{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,16]],"date-time":"2026-03-16T13:39:21Z","timestamp":1773668361547,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":29,"publisher":"ACM","license":[{"start":{"date-parts":[[2004,8,30]],"date-time":"2004-08-30T00:00:00Z","timestamp":1093824000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2004,8,30]]},"DOI":"10.1145\/1015467.1015495","type":"proceedings-article","created":{"date-parts":[[2004,10,7]],"date-time":"2004-10-07T13:39:48Z","timestamp":1097156388000},"page":"245-256","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":185,"title":["Building a better NetFlow"],"prefix":"10.1145","author":[{"given":"Cristian","family":"Estan","sequence":"first","affiliation":[{"name":"University of California, San Diego, La Jolla, CA"}]},{"given":"Ken","family":"Keys","sequence":"additional","affiliation":[{"name":"University of California, San Diego, La Jolla, CA"}]},{"given":"David","family":"Moore","sequence":"additional","affiliation":[{"name":"University of California, San Diego, La Jolla, CA"}]},{"given":"George","family":"Varghese","sequence":"additional","affiliation":[{"name":"University of California, San Diego, La Jolla, CA"}]}],"member":"320","published-online":{"date-parts":[[2004,8,30]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"IPMON - packet trace analysis. http:\/\/ipmon.sprintlabs.com\/packstat\/packetoverview.php.]]  IPMON - packet trace analysis. http:\/\/ipmon.sprintlabs.com\/packstat\/packetoverview.php.]]"},{"key":"e_1_3_2_1_2_1","unstructured":"Personal conversation with Dave Plonka.]]  Personal conversation with Dave Plonka.]]"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637210"},{"key":"e_1_3_2_1_4_1","unstructured":"Andy Bierman and Juergen Quittek. Packet sampling (psamp). IETF working group.]]  Andy Bierman and Juergen Quittek. Packet sampling (psamp). IETF working group.]]"},{"key":"e_1_3_2_1_5_1","volume-title":"Traffic flow measurement: Architecture. RFC","author":"Brownlee N.","year":"1999","unstructured":"N. Brownlee , C. Mills , and G. Ruth . Traffic flow measurement: Architecture. RFC 2722, October 1999 .]] N. Brownlee, C. Mills, and G. Ruth. Traffic flow measurement: Architecture. RFC 2722, October 1999.]]"},{"key":"e_1_3_2_1_6_1","unstructured":"Nevil Brownlee and Dave Plonka. IP flow information export (ipfix). IETF working group.]]  Nevil Brownlee and Dave Plonka. IP flow information export (ipfix). IETF working group.]]"},{"key":"e_1_3_2_1_7_1","volume":"18","author":"Lawrence Carter J.","year":"1979","unstructured":"J. Lawrence Carter and Mark N. Wegman . Universal classes of hash functions. In Journal of Computer and System Sciences , volume 18 , April 1979 .]] J. Lawrence Carter and Mark N. Wegman. Universal classes of hash functions. In Journal of Computer and System Sciences, volume 18, April 1979.]]","journal-title":"Journal of Computer and System Sciences"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/276304.276343"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/511334.511376"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/872757.872838"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/948205.948228"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637225"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863992"},{"key":"e_1_3_2_1_14_1","volume-title":"Building a better NetFlow: Technical report","author":"Estan Cristian","year":"2004","unstructured":"Cristian Estan , Ken Keys , David Moore , and George Varghese . Building a better NetFlow: Technical report , 2004 . http:\/\/www.caida.org\/outreach\/papers\/2004\/tr-2004-03\/.]] Cristian Estan, Ken Keys, David Moore, and George Varghese. Building a better NetFlow: Technical report, 2004. http:\/\/www.caida.org\/outreach\/papers\/2004\/tr-2004-03\/.]]"