Experiences with IPFIX-based Traffic Measurement for IPv6 Networks
نویسندگان
چکیده
Though the popular Cisco NetFlow is widely used for flow-level traffic measurement in IPv4 networks, it is not suitable for IPv6 networks because of the fixed flow structure that cannot carry IPv6-related information. Therefore, the IETF IP Flow Information eXport (IPFIX) standard that employs the flexible flow template structure has been recently proposed to support various flow-level traffic monitoring applications for next-generation Internet such as QoS monitoring, anomaly detection, and IPv6 traffic measurement. Yet, realistic traffic measurement methods with IPFIX have not been much studied. IPv6 traffic analysis has been possible with IPFIX, but it has to be investigated in detail. Especially, traffic measurement in IPv6 networks meets new challenges because ICMPv6 messages, IPv6 extension headers, and mobile IPv6 packets are commonly used for many IPv6-specific features. Hence, this paper presents traffic monitoring experiences in IPv6/mobile IPv6 (MIPV6) networks with IPFIX by proposing new flow templates that have been extended to observe various kinds of IPv6 traffic. From our experiments, it was shown that IPFIX-based IPv6 traffic measurement scheme is useful for anomaly IPv6 traffic detection and MIPv6 handover analysis. For instance, IPv6 anomaly traffic exploiting ICMPv6 messages and covert channels could be easily detcted with our templates. In addition, the MIPv6 traffic measurement methodoloy with IPFIX have been verified to estimate the user-experienced handover latency.
منابع مشابه
Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX (Short Paper)
IPv6 is being deployed but many Internet Service Providers have not implemented its support yet. Most of the end users have IPv6 ready computers but their network doesn’t support native IPv6 connection so they are forced to use transition mechanisms which transports IPv6 packets through IPv4 network. Unfortunately deployment of IPv6 is slow and at this rate, completion of the migration from IPv...
متن کاملFlow-Based Detection of IPv6-specific Network Layer Attacks
With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be possible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using...
متن کاملFlow-Based Measurement: IPFIX Development and Deployment
This paper presents a history of the IPFIX working group, from initial chartering through development and testing, re-chartering and further development, and looking ahead to future developments. As a standardised way of exporting information about traffic flows, IPFIX has attracted a growing number of implementors, who have continued to develop it in useful ways without changing its underlying...
متن کاملIP Multicast Traffic Measurement Method with IPFIX/PSAMP
This paper presents a method of measuring traffic of IP multicast streaming, such as IPTV, by using IPFIX/PSAMP. An IP multicast streaming service has recently become one of the popular network services. Yet, the method of IP multicast operation has not been established. In particular, traffic measurement of IP multicast streaming encounters two big challenges, such as monitoring a multicast pa...
متن کاملSFM3: A Service-based Flow Traffic Measurement Management Model for IP Networks
It is a great challenge to analyze all the data obtained from the variety of measurement tools existing today. This task is even more complicated when we need to extract useful information for managing networks belonging to different domains due to systems and equipment heterogeneity. This is also true with traffic flow measurement data. Although much effort has been placed in its standardizati...
متن کامل