1. PlanetFlow The PlanetLab Network Auditing Service Mark Huang
Princeton University / PlanetLab Operations

2. Why we need network auditing
Enforces the AUP
Isolates responsibility
Keeps us on good terms with the Internet community

3. Basic search

4. Search results

5. Feedback

6. PlanetFlow is not… NetFlow™ NetFlow Snort Packet accurate Real time
Suitable for research (yet)
Not NetFlow™, Cisco’s proprietary traffic flow monitor. Does not do fancy accounting, billing, protocol analysis, or DoS monitoring, and does not track usage over time.
Not NetFlow, the old version 2 service that ended up being mostly unusable.
Not Snort or tcpdump. Aggregates outbound packets into daily “flows” (unique source and destination tuples for known protocols).
Updates backend every 5 minutes. Flows are aggregated daily.
Makes mistakes. Does no protocol analysis. No sensor interface.

7. Requirements Usable Comprehensive Archivable Secure Fast Scalable
Small
Secure
Run in a slice

8. Implementation Fast Scalable Small Secure
Collector is multi-threaded C
MySQL backend
Most queries take only seconds
Scalable
Split table, split database schema
One codebase
Automated maintenance
Small
Compressed MyISAM tables
20-50 MB per day per node
240 GB per month
Secure
Runs in a slice

9. Some interesting statistics
PlanetLab regularly generates 100 M flows and 3-4 TB of traffic per day
60-70% of this traffic is within PlanetLab
55% of an average node’s traffic is generated by a single slice
72% of an average slice’s traffic is to a single destination