Joint EMANICS/IRTF-NMRG Workshop on
Netflow/IPFIX Usage in Network Management

October 30, 2008
LRZ Munich, Germany

Last Update: November 5th, 2008

The workshop is over

This page will not be updated anymore. The latest information on the workshop, including the slides of the presentations, can be found here. The workshop minutes can be found here.

Scope

The goal of the workshop is to exchange and discuss experiences and ideas in the usage of Netflow/IPFIX in network management.

Flow-based approaches are used in various areas of network management today, such as accounting, dependency discovery, and intrusion detection. The workshop will address these and other areas, as well as related activities such as flow collection and storage, querying, etc.

Workshop program

We want the workshop to be an opportunity for people to exchange and discuss their experiences and ideas. To structure the discussions the workshop will be organized into several discussion topics. For each discussion topic, there will be short presentations (10-15 minutes) highlighting different aspects of the topic, followed by a discussion round.

9:00-9:30 Registration
9:30-10:15 Keynote
Benoit Claise, Cisco
10:15-10:30 Coffee break
10:30-12:15 Topic: What technologies are available to analyze flow data?
Presentation: Flow record query languages (Vladislav Marinov, JUB)
Presentation: Using SQL databases for flow processing (Anna Sperotto, UT)
Presentation: A distributed architecture for IP flow analysis (Cristian Morariu, UZH)
Presentation: 10G netflow monitoring (Luca Deri)
Discussions
12:15-13:15 Lunch break
13:15-14:45 Topic: How do sampling and aggregation affect the volume and accuracy of data collection and analysis?
Presentation: Open issues of hierarchical flow aggregation (Christoph Sommer, UniErlangen)
Presentation: Flow-based TCP Connection State Detection (Tobias Limmer, UniErlangen)
Presentation: Self-management of optical networks - can we trust NetFlow data? (Tiago Fioreze, UT)
Discussions
14:45-15:00 Coffee break
15:00-16:30 Topic: For what kind of applications can Netflow/IPFIX be used?
Presentation: Using IPFIX/PSAMP for anomaly detection (Tanja Zseby, FOKUS)
Presentation: Application level dependency discovery with flows (Olivier Festor, INRIA)
Presentation: IPFIX for VoIP monitoring (Sven Anderson, NECLAB)
Discussions
16:30-17:15 Topic: Should we have a standard format for the annotation of Netflow/IPFIX traces?
Discussions
17:15 Workshop close

Venue and travel information

The conference will take place at

 in the seminar room 1.

A list of hotels in Garching can be found here (ASCII file). But it is also possible to stay near the station in Munich and take the underground to the LRZ (approx. 30 minutes, see How to get to the LRZ).

Registration

The workshop is open to the public but the number of participants is limited. We kindly ask to register for this workshop (registration is free). Deadline for registration: October 15, 2008.

Chair

Participants