university of twente the measurements · university of twente the simpleweb what is being measured?...
TRANSCRIPT
![Page 1: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/1.jpg)
UNIVERSITY OF TWENTEThe SimpleWeb
CopyrighThese sh
MEASUREMENTS
OVERVIEW:
• WHAT IS BEING MEASURED?
• GOALS
• TECHNIQUES
• TOOLS
t © 2005 by Aiko Praseets may be used for educational purposes
![Page 2: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/2.jpg)
UNIVERSITY OF TWENTEThe SimpleWeb
WHAT IS BEING MEASURED?
DELAY• ONE-WAY
• ROUND-TRIP
DELAY VARIATION• JITTER
THROUGHPUT• AVARAGE
• PEAK• CAPACITY
LOSS
![Page 3: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/3.jpg)
GOALS OF MEASUREMENTS
INTRUSION DETECTION
LAWFULL INTERCEPTION
TRAFFIC ENGINEERING
NETWORK DIMENSIONING
ACCOUNTING
NETWORK TOMOGRAPHY
![Page 4: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/4.jpg)
INTRUSION DETECTION - INCIDENTS - 1
NUMBER OF REPORTED INCIDENTS
SOURCE: www.cert.org/stats/cert_stats.html
1
10
100
1000
10000
100000
1000000
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
![Page 5: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/5.jpg)
INTRUSION DETECTION - INCIDENTS - 2
ATTACK SOPHISTICATION VERSUS INTRUDER’S KNOWLEDGE
SOURCE: D1.4 SCAMPI PROJECT
• WORMS• DDoS ATTACKS
• SPAM• PHISHING
![Page 6: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/6.jpg)
INTRUSION DETECTION - APPROACHES
DETECT BIT PATTERNS• EXAMPLE: PUBLIC, *.EXE
• SNIFFER• SNORT
DETECT PACKET SEQUENCES• SNIFFER / HOST
• HORIZONTAL - VERTICAL (PORT) SCANS• TCP CONNECTION ATTEMPTS
DETECT SUSPICIOUS BEHAVIOUR• HOST
• (DISTRIBUTED) HONEYPOT
ANALYZE LOG FILES• HOST
• MAIL AND WEB LOGS
![Page 7: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/7.jpg)
INTRUSION DETECTION - HONEYPOT
EXAMPLE: UT
![Page 8: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/8.jpg)
BACKGROUND RADIATION
CATEGORIES:
NON-PRODUCTIVE:• MISCONFIGURATIONS
MALICIOUS:• SCANS
• WORMS• BACKSCATTER FROM FLOODING ATTACKS
• DENIAL OF SERVICE (DOS) ATTACKS
![Page 9: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/9.jpg)
BACKGROUND RADIATION
Study by Pang, Yegneswaran, Barford, Paxson & Peterson2004, Lawrence Berkeley National Laboratory (LBL)
Questions:• What protocols
• What ports• How is the variation in time• What are the main worms
Reference: Characteristics of Internet Background Radiation R Pang, V Yegneswaran, P Barford, V Paxson, L Peterson Proc. of the ACM Sigcomm Internet Measurement Conference
Taormina, Sicily, Italy 2004
![Page 10: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/10.jpg)
BACKGROUND RADIATION
Measurement approach:• Measure traffic destined for unused Internet addresses
• Passive filtering to cope with large amounts of data• Active responders to solicit further traffic
Traces from three locations:• University of Wisconsin (UW)
• Lawrence Berkeley National Laboratory (LBL)• Class A network
![Page 11: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/11.jpg)
BACKGROUND RADIATION
WHAT PROTOCOLS?
11.3%16.53.8%45.20.8%0.156UDP
0.3%0.37639.6%4884.2%4.00ICMP
88.5%13056.5%66495.0%928TCP
%Rate%Rate%Rate
Class ALBL-PUW-1Protocol
11.3%16.53.8%45.20.8%0.156UDP
0.3%0.37639.6%4884.2%4.00ICMP
88.5%13056.5%66495.0%928TCP
%Rate%Rate%Rate
Class ALBL-PUW-1Protocol
![Page 12: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/12.jpg)
BACKGROUND RADIATION
WHAT PORTS?
