NetFlow 是網路設備輸出流量資訊的協定，為一廣泛受到支援的業界標準，本研究以NetFlow 資料為基礎，針對大型網路進行研究。第一部份是改進流量分析軟體Flow-tools，使其可以在合理的時間及資源內處理現在及未來龐大的流量資料。第二部份以台灣學術網路為例，分析使用者行為和異常流量，可做為容量規劃、互連協議、使用政策、網路安全，制定時重要的參考。

NetFlow is a de facto protocol to export information about IP flow from network device. In this paper, we describe the modification to the famous open source software Flow-tools which let it has the ability to process the large NetFlow data under reasonable time and resource in the first
part. In second part, we propose a series network usage and anomalies analysis methods, using TANet as example. These analyses are useful for capacity planning, peering, security, usage policy enacting.

中文摘要..........2
英文摘要..........3
目錄..................4
圖表目錄..........5
1. 緒論..........6
1.1. 研究動機..................................................................................................................6
1.2. NetFlow定義...........................................................................................................7
1.3. NetFlow資料來源...................................................................................................8
1.4. 相關研究..................................................................................................................8
2. 對flow-tools 的改進.............................................................................................................13
2.1. 簡介........................................................................................................................13
2.2. 動機........................................................................................................................15
2.3. 瓶頸分析................................................................................................................16
2.3.1. 資料結構........................................................................................................16
2.3.2. Profiling .........................................................................................................16
2.4. 使用較多的Bucket ...............................................................................................16
2.5. 使用不同的Hash Function ...................................................................................20
2.6. 以Judy Array 取代第二層Hash...........................................................................21
3. 網路應用分析........................................................................................................................23
3.1. 動機........................................................................................................................23
3.2. FTP 協定分析........................................................................................................23
3.3. eDonkey 協定分析................................................................................................25
3.4. BitTorrent 協定分析..............................................................................................26
3.5. Heuristic 演算法....................................................................................................27
3.5.1. 判定依據........................................................................................................27
3.5.2. 驗證方法........................................................................................................
- 4 -
3.5.3. Pseudo Code...................................................................................................28
3.6. 結果比較................................................................................................................29
4. 結論與未來方向....................................................................................................................30
5. 參考文獻32

Barford, P. and D. Plonka (2001). Characteristics of network traffic flow anomalies. ACM
SIGCOMM Workshop on Internet Measurement Workshop, San Francisco,
California, USA.
Barford, P. and D. Plonka (2001). Inferring Client Experience From Flow-based
Measurements. ACM SIGCOMM Internet Measurement Workshop.
Caceres, R., N. G. Duffield, et al. (2000). Measurement and Analysis of IP Network Usage
and Behavior. IEEE Communications Magazine.
Claffy, K. C. (1994). Internet traffic characterization. Computer Science & Enginnering,
University of California, San Diego.
Cranor, C. D., E. Gansner, et al. (2001). Characterizing large DNS traces using graphs,
ACM SIGCOMM Internet Measurement Workshop.
Fritchie, S. L. (2003). A study of Erlang ETS table implementations and performance. ACM
SIGPLAN Workshop on Erlang, Uppsala, Sweden, ACM Press.
Fullmer, M. and S. Roming (2000). The OSU Flow-tools Package and Cisco NetFlow Logs.
LISA.
Karagiannis, T., A. Broido, et al. (2004). File-sharing in the Internet: A characterization of
P2P traffic in the backbone . Networking.
Plonka, D. (2000). FlowScan: A Network Traffic Flow Reporting and Visualization Tool.
LISA.
Rogers, J. and K. Christensen (2001). A Fluid-Flow Characterization of Internet1 and
Internet2 Traffic. IEEE Conference on Local Computer Networks.
GPROF: http://www.cs.utah.edu/dept/old/texinfo/as/gprof_toc.html
FNV Hash: http://www.isthe.com/chongo/tech/comp/fnv/
NetFlow: http://www.switch.ch/tf-tant/floma/software.html#netflow