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/948205.948225"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/347059.347554"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF02241657"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/948205.948235"},{"key":"e_1_3_2_1_19_1","volume-title":"PAM2001","author":"Keys Ken","year":"2001","unstructured":"Ken Keys , David Moore , Ryan Koga , Edouard Lagache , Michael Tesch , and k claffy. The architecture of CoralReef: an Internet traffic monitoring software suite . In PAM2001 . CAIDA, RIPE NCC, April 2001 . http:\/\/www.caida.org\/outreach\/papers\/2001\/CoralArch\/.]] Ken Keys, David Moore, Ryan Koga, Edouard Lagache, Michael Tesch, and k claffy. The architecture of CoralReef: an Internet traffic monitoring software suite. In PAM2001. CAIDA, RIPE NCC, April 2001. http:\/\/www.caida.org\/outreach\/papers\/2001\/CoralArch\/.]]"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/248157.248168"},{"key":"e_1_3_2_1_21_1","volume-title":"Rose. RFC","author":"McCloghrie Keith","year":"1991","unstructured":"Keith McCloghrie and Marshall T . Rose. RFC 1213, March 1991 .]] Keith McCloghrie and Marshall T. Rose. RFC 1213, March 1991.]]"},{"key":"e_1_3_2_1_22_1","volume-title":"March","author":"Mills David L.","year":"1992","unstructured":"David L. Mills . RFC 1305: Network time protocol (version 3) specification, implementation , March 1992 .]] David L. Mills. RFC 1305: Network time protocol (version 3) specification, implementation, March 1992.]]"},{"key":"e_1_3_2_1_23_1","volume-title":"The spread of the sapphire\/slammer worm. Technical report","author":"Moore D.","year":"2003","unstructured":"D. Moore , V. Paxson , S. Savage , C. Shannon , S. Staniford , and N. Weaver . The spread of the sapphire\/slammer worm. Technical report , 2003 .]] D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. The spread of the sapphire\/slammer worm. Technical report, 2003.]]"},{"key":"e_1_3_2_1_24_1","unstructured":"Cisco netflow. http:\/\/www.cisco.com\/warp\/public\/732\/Tech\/netflow.]]  Cisco netflow. http:\/\/www.cisco.com\/warp\/public\/732\/Tech\/netflow.]]"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"e_1_3_2_1_26_1","volume-title":"September","author":"Phaal Peter","year":"2001","unstructured":"Peter Phaal , Sonia Panchen , and Neil McKee . RFC 3176: sFlow , September 2001 .]] Peter Phaal, Sonia Panchen, and Neil McKee. RFC 3176: sFlow, September 2001.]]"},{"key":"e_1_3_2_1_27_1","first-page":"305","volume-title":"USENIX LISA","author":"Plonka David","year":"2000","unstructured":"David Plonka . Flowscan : A network traffic flow reporting and visualization tool . In USENIX LISA , pages 305 -- 317 , December 2000 .]] David Plonka. Flowscan: A network traffic flow reporting and visualization tool. In USENIX LISA, pages 305--317, December 2000.]]"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.5555\/1039834.1039864"},{"key":"e_1_3_2_1_29_1","unstructured":"Sampled NetFlow. http:\/\/www.cisco.com\/univercd\/cc\/td\/doc\/product\/software\/ios120\/120newft\/120limit\/120s\/120s11\/12s sanf.htm.]]  Sampled NetFlow. http:\/\/www.cisco.com\/univercd\/cc\/td\/doc\/product\/software\/ios120\/120newft\/120limit\/120s\/120s11\/12s sanf.htm.]]"}],"event":{"name":"SIGCOMM04: ACM SIGCOMM 2004 Conference","location":"Portland Oregon USA","acronym":"SIGCOMM04","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1015467.1015495","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1015467.1015495","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:23:45Z","timestamp":1750253025000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1015467.1015495"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2004,8,30]]},"references-count":29,"alternative-id":["10.1145\/1015467.1015495","10.1145\/1015467"],"URL":"https:\/\/doi.org\/10.1145\/1015467.1015495","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/1030194.1015495","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2004,8,30]]},"assertion":[{"value":"2004-08-30","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}