\chapter{Network management}
\label{ch:network}

This chapter discusses network
management. Section~\ref{sec:configurationmanagement} describes
network configuration management. Section~\ref{sec:securitymanagement}
studies security management and network elements that are used to
secure risky areas of networks. Section~\ref{sec:faultmanagement}
studies fault management, including troubleshooting, fault
localization, and testing
methods. Section~\ref{sec:accountingmanagement} studies accounting
management.


\section{Configuration management}
\label{sec:configurationmanagement}

Configuration management means initializing and shutting down parts of
a network (for example routers, hubs, repeaters) and reporting the
changes. It is also concerned with maintaining, adding and updating
the relationships among components and the status of components during
network operation. Network traffic patterns and identified
bottlenecks that reduce performance must be understood. Nowadays
modern components and subsystems can be configured to support many
different applications. The same device can be configured to act
either as a router or as an end system node or both. When it is
decided how a device is to be used, the appropriate software and a set
of attributes and values are chosen for that device~\cite[page
481]{b32}. Reconfiguration may be necessary in case of fault isolation
or when the network is expanded.

As the network scales up in physical size (capability and complexity),
also the management capabilities must be enlarged. The aim is that
these actions could be automated. It should also be possible to make
on-line changes without affecting the entire element or
network~\cite{b24}. Large-scale network management systems must be
constructed to support diverse network elements. They must also be
extensible and flexible enough to support new elements and the rapid
deployment of new highly customized services.

Activities in network management can be divided into three groups~\cite{b10}:
\begin{itemize}
\item Activities, that do not affect the function of an element, 
\item Activities, that affect the function of an element (for example
switching off an element in a subnetwork), and 
\item Activities, that make elements to desired activities (for
example restarting an element).  
\end{itemize}

Dynamic updating of configuration needs to be done periodically to
ensure that the existing configuration is known. This is essential for
fault management as well.

Configuration management tools have reporting components. When network
configuration changes, users must be informed about new network
elements and resources.  Configuration management is well organized
when all the gathered information and operations are in statistical
form.

There is a risk of spending money on hardware and services that remain
underutilized. On the other hand the risk of underprovisioning is that
there is loss of productivity which reflects to the service
level~\cite{b4}. When the network is designed, it is essential to
predict the growth of the network. The network should also be prepared
to varying volumes of users.

By continuously addressing the cost of maintenance (Mean Time Between
Failure (MTBF) and Mean Time To Repair (MTTR) statistics, costs
associated with maintaining) the network as a system can be
tuned~\cite{b27}.


\subsection{TCP/IP networks}

TCP/IP networks cause more work for system administrators than other
networking systems. Administrators have to manually configure each
computer for network use when it is added to the network, or when it
is moved from one subnet to another. Each computer must manually be
assigned a unique IP address and various configuration parameters must
be set.

There is a need for tools, that automatically assign addresses and set
configuration parameters. Some client/server solutions are already
available. Client machines find the details of other hosts on the
network using the Domain Naming Systems (DNS) protocols, and can be
told their network configuration using Bootstrap (BOOTP)
protocol. Static allocation of IP addresses to particular machines can
be chosen over dynamic allocation using the Dynamic Host Configuration
Protocol (DHCP)~\cite{rfc2132}.


\section{Security management}
\label{sec:securitymanagement}

Security management covers such areas as detecting, tracking and
reporting security violations, and creating, deleting and maintaining
security-related services such as encryption, key management, and
access control. Distributing passwords and secret keys to bring up
systems is also a function of security management~\cite[page 12]{b34}.

As computer-based communications and networks that link open systems
continue to expand, security management becomes
critical. Nevertheless, standardization of security properties has
developed slowly. Security of devices and networks must be compared to
possible threats and risks. If the risks are high, the devices and the
networks must be provided with more reliable secure properties.

