Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
Building a Better NetFlow: Technical Report
C. Estan, K. Keys, D. Moore, and G. Varghese, "Building a Better NetFlow: Technical Report", Tech. rep., Cooperative Association for Internet Data Analysis (CAIDA), Jun 2004.

This is an extended version of a paper presented at SIGCOMM'04, Aug. 30-Sept. 3, 2004, Portland, Oregon, USA. Copyright 2004 ACM 1-58113-862-8/04/0008.

|   View full paper:    PDF    gzipped postscript    |  Citation:    BibTeX   |

Building a Better NetFlow: Technical Report

Cristian Estan2
Ken Keys1
David Moore1, 2
George Varghese2

CAIDA, San Diego Supercomputer Center, University of California San Diego


Department of Computer Science and Engineering,
University of California, San Diego

Network operators need to determine the composition of the traffic mix on links when looking for dominant applications, users, or estimating traffic matrices. Cisco's NetFlow has evolved into a solution that satisfies this need by reporting flow records that summarize a sample of the traffic traversing the link. But sampled NetFlow has shortcomings that hinder the collection and analysis of traffic data. First, during flooding attacks router memory and network bandwidth consumed by flow records can increase beyond what is available; second, selecting the right static sampling rate is difficult because no single rate gives the right tradeoff of memory use versus accuracy for all traffic mixes; third, the heuristics routers use to decide when a flow is reported are a poor match to most applications that work with time bins; finally, it is impossible to estimate without bias the number of active flows for aggregates with non-TCP traffic.

In this paper we propose Adaptive NetFlow, deployable through an update to router software, which addresses many shortcomings of NetFlow by dynamically adapting the sampling rate to achieve robustness without sacrificing accuracy. To enable counting of non-TCP flows, we propose an optional Flow Counting Extension that requires augmenting existing hardware at routers. Both our proposed solutions readily provide descriptions of the traffic of progressively smaller sizes. Transmitting these at progressively higher levels of reliability allows graceful degradation of the accuracy of traffic reports in response to network congestion on the reporting path.

Note: This technical report contains additional proofs of lemmas and more detailed measurement results.

Keywords: measurement methodology, software/tools
  Last Modified: Tue Jul-28-2020 14:29:54 UTC
  Page URL: