Flow - Based Traffic Analysis at Switch

Flow-Based Tra c Analysis at SWITCH Simon Leinen Abstract|SWITCH has been using locally developed software for ow-based network tra c analysis for more than three years. Its applications include: volume-based charging for \transatlantic" tra c, capacity planning using perapplication and per-peer statistics, and the detection of anomalies such as unwanted routing asymmetries and various types of network abuse. We outline the design of our software and point out some of its unique characteristics. Keywords| Internet, passive measurement, ow-based tra c analysis, NetFlow I. Background SWITCH is a non-pro t foundation that provides telecommunication services to universities and other research institutions in Switzerland. During many years, our charging system for Internet access was based mostly on tra c volume. We counted tra c at the egress interface from SWITCH to each university (sending tra c out was free because we wanted to encourage sharing of information by the universities) using SNMP[1], and based our billing on those numbers. While this simple volume-based charging scheme encouraged responsible use of the network, we found that it had some drawbacks. In particular, \on-net" tra c between di erent universities was unduly penalized, and certain kinds of new services, notably multicast, could not be introduced because of cost concerns on the part of the universities. So in 1997, we decided to introduce a new charging scheme, where the volume-based part of the charges would be based only on tra c that uses our transatlantic connection. Under the new scheme, it became necessary to account transatlantic tra c separately for each university. We decided to use the then-new NetFlow[2] mechanism on our Cisco routers to generate the necessary accounting data, which would then be converted into aggregated trafc gures for billing. The minimum requirements were a monthly table stating the utilization of the transatlantic connection separately for each organization. Additional desired functionality included near-real-time statistics and useful visualization tools for SWITCH's NOC and site sta . II. Fluxoscope Design At the start of this project, the c owd system[3] was| to our knowledge|the only available tool for processing NetFlow accounting data. However, we found that its aggregation methods couldn't easily be adapted to our needs. So we decided to write our own programs to analyze the NetFlow accounting streams. The resulting \Fluxoscope" system consists of the following components: Simon Leinen works as a network engineer for SWITCH in Zurich, Switzerland. E-mail: [email protected]. SWITCH to US peers