Basic security services, that are defined in ITU-T (International
Telecommunication Union - Telecommunication standards) Recommendation
X.800, are:

\begin{itemize}

\item \textbf{Access control}

The property of controlling network and computer resources in such way
that only legitimate users can access them within their limits. One
approach is to attach to an object a list which explicitly contains
the identity of all permitted users (an Access Control List
(ACL))~\cite{rfc2196}. Access control tools are discussed on
page~\pageref{subsec:accesscontroltools}.

\item \textbf{Authentication}

The property of knowing that the data received is the same as the data
that was sent and that the claimed sender is in fact the actual
sender. Several authentication techniques have been developed, for
example technologies that provide passwords that are only used once
(commonly called one-time passwords), and Kerberos. Kerberos is a
software designed and developed at Massachusetts Institute of
Technology (MIT) to perform distributed authentication in an open
network environment.

\item \textbf{Confidentiality}

The property of communicating so that the intended recipients know
what was being sent but unintended parties cannot determine what was
sent. Encryption is commonly used to provide confidentiality.

\item \textbf{Integrity}

The property of ensuring that data is transmitted from source to
destination without undetected alteration. One way to provide
integrity is to produce a checksum of the unaltered file, store that
checksum offline, and periodically (or when desired) check to make
sure the checksum of the online file hasn't changed (which would
indicate the data has been modified)~\cite{rfc2196}.

\item \textbf{Non-repudiation}

The property of a receiver being able to prove that the sender of some
data did in fact send the data even though the sender might later
desire to deny ever having sent that data~\cite{rfc1825}.
\end{itemize}


Effective security management must be involved in all steps of
data storage and transfer process. Logs are important security tools
and therefore security management is involved with the collection,
storage and examination of the audit records and security
logs. Increasing the level of network security will affect to the
openness of the system and to the cost of maintaining the network. The
implementation of security management with proper controls should not
affect the normal operation of network personnel. It is problematic to
decide where to locate data security properties.


\subsection{Authentication and authorization}

Almost all applications utilize user information and presume an
authentication of users. Authorization is determining whether an
identity is permitted to perform some action, such as accessing a
resource~\cite{b15}. Passwords, smart cards and certificates are used
to authenticate a user. A user may have a right to use more than
one name and identities established by
multiple organizations (such as universities and scholarly
societies). There might be an advantage if all the user information is
available in same directory. All the applications could then use the
same information. Users have to log in only once to be able to use all
the services and resources~\cite{b17}.

There are some basic requirements for authentication~\cite{b15}:
\begin{itemize}
\item Access management solution needs to work at a practical level,
\item The solution needs to be secure
\item It should make access easier, minimizing redundant
authentication interactions and providing user-friendly information
resources, 
\item It needs to scale,
\item It needs to be robust,
\item It must be able to recognize the need for a user to access a
resource independent of his or her physical location (for example, a
user must be able to connect to the internet via a commercial ISP, a
mobile IP link, or a cable television Internet connection from home),
and
\item There should be a simple and well-defined (standard) interface
between resource operator and licensing institution.
\end{itemize}

The basic access management problem is licensing agreements for
networked information resources. The situations where institutions
agree to share limited access are difficult. At present, most access
to network information resources is not controlled on a fine-grained
basis. There is a danger that by accommodating all the needs for
fine-grained access management into the basic access management
mechanisms will produce a too complex and costly system~\cite{b15}.

Management data represents a problem in the current access framework. The
problem is the conflict between private and public data. Most of the
data has to be sorted out at the institutional policy level and it
may involve making sacrifices in order to ensure privacy. Some
institutions may be legally limited in their ability to collect
certain management data.

Proxies and credential-based authentication (the user presents a
credential to the operator as evidence that he or she is a member of
the user community) schemes seem to be viable. Proxy servers will
become a focal point for policy debates about privacy, accountability
and the collection of management information. Successful operation of
a proxy server means that the user trusts the licensee institution to
behave responsibly and to respect privacy.

