Flamingo: Visualizing Internet Traffic

In this paper we describe a set of visualization techniques that can help the task of operating and managing a network by representing network traffic information in a concise and intuitive manner. We have implemented these visualization techniques in Flamingo, a software tool that can be used to explore Internet traffic flow data. Flamingo is able to process live Netflow data in real-time and present a set of interactive visualizations and associated manipulation tools that can help users in network data analysis. Flamingo is comprised of a server and a client component. The Flamingo server is responsible for receiving raw Netflow feeds from devices in the network that can sample traffic, and then sending processed information to the client for display. The Flamingo client receives data from the server and provides concise intuitive data visualizations, 3D space navigation, as well as filtering capabilities that can help the operator to extract or monitor specific information of interest. Flamingo also supports a playback mode which allows users to select specific historical Netflow data for visualization. We illustrate with the help of simple examples, based on traffic data from a busy Internet backbone router, how Flamingo can be used to perform network monitoring tasks as well as network security related data forensics.