FloMA: Pointers and Related Projects

FloMA: Related Projects

Outside TF-TANT, there are several projects using flow-based accounting for purposes such as accounting or traffic planning. This list contains pointers to a few of them. If you know of other projects in this area, or additional information about those listed here, please send me mail. Thanks!

Abilene usage reports
Measurements focused on trends in the throughput of bulk TCP connections, based on sampled NetFlow accounting on Abilene's core routers. See the pointer to the corresponding paper in the references section for documentation.
CESNET

A comprehensive accounting system and statistics system which provides a nice Web-based user interface to NetFlow data, but also integrating data from other sources such as SNMP interface counters or IP accounting. See the pointer to the corresponding PAM 2001 paper in the references section for documentation.

SWITCH: Fluxoscope

Lisp-based system that implements a different approach to aggregating NetFlow accounting data. It is used by SWITCH for volume-based charging for the use of the transatlantic line (similar to JANET) as well as for monitoring and traffic analysis.

JANET Traffic Accounting

Information and statistics collected by JANET. Data are currently used for volume-based charging on JANET's US connection.

One of its distinguishing features is the Transatlantic Itemisation Service, an optional for-fee service that allows an organization to receive detailed accounting data according to a list of (site-internal) network prefixes that the organization can submit to JANET.

DANTE's Purgatorio

NetFlow-based traffic statistics for the TEN-155 backbone for European research networking. A sub-application of this is the ``Floodlog'' system for detection of Denial-of-Service attacks.

Compared with other approaches at detecting DoS/intrusions, this is somewhat special because it must work in places of very high aggregation (enormous numbers of flows).

GRNET Accounting Graphs

Produced using FlowScan. They generate MTRG-like graphs of traffic between GRNET on the one side and the US and EU on the other.

Usage-Pattern-Adaptive Rate Limiting at McLeodUSA's ``Flexabit'' and UIUC's residence hall networks
Presentation on a scheme to enforce rate limits in a way that doesn't hurt ``reasonable'' users. Per-host traffic history is extracted from NetFlow data (using a custom C++ program) and stored in a MySQL database. Users that generate excessive traffic are then rate-limited using CAR.
TransPAC Measurement Update
Slides from the Spring 2000 Internet2 meeting. The TransPAC Flow Analysis Tool uses tools such as cflowd, Cflow.pm, and RRDtool to plot traffig over intercontinental links according to known applications.
SLAC Traffic Characterization
Work by Connie Logg, Les Cottrell and Manish Bhargava on the traffic mix of SLAC's external connections. They used Cisco NetFlow Collector (NFC) to collect flow data, applied post-processing methods of their own and provide detailed analysis of the results.