The DOI matches its Crossref record; 13 of the 13 references it cites were found in a registry or an index.
Building a better NetFlow
Abstract
Network operators need to determine the composition of the traffic mix on links when looking for dominant applications, users, or estimating traffic matrices. Cisco's NetFlow has evolved into a solution that satisfies this need by reporting flow records that summarize a sample of the traffic traversing the link. But sampled NetFlow has shortcomings that hinder the collection and analysis of traffic data. First, during flooding attacks router memory and network bandwidth consumed by flow records can increase beyond what is available; second, selecting the right static sampling rate is difficult because no single rate gives the right tradeoff of memory use versus accuracy for all traffic mixes; third, the heuristics routers use to decide when a flow is reported are a poor match to most applications that work with time bins; finally, it is impossible to estimate without bias the number of active flows for aggregates with non-TCP traffic. In this
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,163
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636
Universal classes of hash functions
Carter, J. L., & Wegman, M. N. (1979) · Journal of Computer and System Sciences · doi:10.1016/0022-0000(79)90044-8 · Cited by 2,519
Receiver-driven layered multicast
McCanne, S., Jacobson, V., & Vetterli, M. (1996) · Conference proceedings on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/248156.248168 · Cited by 1,195
Network Time Protocol (Version 3) Specification, Implementation and Analysis
Mills, D. L. (1992) · doi:10.17487/rfc1305 · Cited by 851
A signal analysis of network traffic anomalies
Barford, P., Kline, J., Plonka, D., & Ron, A. (2002) · Proceedings of the second ACM SIGCOMM Workshop on Internet measurment - IMW '02 · doi:10.1145/637201.637210 · Cited by 787
Gigascope: a stream database for network applications
Cranor, C., Johnson, T., Spataschek, O., & Shkapenyuk, V. (2003) · Proceedings of the 2003 ACM SIGMOD international conference on Management of data · doi:10.1145/872757.872838 · Cited by 687
Random sampling for histogram construction
Chaudhuri, S., Motwani, R., & Narasayya, V. R. (1998) · Proceedings - ACM-SIGMOD International Conference on Management of Data · doi:10.1145/276304.276343 · Cited by 234
Estimating flow distributions from sampled flow statistics
Duffield, N., Lund, C., & Thorup, M. (2003) · Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications · doi:10.1145/863955.863992 · Cited by 226
Properties and prediction of flow statistics from sampled packet streams
Duffield, N., Lund, C., & Thorup, M. (2002) · Proceedings of the second ACM SIGCOMM Workshop on Internet measurment - IMW '02 · doi:10.1145/637201.637225 · Cited by 211
Cited by
Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX
Hofstede, R., Čeleda, P., Trammell, B., Drago, I., Sadre, R., Sperotto, A., & Pras, A. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2014.2321898 · Cited by 431
Offline/realtime traffic classification using semi-supervised learning
Erman, J., Mahanti, A., Arlitt, M., Cohen, I., & Williamson, C. (2007) · Performance Evaluation · doi:10.1016/j.peva.2007.06.014 · Cited by 287
Identifying and discriminating between web and peer-to-peer traffic in the network core
Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213
Implementation Issues of Early Application Identification
Bernaille, L., & Teixeira, R. (2007) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-76809-8_14 · Cited by 11
Metadata
- Authors
- Estan, C., Keys, K., Moore, D., & Varghese, G.
- Venue
- Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
- Publisher
- ACM
- Published
- 2004-08-30
- Pages
- 245-256
- OpenAlex
- W2169636627
- Cited by
- 351
- References
- 13
- FWCI
- 13.48
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Building a better NetFlow. https://app.cochat.ai/papers/10.1145/1015467.1015495
- The paper
- Estan, C., Keys, K., Moore, D., & Varghese, G. (2004). Building a better NetFlow. Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications. https://doi.org/10.1145/1015467.1015495
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