A cross-organizational authentication system based on a credential
approach has the advantage of greater transparency. Resource operators
can have a higher level of confidence in the access management
mechanisms and a greater ability to monitor irregular access
patterns. Privacy, accountability and collection of management
statistics must be taken up for discussion among a larger group of
parties.

IP source filtering does not seem to be a viable solution for access
management. However, it may be very useful for some niche
applications, such as supporting public workstations. It could be used
more widely, although it cannot support remote users flexibly in its
basic form. Most real-world access management systems are going to
have to employ multiple approaches and IP source address filtering is
likely to be one of them~\cite{b15}.


\subsection{Protocols and programs for network security}

Table~\ref{tab:protocolsandprograms} describes protocols and programs,
that are developed to provide security over the Internet. Secure-HTTP
(S-HTTP) is an application-level protocol that provides security
services across the Internet. It provides confidentiality,
authenticity, integrity, and non-repudiability. S-HTTP is limited to
the specific software that is implementing it, and it encrypts each
message individually~\cite{b30}.

\begin{table}[htb]
\begin{tabular}{|c|c|}\hline
\textbf{Level}			& 	\textbf{Protection Used}\\\hline
Application-level 		&	 S-HTTP, SSH, stelnet, S/MIME\\\hline
Transport-level (TCP, UDP) 	& 	SSL, PCT\\\hline
Network-level (IP) 		& 	IPSEC\\\hline
\end{tabular}
\caption{Protocols and programs developed to provide security over the Internet}
\label{tab:protocolsandprograms}
\end{table}

Secure Shell (SSH) and Secure telnet (stelnet) are programs that allow
you to log in to remote systems and using an encrypted connection. SSH
uses public-key cryptography to encrypt communications between two
hosts, as well as for user authentication.

Secure Multipurpose Internet Mail Extension (S/MIME) is an encryption
standard used to encrypt electronic mail, or other types of messages
on the Internet. It is an open standard developed by RSA Data Security
Inc.

Secure Socket Layer (SSL) is an encryption method developed by
Netscape to provide security over the Internet. SSL is a protocol
layer that is located between the network layer and applications, so
that, in theory, it can be used with any application. However, it is
vulnerable to poor application design. It provides data encryption,
server authentication, message integrity, and optional client
authentication for a TCP/IP connection~\cite{b30}.

The Private Communication Technology (PCT) protocol is developed by
the Microsoft company to be used mainly in their Internet Explorer
browser.

IP Security Architecture (IPSEC) provides a standard security
mechanism and services to the currently used IP version 4 (IPv4) and
to the new IP version 6 (IPv6). IPSEC is less dependent of individual
applications than SSL. It provides IP-level encryption by specifying
two standard headers: IP Authentication Header (AH) and IP
Encapsulating Security Payload (ESP). IP Authentication Header
provides strong integrity and authentication. It computes a
cryptographic authentication function over the IP datagram and uses a
secret authentication key in the computation. IP Encapsulating
Security Payload provides integrity and confidentiality for IP
datagrams. It encrypts the data to be protected and places it in the
data portion of the IP Encapsulating Security Payload.  However, these
mechanisms do not provide security against traffic analysis.  Any
specific protocol for key management is not provided by the
architecture, only requirements for such systems to be used in
conjunction are described~\cite{b35}.


\subsection{Simple Network Management Protocol (SNMP)}

The SNMP architecture makes a distinction between message security
services (integrity, authentication and encryption) and access control
services. Both message security and access control services can be
provided by multiple security or access control models. The
architecture allows coexistence of multiple models in order to
allow future updates, in case the security requirements change or
cryptographic protocols need to be replaced~\cite[pages
690--692]{b36}.

The User-based Security Model (USM) provides integrity, authentication
and privacy, and is the standard security model currently used with
SNMP version 3 (SNMPv3). The View-based Access Control Model (VACM)
provides checking whether the users have proper access rights to
access one or more objects in a Management Information Base (MIB) and
perform operations on these objects. USM is discussed in RFC 2274 and
VACM in RFC 2275.


