An Accurate and Efficient 3-Phase Measurement Method for IP Traffic Flow on High Speed Link

Flow metrics are critical for protocol research, anomaly detection, network operation and application deployment. There are great challenges to match every packet into millions of flows in high speed network link. A 3-phase measurement method for IP traffic flow is proposed in this paper. The packets are captured and classified into the flows through hash table, search tree and linear table with this approach. The traffic measurement systems in general purpose CPU platform and network processor platform with this method have been implemented and deployed in backbone links. The experiment on OC-48 backbone shows the average length search path for each packet is 7.7. Average process times of mapping successfully and unsuccessfully are about 1.3 mus and 1.8 mus respectively at the length of search path 350. Traffic matrix, host behavior and other metrics can been easily deduced with our approach.