Check out the new USENIX Web site.

Home About USENIX Events Membership Publications Students
LISA 2000 Abstract

The OSU Flow-tools Package and CISCO NetFlow Logs

Steve Romig, Mark Fullmer, and Ron Luman, The Ohio State University

Abstract

Many Cisco routers and switches support NetFlow services which provides a detailed source of data about network traffic. The Office of Information Technology Enterprise Networking Services group (OIT/ENS) at The Ohio State University (OSU) has written a suite of tools called flow-tools to record, filter, print and analyze flow logs derived from exports of NetFlow accounting records. We use the flow logs for general network planning, performance monitoring, usage based billing, and many security related tasks including incident response and intrusion detection. This paper describes what the flow logs contain, the tools we have written to store and process these logs, and discusses how we have used the logs and the tools to perform network management and security functions at OSU. We also discuss some related projects and our future plans at the end of the paper.

?Need help? Use our Contacts page.

Last changed: 16 Jan. 2002 ml
Technical Program
LISA 2000 Home
USENIX home