Observations on Cisco sampled NetFlow
Observations on Cisco sampled NetFlow
复制标题
对 Cisco NetFlow 样本的观察
DOI：
--
复制
发表时间：
2005
期刊：
影响因子：
--
通讯作者：
S. Bhattacharyya
中科院分区：
文献类型：
--
作者：
Baek;S. Bhattacharyya
流量监测是网络管理和流量工程的重要第一步。随着高速互联网骨干链路，高效和有效的数据包采样不仅是可取的，而且越来越成为一种必要。采样NetFlow [10]是Cisco路由器的流量测量功能，具有用于高速链路的静态数据包采样。由于抽样的效用取决于测量的准确性和经济性，因此了解抽样误差和测量开销非常重要。在本文中，我们首先讨论了采样NetFlow中使用的采样技术的基本局限性。我们通过将其输出与来自运行路由器的完整数据包跟踪[8]进行比较来评估采样NetFlow的准确性。我们还显示了采样NetFlow中涉及的开销。我们发现，采样NetFlow在我们的实验过程中没有产生显着的开销正确执行。但是，在使用它时应该小心，因为开销与流记录的数量成线性比例。
Traffic monitoring is an important first step for network management and traffic engineering. With high-speed Internet backbone links, efficient and effective packet sampling is not only desirable, but also increasingly becoming a necessity. The Sampled NetFlow [10] is Cisco router's traffic measurement functionality with static packet sampling for high speed links. Since the utility of sampling depends on the accuracy and economy of measurement, it is important to understand sampling error and measurement overhead. In this paper, we first discuss fundamental limitations of sampling techniques used in the Sampled NetFlow. We assess the accuracy of the Sampled NetFlow by comparing its output with complete packet traces [8] from an operational router. We also show the overheads involved in the Sampled NetFlow. We find that Sampled NetFlow performs correctly without incurring dramatic overhead during our experiments. However, a care should be taken in its use, since the overhead is linearly proportional to the number of flow records.