Check out the new USENIX Web site.
USENIX, The Advanced Computing Systems Association

LISA '06 Abstract

Pp. 221231 of the Proceedings

NAF: The NetSA Aggregated Flow Tool Suite

Brian Trammell, CERT/NetSA, Carnegie Mellon University; Carrie Gates, CA Labs

Abstract

In this paper we present a new suite of tools - NAF (for NetSA Aggregated Flow) - that accepts network flow data in multiple different formats and flexibly processes it into time-series aggregates represented in an IPFIX-based data format. NAF also supports both unidirectional and bidirectional flow data by matching uniflows into biflows where sufficient information is available. These tools are designed for generic aggregation of flow data with a focus on security applications. They can be used to reduce flow data for long-term storage, summarize it as the first step in numerical analysis, or as a back-end to flow data visualization processes.
  • View the full text of this paper in HTML and PDF. Listen to the presentation and Q & A in MP3 format.
    Click here if you have forgotten your password Until December 2007, you will need your USENIX membership identification in order to access the full papers. The Proceedings are published as a collective work, 2006 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
To become a USENIX member, please see our Membership Information.

Last changed: 19 April 2007 ac