The NetSA Aggregated Flow Tool Suite

Abstract

We present a new suite of tools – NAF (for NetSA Aggregated Flow) – that accepts network flow data in multiple different formats and flexibly processes it into time-series aggregates represented in an IPFIX-based data format. NAF also supports both unidirectional and bidirectional flow data by matching uniflows into biflows where sufficient information is available. These tools are designed for generic aggregation of flow data with a focus on security applications. They can be used to reduce flow data for long-term storage, summarize it as the first step in numerical analysis, or as a back-end to flow data visualization processes.

Publication
In Proceedings of the 20th USENIX Large Installation System Administration Conference, Washington, November 2006