Abstract: Binned Duration Flow Tracking (BDFT) method tracks the duration of packet flows in a resource limited environment by storing packets identifying the beginning and the end of a flow in bins, with each bin covering an independent and arbitrary length of time. Bins are “aged” periodically, based on the range of time which the bin covers. A query as to the flow duration returns the bin number which that flow is in; the bin number is then translated into a range of time. Each bin is a counting bloom filter. The size of the bloom filters, range of the count, and number of hashes used are all parameters of the algorithm which affect memory usage, processing required, and accuracy.

Abstract: Symmetric Connection Detection (SCD) is a method of detecting when a connection has been fully established in a resource-constrained environment, and works in high-speed routers, at line speed. Many network monitoring applications are only interested in connections that become fully established, so other connection attempts, such as port scanning attempts, simply waste resources if not filtered. SCD filters out unsuccessful connection attempts using a simple combination of Bloom filters to track the state of connection establishment for every flow in the network. Unsuccessful flows can be filtered out to a very high degree of accuracy, depending on the size of the bloom filter and traffic rate. The SCD methodology can also easily be adapted to accomplish port scan detection, and to detect or filter other types of invalid TCP traffic.