Live traffic monitoring with tstat: capabilities and experiences

摘要: Network monitoring has always played a key role in understanding telecommunication networks since the pioneering time of Internet. Today, traffic become element to characterize network usage and users’ activities, understand how complex applications work, identify anomalous or malicious behaviors, etc. In this paper we present our experience engineering deploying Tstat, passive tool that been developed past ten years. Started as scalable continuously monitor packets flow on link, Tstat evolved into application gives researchers operators possibility derive extended measurements. offers capability track flows, it integrates advanced behavioral classifiers generated flow, automatically derives performance indexes allow easily both activity. After describing capabilities internal design, some examples measurements collected at edge campus for