search menu icon-carat-right cmu-wordmark

Flow Indexing: Making Queries Go Faster

In this presentation, John McHugh explains that using the SiLK framework to index flow is effective and inexpensive, and reduces query time significantly.

Software Engineering Institute



  • Indexing of flow is effective and inexpensive.
  • For a large class of queries, it can significantly reduce query time by eliminating files from consideration.
  • Everything can be done within the SiLK framework, but:
    • Some data reorganization and improvements in the tools (more efficient data structures, tool approaches, multi-key sets) could improve things.
    • Routine indexing of {sip, dip}, ports, protocols, size, rate, frequency, etc., distributions with graphical presentation would be a big plus.
Part of a Collection

Flocon 2012 Collection

This content was created for a conference series or symposium and does not necessarily reflect the positions and views of the Software Engineering Institute.