Flow Analysis System for Multi-Layer Service Networks

Our academic backbone network, SINET4, provides a variety of network services, such as multi-layer, VPN, and BoD services, over a single network platform. Network traffic analysis is therefore very important for network design, QoS control, and stable network operation. This traffic analysis needs traffic volume information about each IP router interface as well as network flow information such as IP addresses, packet and byte counts, time-stamps, ToS, and application ports. If we increase the flow sampling rate of IP routers to enable a fine flow analysis, the forwarding performance of IP routers can easily decrease. We therefore decided to use special hardware engines dedicated to our IP routers in order to collect a large volume of flow information without degrading forwarding performance and flexibly change sampling parameters such as the flow sampling rates depending on the analysis requirements. This paper describes the flow analysis system for the multi-layer service networks which use special hardware engines, Netflow, and NETCONF. It also shows the initial experimental results and proposes methods for improving the analysis. By using our system, we can analyze several network utilization patterns such as intercommunication patterns between finely specified locations and nationwide application utilization patterns.