Flow-Based Traffic Analysis at SWITCH

Simon Leinen

SWITCH

For more than three years, SWITCH has been using a locally developed software package called "Fluxoscope" to perform volume-based billing and traffic analysis tasks on traffic over our external (peering/transit) connections. The system processes microflow-based accounting data generated by our external border routers in Cisco NetFlow(TM) format. While the main goal of this effort was to generate bills based on member organizations' (universities') respective utilization of our transatlantic connection, we also hoped to get valuable insight about the nature of the traffic that our network transports, so the system was designed to be easily extensible in order to allow for experimentation. It has successfully been applied to other areas such as: Capacity and interconnection planning using detailed long-term statistics, and the detection of anomalies such as unwanted routing asymmetries and various types of network abuse.

We outline the design of our software and point out some of its distinguishing features, which include: (1) versatile aggregation and analysis in real time; (2) multi-dimensional aggregated traffic matrices allowing "drill down" data exploration, (3) sensible handling of microflows' start and end times, (4) an integrated SNMP agent for monitoring the system; (5) distribution of "raw" NetFlow accounting data to individual customers for local cross-checking and detailed analysis.

The strategy and the tools used in the implementation of Fluxoscope are presented, in particular how the choice of a development and execution environment with garbage collection, arbitrary-precision integer arithmetics and late binding has helped the creation and evolution of the system.

We also look at the performance of the system under real-life conditions, and explain how scalability issues are addressed through parallel distributed operation. Some design decisions for Fluxoscope are compared with other systems such as cflowd [cflowd], FlowScan [flowscan], or JANET's Transatlantic Billing Service [janet].

The flow-processing and aggregation component requires some configuration describing the external and internal topology of the network under consideration. We show two configuration examples, one for a "stub" network with customer networks in the same AS as the backbone, and one for a network whose customer networks are EBGP neighbors.

Several graphical and textual representations of the collected traffic statistics are presented, as well as an example of how the system can be used to get to the bottom of anomalies such as denial-of-service attacks launched from compromised systems within a university.

Router-based per-microflow traffic accounting seems to hit a "sweet spot" with respect to trade-offs of router and analysis performance, data reduction, and range of applications. For situations where full microflow-based accounting isn't deemed possible due to performance limitations, we evaluate alternative methods such as router-based aggregation, accounting based on traffic sampling, separate measurement devices, and policy-based accounting techniques, with respect to their scalability and their applicability to different tasks.