5.8%4.3%102530.4%19.1%1357.3%28.7%8019.7%43.4%445
3.2%2.7%31272.4%2.2%6129
11.1%3.2%1393.6%3.2%2745
# Packets (%)# Source IP (%) TCP Port
5.8%4.3%102530.4%19.1%1357.3%28.7%8019.7%43.4%445
3.2%2.7%31272.4%2.2%6129
11.1%3.2%1393.6%3.2%2745
# Packets (%)# Source IP (%) TCP Port
![Page 13: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/13.jpg)
BACKGROUND RADIATION
HOW IS THE VARIATION OVER TIME?(PER PROTOCOL)
![Page 14: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/14.jpg)
BACKGROUND RADIATION
HOW IS THE VARIATION OVER TIME?(PER ATTACK)
![Page 15: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/15.jpg)
GOALS OF MEASUREMENTS
INTRUSION DETECTION
LAWFULL INTERCEPTION
TRAFFIC ENGINEERING
NETWORK DIMENSIONING
ACCOUNTING
NETWORK TOMOGRAPHY
![Page 16: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/16.jpg)
LAWFULL INTERCEPTION
RECENT PROPOSALS IN US & EUROPE
NOVEMBER 2004, COUNCIL OF THE EU:
(a) Data necessary to trace and identify the source of a communication which includes personaldetails, contact information and information identifying services subscribed to.
(b) Data necessary to identify the routing and destination of a communication.
(c) Data necessary to identify the time and date and duration of a communication.
(d) Data necessary to identify the telecommunication.
(e) Data necessary to identify the communication device or what purports to be the device.
(f) Data necessary to identify the location at the start and throughout the duration of thecommunication.
SOURCE: http://register.consilium.eu.int/pdf/en/04/st14/st14190.en04.pdf
![Page 17: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/17.jpg)
GOALS OF MEASUREMENTS
INTRUSION DETECTION
LAWFULL INTERCEPTION
TRAFFIC ENGINEERING
NETWORK DIMENSIONING
ACCOUNTING
NETWORK TOMOGRAPHY
![Page 18: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/18.jpg)
TRAFFIC ENGINEERING
MODELLING OF NETWORK TRAFFIC
POISSON ARRIVAL PROCESS
GAUSSIAN TRAFFIC MODELS
SELF-SIMILARITY / LONG RANGE DEPENDANCE
HEAVY TAIL DISTRIBUTION
![Page 19: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/19.jpg)
TRAFFIC ENGINEERING - SELF SIMILARITY
SOURCE: Traffic Characterisation for Telecommunication NetworksAttila Vidács, Zsolt Kenesi, Ákos Rétfalvi, Péter Pozsgai, Sándor Molnár - BUTE, Budapest, 1999
Time
Time
Time
Time
1800 sec
180 sec
18 sec
1.8 sec
0
0
0
0
0
0
0
0
400
50
1
3000
(e)
(f)
(g)
(h)
![Page 20: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/20.jpg)
TRAFFIC ENGINEERING - SELF SIMILARITY
SOURCE: Traffic Characterisation for Telecommunication NetworksAttila Vidács, Zsolt Kenesi, Ákos Rétfalvi, Péter Pozsgai, Sándor Molnár - BUTE, Budapest, 1999
1800 sec
Time
Time
Time
Time
180 sec
18 sec
1.8 sec
0
0
0
0
0
0
0
0
(a)
(b)
(c)
(d)
400
50
1
3000
Time
Time
Time
Time
1800 sec
180 sec
18 sec
1.8 sec
0
0
0
0
0
0
0
0
400
50
1
3000
(e)
(f)
(g)
(h)
![Page 21: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/21.jpg)
TRAFFIC ENGINEERING - SELF SIMILARITY
SOURCE: On the self-similar nature of Ethernet traffic (extended version)WE Leland, MS Taqqu, W Willinger, DV Wilson - IEEE/ACM Transactions on Networking, 1994
0 100 200 300 400 500 600 700 800 900 1000
0
20000
40000
60000
(a)Time Unit = 100 Seconds
Pack
ets/
Tim
e U
nit
0 100 200 300 400 500 600 700 800 900 1000
0
2000
4000
6000
(b)Time Unit = 10 Seconds
Pack
ets/
Tim
e Un
it
0 100 200 300 400 500 600 700 800 900 1000
0
200
400
600
800
(c)Time Unit = 1 Second
Pack
ets/
Tim
e Un
it
0 100 200 300 400 500 600 700 800 900 1000
0
20
40
60
80
100
(d)Time Unit = 0.1 Second
Pack
ets/
Tim
e Un
it
(e)Time Unit = 0.01 Second
Pack
ets/
Tim
e Un
it
0 100 200 300 400 500 600 700 800 900 1000
0
5
10
15
![Page 22: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/22.jpg)
GOALS OF MEASUREMENTS
INTRUSION DETECTION
LAWFULL INTERCEPTION
TRAFFIC ENGINEERING
NETWORK DIMENSIONING
ACCOUNTING
NETWORK TOMOGRAPHY
![Page 23: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/23.jpg)
NETWORK DIMENSIONING
