows. Within this context, this paper presents an investigation on the trustfulness of measurements performed using the popular NetFlow monitoring solution when elephant flows are especially observed. We primarily focus on the use of NetFlow with sampling in order to collect network information and investigate how reliable such information is for the self-management processes. This is important because the self-management approach decides which flows should be offloaded to the optical level based on the current state of the network and its running flows. We observe three specific flow metrics: octets, packets, and flow duration. Our analysis shows that NetFlow provides reliable information regarding octets and packets. On the other hand, the flow duration reported when sampling is employed tends to be shorter than the actual duration.
    Original languageUndefined
    Title of host publication11th IFIP/IEEE International Symposium on Integrated Network Management (IM 2009)
    Place of PublicationPiscataway
    Number of pages8
    ISBN (Print)978-1-4244-3487-9
    Publication statusPublished - 1 Jun 2009
    Event11th IFIP/IEEE International Symposium on Integrated Network Management, IM 2009: Making Management Scalable, Robust, Cost-Effective and Revenue-Generating - Hofstra University, Long Island, United States
    Duration: 1 Jun 20095 Jun 2009
    Conference number: 11

    Publication series

    PublisherIEEE Computer Society Press


    Conference11th IFIP/IEEE International Symposium on Integrated Network Management, IM 2009
    Abbreviated titleIM 2009
    Country/TerritoryUnited States
    CityLong Island


    • EWI-15393
    • METIS-263864
    • IR-65501

    Cite this