Network flows build the basis of modern network data analysis by aggregating properties of network packets with common characteristics. A consistent and unambiguous definition of the network flow concept is an indispensable prerequisite and starting point for reproducible network research. However, in today’s practice, the flow output of distinct flow exporters, which is software to generate flows from observed network packets, varies substantially on identical network packet stream input. In this paper we present an in-depth comparison of different flow exporters and show how their outputs differ significantly. We argue that this substantially impairs reproducibility for traffic analysis research. We first present the detailed flow definition of the IP Flow Information eXport (IPFIX) standard including explanations and examples, analyze design and implementation of existing flow exporters, and explore the reasons why many projects and publications chose to implement their own flow exporters. Based on this analysis we highlight the main challenges in the flow exporting process and present a detailed tutorial on how to design and implement a flow exporter such that it yields consistent, reproducible output. Based on the tutorial’s theoretical analysis and lessons learned we present design and main concepts of a versatile, flexible, and open source flow exporting solution called go-flows that generates deterministic, reproducible network flows. Finally, we present a flow-by-flow comparison of the analyzed flow exporters’ output, explore the differences in terms of their generated flows, compare flow exporter performance, and conclude with guidelines on parameters that play a crucial role in improving the reproducibility of exported flows.

中文翻译：

---

为什么我的流量不同？流导出器教程

网络流通过聚合具有共同特征的网络数据包的属性构建现代网络数据分析的基础。网络流概念的一致和明确定义是可重复网络研究不可或缺的先决条件和起点。然而，在今天的实践中，不同流输出器的流输出，它是从观察到的网络数据包生成流的软件，在相同的网络数据包流输入上有很大的不同。在本文中，我们对不同的流量输出器进行了深入比较，并展示了它们的输出如何显着不同。我们认为这极大地损害了流量分析研究的可重复性。我们首先介绍 IP 流信息导出 (IPFIX) 标准的详细流定义，包括解释和示例，分析现有流导出器的设计和实现，并探讨许多项目和出版物选择实现自己的流导出器的原因。基于此分析，我们重点介绍了流导出过程中的主要挑战，并提供了有关如何设计和实现流导出器以使其产生一致、可重复的输出的详细教程。基于本教程的理论分析和经验教训，我们介绍了一种称为 go-flows 的通用、灵活和开源流导出解决方案的设计和主要概念，该解决方案可生成确定性、可重现的网络流。最后，我们对所分析的流导出器的输出进行了逐流比较，探讨了它们生成的流方面的差异，比较了流导出器的性能，