|
LISA 2000 Abstract
Combining Cisco NetFlow Exports with Relational Database Technology for Usage
Statistics, Intrusion Detection, and Network Forensics
Bill Nickless, John-Paul Navarro, and Linda Winkler, Argonne National
Laboratory
Abstract
Argonne National Laboratory operates a complex internal network
with a large number of external network peerings. A requirement of
this network is that it be monitored with minimal impact on traffic.
Cisco NetFlow technology provides the information necessary to monitor
such a network, but the data from NetFlow must be captured and
analyzed. We present a system that uses a high-powered relational
database to manage the data. Our primary motivations in building this
system were to learn whether or not database technology was an
appropriate tool for this situation and to understand what types of
questions about the network could be answered with such a system.
This work was supported by the Mathematical, Information, and
Computational Sciences Division subprogram of the Office of Advanced
Scientific Computing Research, U.S. Department of Energy, under
Contract W-31-109-Eng-38.
|
Need help? Use our Contacts page.
