This document specifies the data export format for version 9 of Cisco
Systems' NetFlow services, for use by implementations on the
network elements and/or matching collector programs. The version 9
export format uses templates to provide access to observations of IP
packet flows in a flexible and extensible manner. A template defines a
collection of fields, with corresponding descriptions of structure and
semantics. This memo provides information for the Internet community.

Providing detailed, accurate, and consistent network measurements is essential to running a service provider network, both for planning, engineering and troubleshooting the network, and for verifying that network performance meets targets that are set by the provider and agreed with its customers. The speed and scale of networks, coupled with increasing need for active and passive measurements differentiated by customer, service class, and network elements, present challenges for providers in deploying and operating the measurement infrastructure. This chapter reviews a spectrum of methods, practices, and standards for the acquisition, management, and interpretation of network measurements.

methods

Cisco Systems NetFlow Services Export Version 9

Measurements of Data Plane Reliability and Performance

Intrusion detection is a crucial area of research nowadays. Earlier methods to detect the attacks are based on content verification of every packet flowing through the network. Packet inspection is very time consuming process and increases the overhead of intrusion detection system. Therefore, the researchers discover the alternative method named flow-based intrusion detection. Instead of verifying the packet contents, the flow of packet through the network is inspected. The goal of this paper is to implement the flow based intrusion detection system as a supplementary service to the content-based intrusion detection. The paper provides the overview of the flow-based approach and shows how flow- based approach can be used to detect attacks.

background

Detecting Network Attacks Using Flow-Based Techniques

We present a novel attack on relayed instant messaging (IM) traffic that allows an attacker to infer who’s talking to whom with high accuracy. This attack only requires collection of packet header traces between users and IM servers for a short time period, where each packet in the trace goes from a user to an IM server or vice-versa. The specific goal of the attack is to accurately identify a candidate set of top-k users with whom a given user possibly talked to, while using only the information available in packet header traces (packet payloads cannot be used because they are mostly encrypted). Towards this end, we propose a wavelet-based scheme, called COmmunication Link De-anonymization (COLD), and evaluate its effectiveness using a real-world Yahoo! Messenger data set. The results of our experiments show that COLD achieves a hit rate of more than 90% for a candidate set size of 10. For slightly larger candidate set size of 20, COLD achieves almost 100% hit rate. In contrast, a baseline method using time series correlation could only achieve less than 5% hit rate for similar candidate set sizes.

Cisco Systems NetFlow Services Export Version 9

Citations

Measurements of Data Plane Reliability and Performance

Detecting Network Attacks Using Flow-Based Techniques

Breaching Privacy in Encrypted Instant Messaging Networks

Related Papers (5)

OpenFlow: enabling innovation in campus networks

Mining anomalies using traffic feature distributions

Simple Network Management Protocol (SNMP)

An improved data stream summary: the count-min sketch and its applications

Diagnosing network-wide traffic anomalies