Peeling Away Timing Error in NetFlow Data
Peeling Away Timing Error in NetFlow Data
复制标题
消除 NetFlow 数据中的计时错误
DOI：
--
复制
发表时间：
2011
期刊：
影响因子：
--
通讯作者：
M. Burkhart
中科院分区：
文献类型：
--
作者：
B. Trammell;B. Tellenbach;Dominik Schatzmann;M. Burkhart
在本文中，我们通过Cisco NetFlow version 9的收集和导出来描述、量化和纠正引入网络流量数据的时序误差。我们发现，虽然其中一些错误来源（时钟倾斜、导出延迟）通常是与实现相关的，并且在文献中是已知的，但导出协议的设计中存在一个额外的周期错误，最多可达一秒。我们提出了一种在存在时钟偏差和输出延迟的情况下纠正这种循环误差的方法。在使用从全国规模网络中收集的已知定时流量进行评估时，我们表明该方法可以成功地纠正循环误差。但是，也可能存在其他特定于实现的错误，这些错误仍然没有足够的信息来进行纠正。在我们在网络中部署的路由器上，这将精度限制在约70ms，这加强了在进行网络测量数据研究时实施的重要性。
In this paper, we characterize, quantify, and correct timing errors introduced into network flow data by collection and export via Cisco NetFlow version 9. We find that while some of these sources of error (clock skew, export delay) are generally implementation-dependent and known in the literature, there is an additional cyclic error of up to one second that is inherent to the design of the export protocol. We present a method for correcting this cyclic error in the presence of clock skew and export delay. In an evaluation using traffic with known timing collected from a national-scale network, we show that this method can successfully correct the cyclic error. However, there can also be other implementation-specific errors for which insufficient information remains for correction. On the routers we have deployed in our network, this limits the accuracy to about 70ms, reinforcing the point that implementation matters when conducting research on network measurement data.