Inferring Client Experience From Flow-based Measurements

M ODERN IP routers have flow export features which are typically used for traffic measurement, accounting, and billing purposes. One such flow export technology is Cisco’s NetFlow [1]. These features transmit timestamped IP flow information in a timely fashion from the routers to collection stations. The timestamps indicate the time at which each flow’s initial and final packet was forwarded. Although NetFlow’s timestamps have millisecond granularity, they have usually been considered to be mere accounting data and have not generally been utilized by collection software to calculate the data transfer rates of individual IP flows. In this extended abstract we investigate the efficacy of IP flow rate analysis to summarize the data transfer rates experienced by individual TCP application data streams. We use the flow start and end timestamps to estimate the flow’s duration and, in turn, compute the average data transfer rate. We then plot these flow rates in a time series to determine whether or not such visualization exposes important characteristics of Internet traffic flows as they cross a network’s border. If it does, such analysis may have significant operational use, perhaps aiding in the detection of network problems and determining whether or not Quality-ofService agreements are being satisfied. Our past experience with flow-based passive measurement in production networks has shown it to be a practical methodology capable of being operated continuously and analyzed in near real-time [2]. We hope to determine whether the addition of flow rate analysis provides useful, qualitative information regarding the delivery of IP-based services to various classes of clients.