CAPACITY OF LINKS
5 MIN. MRTG - 1 SECOND
![Page 24: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/24.jpg)
GOALS OF MEASUREMENTS
INTRUSION DETECTION
LAWFULL INTERCEPTION
TRAFFIC ENGINEERING
NETWORK DIMENSIONING
ACCOUNTING
NETWORK TOMOGRAPHY
![Page 25: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/25.jpg)
ACCOUNTING
RADIUS
STOP:• CURRENT TIME• SESSION TIME• INPUT OCTETS
• OUTPUT OCTETS• INPUT PACKETS
• OUTPUT PACKETS• DISCONNECT REASON
![Page 26: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/26.jpg)
GOALS OF MEASUREMENTS
INTRUSION DETECTION
LAWFULL INTERCEPTION
TRAFFIC ENGINEERING
NETWORK DIMENSIONING
ACCOUNTING
NETWORK TOMOGRAPHY
![Page 27: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/27.jpg)
NETWORK TOMOGRAPHY
EXAMPLE: GEO-LOCATION OF INTERNET HOSTS
SOURCE: Constraint-Based Geolocation of Internet Hosts - B Gueye, A Ziviani, M Crovella, S FdidaProc. of the ACM Sigcomm Internet Measurement Conference, 2004
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0 100 200 300 400 500 600
Cum
ulat
ive
Pro
babi
lity
Error Distance (km)
CBGGeoPing
![Page 28: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/28.jpg)
BANDWIDTH ESTIMATION
Narrow link
interval
![Page 29: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/29.jpg)
BANDWIDTH ESTIMATION
Narrow link
interval
Delay x
![Page 30: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/30.jpg)
TECHNIQUES
ACTIVE MEASUREMENTS• PING
• TRACEROUTE• TCP/IP HEADER OPTIONS
• RIPE / SURVEYOR
PASSIVE MEASUREMENTS• PACKET CAPTURING
• TCPDUMP / NETFLOW / NETRAMET• MIBs
PACKET SAMPLING• TRAJECTORY SAMPLING
![Page 31: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/31.jpg)
EXAMPLE: MEASUREMENT CARDS
![Page 32: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/32.jpg)
EXAMPLE: TCPDUMP
CAN BE USED TO CAPTURE NETWORK TRAFFIC
NOT ONLY TCP
MANY CAPTURE OPTIONS AND FILTERS
MANY DISPLAY OPTIONS
PACKET CAPTURE (PCAP) LIBRARY
![Page 33: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/33.jpg)
EXAMPLE: WIRESHARK
![Page 34: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/34.jpg)
EXAMPLE: NETFLOW
• CISCO• IETF-IPFIX
FLOW:• SOURCE IP ADDRESS
• DESTINATION IP ADDRESS• SOURCE PORT NUMBER
• DESTINATION PORT NUMBER• LAYER 3 PROTOCOL TYPE
• TOS BYTE• INPUT LOGICAL INTERFACE (IFINDEX)
![Page 35: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/35.jpg)
EXAMPLE: NETFLOW
SOURCE: http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/netflsol/nfwhite.htm
![Page 36: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/36.jpg)
EXAMPLE: NETFLOW
![Page 37: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/37.jpg)
EXAMPLE: NETFLOW V9 (1)
SOURCE: http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/tflow_wp.htm#wp1002063
IP HEADER
UDP HEADER
NETFLOW HEADER
TEMPLATE FLOWSET
DATA FLOWSET
DATA FLOWSET
...
VERSION COUNT
SYSTEM UPTIME
UNIX SECONDS
PACKAGE SEQUENCE
SOURCE ID
TEMPLATE FLOWSET
DATA FLOWSET
DATA FLOWSET
...
FLOWSET ID
LENGTH
TEMPLATE
TEMPLATE ID
FIELD COUNT
FIELD TYPE
FIELD LENGTH
FIELD TYPE
FIELD LENGTH
...
...
FIELD TYPE
FIELD LENGTH
![Page 38: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/38.jpg)
EXAMPLE: NETFLOW V9 (2)
SOURCE: http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/tflow_wp.htm#wp1002063
IP HEADER
UDP HEADER
NETFLOW HEADER
TEMPLATE FLOWSET
DATA FLOWSET
DATA FLOWSET
...
TEMPLATE FLOWSET
DATA FLOWSET
DATA FLOWSET
...
FLOWSET ID
LENGTH
RECORDS
RECORD 1 - FIELD 1
RECORD 1 - FIELD 2
...
RECORD 1 - FIELD N
RECORD 2 - FIELD 1
RECORD 2 - FIELD 2
...
RECORD 2 - FIELD N
...
PADDING
![Page 39: UNIVERSITY OF TWENTE The MEASUREMENTS · university of twente the simpleweb what is being measured? delay • one-way • round-trip delay variation • jitter throughput • avarage](https://reader033.vdocuments.us/reader033/viewer/2022041706/5e44fe19bfc8f513663142e0/html5/thumbnails/39.jpg)
EXAMPLE: NETFLOW V9 (3)
SOURCE: http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/tflow_wp.htm#wp1002063