Re: NetFlow

[Warren Matthews <]

On Fri, 30 Nov 2001, Keith Godber wrote:

> At Ripe 40 in Prague the subject of NetFlow came up - and if this was a
> subject that the TT working group should look at.
>
> For my part I would say the answer is "Yes."  This is traffic
> measurement and produces useful real world data.

We analyse netflow data and I agree it has its uses. I look at the graphs
from time-to-time to see changes in traffic patterns. I'm told our
cyber-security use it too. Other people use it to look for changes
indicative of a problem somewhere in the WAN that is disrupting traffic.

I did a quick survey and there are 2 features that we'd like to see
improved:

1/ better handling of fragmented packets
2/ better timestamping (to give time-in-flight data)

What would  the TT working group look at ? Are you thinking of building
netflow analysis tools into our RIPE box ?

--------------------------------------------------------------------------
Dr. Warren Matthews                   If ease of use was the highest goal,
Principal Network Specialist               we'd all be driving golf carts.
Stanford Linear Accelerator Center.                          - Larry Wall.

On Fri, 30 Nov 2001, Keith Godber wrote:

> At Ripe 40 in Prague the subject of NetFlow came up - and if this was a
> subject that the TT working group should look at.
>
> For my part I would say the answer is "Yes."  This is traffic measurement
> and produces useful real world data.
>
> There's two reason's for me sending this posting:
>
> a)	Would anyone be willing to make a presentation at Ripe 41 regarding
> use of NetFlow?
>
> Maybe you have a couple of years of data and want to show us some trends,
> some abnormalities.
> Maybe you have linked NetFlow data with routing data and have a tool to
> predict the flow of traffic should a certain peer and peering point fail.
> etc...
>
> b)	Get a thread running.
>
> Tell the world about your NetFlow woes.
> That NetFlow is the font of all knowledge in your organisation.
> That you tried it, and didn't like it.
>
>
> There's some ideas.  Over to you...
>
>
>
> Keith
>