Network Flow Monitoring

Network flow data describes the basic attributes of IP “conversations” (flows) which have been observed on the network. Flow data for JANET is generated by the network's external peering routers, and has a range of purposes including helping to engineer the network for optimum performance and detecting attacks and anomalous traffic behaviour.

There are however, significant limitations on using network flow data. On a network of JANET's size there are technical limitations due to the sheer number of flows present (> 60,000). There are also legal limitations in the form of the RIP (Regulation of Investigatory Powers) and Data Protection Acts.

JANET's current network flow data architecture is build upon Flow-tools and Crannog's Netflow Tracker. In 2008 JANET(UK) will launch a procurement for a new network flow monitoring solution. One area which JANET(UK) wish to address is analysis of the most common protocols and traffic types. More can be said, once the capabilities of the chosen solution are known - both in terms of the feature set and the number of simultaneous flows that can be processed.

For further information please contact Mark Leese.