|
LISA 2000 Abstract
FlowScan: A Network Traffic Flow Reporting and Visualization Tool
Dave Plonka, University of Wisconsin. Madison
Abstract
Internet traffic flow profiling has become a useful technique in
the passive measurement and analysis field. The prerequisites for
flow-based measurements are now available within the network
infrastructure - particularly, in popular Cisco network devices. The
integration of this feature has enabled the ``flow'' concept to become
a valuable tool for the network administrator, as it had been in the
past for the researcher.
This paper describes FlowScan, a software package for open systems
that is freely available under the terms of the GNU General Public
License. FlowScan analyzes and reports on flow data exported by
Internet Protocol routers. It is an assemblage of perl scripts and
modules and is the glue that binds together other freely available
components such as a flow collection engine, a high performance
database, and a visualization tool. Once assembled, the FlowScan
system produces graph images, suitable for use in web pages. These
provide a continuous, near real-time view of the network traffic
through a network's border.
Although there are now a number of tools available that collect
and process flow data, there is a dearth of visualization tools. By
utilizing freely available software tools, FlowScan can be readily
deployed in most modern educational institution, corporate, and ISP
networks. The information presented by FlowScan assists in
understanding the nature of the traffic that your network is carrying.
It can be useful in the identification and investigation of anomalies
such as poor performance and attacks on hosts. It can provide a
foundation on which to develop usage-based billing or to verify the
effectiveness of Quality-of-Service policies. By understanding the
flows of traffic carried by the network, your institution should be
able to make informed network management and bandwidth provisioning
decisions.
|
Need help? Use our Contacts page.
