|
LISA 2000 Abstract
The OSU Flow-tools Package and CISCO NetFlow Logs
Steve Romig, Mark Fullmer, and Ron Luman, The Ohio State University
Abstract
Many Cisco routers and switches support NetFlow services which
provides a detailed source of data about network traffic. The Office
of Information Technology Enterprise Networking Services group
(OIT/ENS) at The Ohio State University (OSU) has written a suite of
tools called flow-tools to record, filter, print and analyze flow logs
derived from exports of NetFlow accounting records. We use the flow
logs for general network planning, performance monitoring, usage based
billing, and many security related tasks including incident response
and intrusion detection. This paper describes what the flow logs
contain, the tools we have written to store and process these logs,
and discusses how we have used the logs and the tools to perform
network management and security functions at OSU. We also discuss some
related projects and our future plans at the end of the paper.
|
Need help? Use our Contacts page.
