RFC 2123 (rfc2123) - Page 2 of 34

Traffic Flow Measurement: Experiences with NeTraMet

RFC 2123                Traffic Flow Measurement              March 1997


 4 Flow data files                                                    26
   4.1 Sample flow data file  . . . . . . . . . . . . . . . . . . . . 27
   4.2 Flow data file features  . . . . . . . . . . . . . . . . . . . 28
   4.3 Terminating and restarting meter reading . . . . . . . . . . . 29
 5 Analysis applications                                              30
 6 Using NeTraMet in a measurement system                             31
   6.1 Examples of NeTraMet in production use . . . . . . . . . . . . 31
 7 Acknowledgments                                                    33
 8 References                                                         33
 9 Security Considerations                                            34
10 Author's Address                                                   34

1 Introduction

   Early in 1992 my University needed to develop a system for recovering
   the costs of its Internet traffic.  In March of that year I attended
   the Internet Accounting Working Group's session at the San Diego
   IETF, where I was delighted to find that the Group had produced a
   detailed architecture for measuring network traffic and were waiting
   for someone to try implementing it.

   During 1992 I produced a prototype measurement system, using balanced
   binary trees to store information about traffic flows.  This work was
   reported at the Washington IETF in November 1992.  The prototype
   performed well, but it made no attempt to recover memory from old
   flows, and the overheads in managing the balanced trees proved to be
   unacceptably high.  I moved on to develop a production-quality
   system, this time using hash tables to index the flow information.

   This version was called NeTraMet (the Network Traffic Meter), and was
   released as free software in October 1993.  Since then I have
   continued working on NeTraMet, producing new releases two or three
   times each year.  NeTraMet is now in production use at many sites
   around the world.  It is difficult to estimate the number of sites,
   but there is an active NeTraMet mailing list, which had about 130
   subscribers in March 1996.

   Early in 1996 the Realtime Traffic Flow Measurement Working Group
   (RTFM) was chartered to move the Traffic Flow Measurement
   Architecture on to the IETF standards track.  This document records
   traffic flow measurement experience gained through three years
   experience with NeTraMet.









Brownlee                     Informational