trace2flow karol adamski, maciej korczyński, lucjan janowski, krzysztof rusek 3rd nmrg workshop on...
TRANSCRIPT
![Page 1: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/1.jpg)
Trace2Flow
Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek
3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010, Maastricht
![Page 2: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/2.jpg)
Motivation
I am a member of the COST TMA Action IC0703
(see www.tma-portal.eu)
Look, I have a nice algorithm
Does it work for IPFIX?
I do not know …
![Page 3: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/3.jpg)
Solution
• We should have a tool to generate a IPFIX trace from packet trace and use both of them …
• … so that anyone can compare both packet and IPFIX algorithms
• The conversion should be easy and flexible• It should work for many operating systems• We have TracesPlay
(http://tracesplay.sourceforge.net/ ) – a tool reading packet traces which work for
different operating systems
![Page 4: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/4.jpg)
Nice To Have
• Direct MATLAB connection• Support for lots of different protocols• Support for numerous IPFIX fields• It should be easy to add a custom
statistics not necessarily IPFIX one• On-line generating – artificial IPFIX node
![Page 5: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/5.jpg)
Whole system
Binary Data
Reading and
Analyzis
Statistics Generator
Data Providing
CSV
MATLAB
Extend Software
5
Formats: PCap, ERF, TSH, FR, FR+, SNOOPv2On-line with lib PCAPFrom a buffer
ETH, 802.1q, 802.11, ICMPv4, IPv4, TCP, UDP, RTP, H264, NetFlow v1,5,7,8,9.........................
IPFIX ,Different samplig methods
![Page 6: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/6.jpg)
Trace2flow Options
• -IPFIX <value> the flow definition• –c the first column of CVS file contains the
column name• -e show error• –r <file name> list of the traces to
analyze • –o <fields name> list of the IPFIX fields• –s <sampling methods> OneToOne,
OneToN <value>, RandomFromN <value>, FirstFromTimeIntercal <value>
• –w <file name> output file, out.txt by default
![Page 7: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/7.jpg)
Supported fields
Field Name Description
IPFIX.inByte Number of bytes
IPFIX.inPkts Number of packets
IPFIX.IP.src Source IP address
IPFIX.IP.dst Destination IP address
IPFIX.MinTTL Minimum TTL value
IPFIX.MaxTTL Maximum TTL value
IPFIX.MinPktLength Minimum packet length
IPFIX.MaxPktLength Maximum packet length
![Page 8: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/8.jpg)
Examples
trace2flow.exe -e -s OneToOne –IPFIX 1 -r test.pcap -o IPFIX.inPkts IPFIX.inBytes IPFIX.MinTTL -w out_OneToOne.txt
trace2flow.exe -s OneToN 25 –IPFIX 3 -r test.pcap -o IPFIX.IP.src IPFIX.inBytes IPFIX.MaxTTL –c -w out_OneToN_3.txt
MATLAB:Data = trace2flow(-s OneToN 100 –IPFIX 1 -r
test.pcap -o IPFIX.inPkts);
![Page 9: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/9.jpg)
A Simple Example
• Packet trace captured within one of subnetworks in campus network in AGH University of Technology in Krakow:– amount of packets: 1273722– packet duration: 180.8632 s– trace size: 100MB– average throughput at the time of traffic
capturing: 3.45 Mb/s
![Page 10: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/10.jpg)
Throughput Estimation
• Two representative count-based methods were examined (as they are used in Cisco routers):
– Deteministic Sampling (every n-th packet)– Random Sampling (1-out-of-N packet)
![Page 11: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/11.jpg)
Throughput Estimation - Results
• Underestimation of the throughput for sampling rates lower than 10%
![Page 12: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/12.jpg)
Throughput Estimation - Results
• For sampling rates lower than 10% the time required for processing all packets is lower than 2s in the particular case
![Page 13: Trace2Flow Karol Adamski, Maciej Korczyński, Lucjan Janowski, Krzysztof Rusek 3rd NMRG Workshop on Netflow/IPFIX Usage in Network Management July 30, 2010,](https://reader035.vdocuments.net/reader035/viewer/2022071808/56649f015503460f94c16ce1/html5/thumbnails/13.jpg)
Where You Can Find Us
The project web page
http://tracesplay.sourceforge.net/traces2flow/index.html
The Mather project
http://tracesplay.sourceforge.net/