GoLCoNDa: Geo-IP Lookup for campus network NetFlow data

Abstract

It is a challenging task for network administrators to properly monitor and manage an institution's incoming and outgoing network traffic patterns. While NetFlow is useful to gather flow-level data, its feature is limited to traditional flow-level information such as the source IP address, destination IP address, source port number, destination port number, and the protocol type. Thus, if we are to understand geographic dynamics of any flow connected to hosts at an institution from the outside world, it is not currently possible with NetFlow. To address the geo-location information of such flows, we developed the tool, GoLCoNDa, for use by campus network administrators. This tool allows the correlation of IP addresses with the geo-location information to visualize the geo-location of incoming and outgoing flows. Our tool handles millions of records quickly.