Abstract
Flow monitoring is a scalable technology for providing summaries of network activity. Being deployed at the IP-layer, it uses fixed flow definitions, based on fields of the IP-layer and higher layers. Since several backbone network operators are considering the deployment of (Carrier) Ethernet in their Next-Generation Network, flow monitoring should also evolve in that direction. In order to do flow monitoring at the Ethernet-layer, Ethernet header fields need to be considered in flow definitions. IPFIX provides the flexibility to change the definition of flows, incorporating information from several layers in the network (including non-IP fields). The deployment of IPFIX is still at an early stage, which means that use cases for Ethernet-layer monitoring are not well known yet. This paper provides an overview of the usability of IPFIX at the Ethernet-layer and presents several use cases in which Ethernet-layer flow monitoring provides new insights and different views on a network.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Brownlee, N.: Traffic Flow Measurement: Meter MIB. RFC 2720 (Informational) (October 1999), http://www.ietf.org/rfc/rfc2720.txt
Brownlee, N.: NeTraMet & NeMaC Reference Manual, Version 4.3 (June 1999), http://www.caida.org/tools/measurement/netramet/download/ntm43.pdf
Claise, B.: Cisco Systems NetFlow Services Export Version 9. RFC 3954 (Informational) (October 2004), http://www.ietf.org/rfc/rfc3954.txt
Claise, B.: Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information. RFC 5101 (Standards Track) (January 2008), http://www.ietf.org/rfc/rfc5101.txt
Claise: B., Johnson, A., Quittek, J.: Packet Sampling (PSAMP) Protocol Specifications. RFC 5476 (Standards Track) (March 2009), http://www.ietf.org/rfc/rfc5476.txt
Duffield, N., Lund, C., Thorup, M.: Properties and prediction of flow statistics from sampled packet streams. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurment, IMW 2002, pp. 159–171. ACM, New York (2002)
Institute of Electrical and Electronics Engineers: Part 3: Carrier sense multiple access with collision detection (CSMA/CD) access method and physical layer specifications. IEEE Standard 802.3 (December 2005)
Institute of Electrical and Electronics Engineers: Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks. IEEE Standard 802.1Q (May 2006)
Institute of Electrical and Electronics Engineers: Virtual Bridged Local Area Networks - Amendment 4: Provider Bridges. IEEE Standard 802.1ad (May 2006)
INVEA-TECH: FlowMon Probe (July 2011), http://www.invea-tech.com/products-and-services/flowmon/flowmon-probes
Leinen, S.: Evaluation of Candidate Protocols for IP Flow Information Export (IPFIX). RFC 3955 (Informational) (October 2004), http://www.ietf.org/rfc/rfc3955.txt
NfDump (July 2011), http://nfdump.sourceforge.net
Poortinga, R., van de Meent, R., Pras, A.: Analysing campus traffic using the meter-MIB. In: Proceedings of Passive and Active Measurement Workshop, pp. 192–201 (2002)
Quittek, J., Zseby, T., Claise, B., Zander, S.: Requirements for IP Flow Information Export (IPFIX). RFC 3917 (Informational) (October 2004), http://www.ietf.org/rfc/rfc3917.txt
Sadasivan: G., Brownlee, N., Claise, B., Quittek, J.: Architecture for IP Flow Information Export. RFC 5470 (Informational) (March 2009), http://www.ietf.org/rfc/rfc5470.txt
sFlow: Making the Network Visible (July 2011), http://www.sflow.org
SURFnet: GigaPort3 and SURFnet7 (July 2011), http://www.surfnet.nl/en/innovatieprograma's/gigaport3/pages/default.aspx
TCPDUMP/LIBPCAP (July 2011), http://www.tcpdump.org
The Internet Assigned Numbers Authority (IANA): Ether Types (April 2010), http://www.iana.org/assignments/ethernet-numbers
The Internet Assigned Numbers Authority (IANA): IP Flow Information Export (IPFIX) Information Elements (July 2011), http://www.iana.org/assignments/ipfix/ipfix.xml
Trammell, B., Boschi, E.: An Introduction to IP Flow Information Export (IPFIX). IEEE Communications Magazine 49(4), 89–95 (2011)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Hofstede, R., Drago, I., Sperotto, A., Pras, A. (2011). Flow Monitoring Experiences at the Ethernet-Layer. In: Lehnert, R. (eds) Energy-Aware Communications. EUNICE 2011. Lecture Notes in Computer Science, vol 6955. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-23541-2_15
Download citation
DOI: https://doi.org/10.1007/978-3-642-23541-2_15
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-23540-5
Online ISBN: 978-3-642-23541-2
eBook Packages: Computer ScienceComputer Science (R0)