Peeling Away Timing Error in NetFlow Data

12 years 2 months ago
Peeling Away Timing Error in NetFlow Data
In this paper, we characterize, quantify, and correct timing errors introduced into network flow data by collection and export via Cisco NetFlow version 9. We find that while some of these sources of error (clock skew, export delay) are generally implementation-dependent and known in the literature, there is an additional cyclic error of up to one second that is inherent to the design of the export protocol. We present a method for correcting this cyclic error in the presence of clock skew and export delay. In an evaluation using traffic with known timing collected from a national-scale network, we show that this method can successfully correct the cyclic error. However, there can also be other implementation-specific errors for which insufficient information remains for correction. On the routers we have deployed in our network, this limits the accuracy to about 70ms, reinforcing the point that implementation matters when conducting research on network measurement data.
Brian Trammell, Bernhard Tellenbach, Dominik Schat
Added 16 Sep 2011
Updated 16 Sep 2011
Type Journal
Year 2011
Where PAM
Authors Brian Trammell, Bernhard Tellenbach, Dominik Schatzmann, Martin Burkhart
Comments (0)