Design and implementation of IP network behaviour analysis system based on NetFlow

The high-speed development of the Internet has brought up a huge challenge for network management. Larger network traffic and more complex applications make it difficult for the original SNMP-based network management software to meet demands of analyzing users and protocols; widespread utility of dynamic ports greatly reduces the accuracy of distinguishing application layer protocols based on tranditional static ports. Since raw NetFlow is enormous, unfit for long-term storage and low in query efficiency, multiple time granularity aggregation schemes are designed. This paper describes characteristics of both real-time and history traffic from five aspects, thus providing a clearer view of network operating conditions. Besides, as the indicator of users' web access behavior, web sites and URLs are analyzed.