\subsection{Access control tools}
\label{subsec:accesscontroltools}

Hubs, routers and firewalls can be used to limit the access to the
networks or the parts of the networks.

\textit{Hubs} used in LANs are provided with simple security
properties, for example tapping or listening protection, and
penetration prevention. These security level operations can be
restricted by a date or a time period.
 

\textit{Routers} are provided with security properties as well.
They can improve network security, but also introduce new problems:
Routing protocols are susceptible to security attacks, and routing
mistakes may allow the entrance of unauthorized personnel into the
network. Unlicensed remote and local operations must be prevented by
using usernames. Traffic can be controlled with packet filtration
based on the list. Properties such as network address translation
(NAT), port address translation (PAT), and logging of events and
alerts can be attached to the router. It has not been possible to
expand the capacity of traditional routers as cost-effectively as the
capacity of PC workstations or the network traffic volume~\cite{b12}.
 
\textit{Firewall systems} control connections between closed networks
and outside world. There are two main types of firewalls: filtering
firewalls and proxy firewalls. A filtering firewall routes packets
according to the address and the type of a packet. A proxy firewall
controls the traffic at the application level.

A firewall often represents the bottleneck of the network. Examining
every packet before transfer requires an efficient processor.
Configuration failures may also leave unprotected passages through the
firewall.

A firewall can be implemented using:
\begin{itemize}
\item Screened subnet architecture,
\item Multi-homed host architecture, or
\item A router with security properties.
\end{itemize}

The screened subnet architecture usually consists of an interface
router, open network, security server (called Bastion Host) and
internal router. Interface router is the only connection to outside
from organization's own network. It checks that packets coming from
outside don't have source address of the internal network. The
internal router filters packets by address, protocols and port
numbers. It controls services available from both outside and inside
of the organization's network. Bastion Host is the security
server. Security server is the connection point with limited services
in the intranet and in the extranet e.g. Domain Name Service (DNS),
Simple Mail Transfer Protocol (SMTP) and File Transfer Protocol
(FTP)~\cite[pages 398--399]{b33}.

The multi-homed host architecture is a solution where an entire
security system resides in a single host. A multi-homed host connects
a closed network to outside world, routing packets on application
level instead of IP level~\cite[pages 399--400]{b33}.


\subsection{Security problems of Internet}

The list below describes the security problems in the current
Internet.

\begin{itemize}
\item \textbf{Weak authentication}

Passwords on the Internet can be cracked by a number of different
ways. The two most common methods are cracking the encrypted form of
the password, and monitoring communications channels for password
packets.

Another problem with authentication results from some TCP or UDP
services being able to authenticate only to the granularity of host
addresses and not to specific users. For example, an NFS (UDP) server
cannot grant access to a specific user on a host, it must grant access
to the entire host. The administrator of a server may trust a specific
user on a host and wish to grant access to that user, but the
administrator has no control over other users on that host and is thus
forced to grant access to all users (or grant no access at all).

\item \textbf{Ease of spying/monitoring}

When a user connects to his or her account on a remote host using
TELNET or FTP, the user's password travels across the Internet
unencrypted. Another method to break into systems is to monitor
connections of IP packets bearing a username and password, and then
use them to login normally. If an administrator-level password is
captured, the job of obtaining privileged access is made much easier.

Electronic mail, as well as the contents of TELNET and FTP sessions,
can be monitored and used to learn information about a site and its
business transactions. Most users do not encrypt e-mail, yet many
assume that e-mail is secure and thus safe for transmitting sensitive
information.

The increasingly popular X Window System is also vulnerable to spying
and monitoring. The system permits multiple windows to be opened at a
workstation. Intruders can sometimes open windows on other systems and
read keystrokes that can contain passwords or sensitive information.

\item \textbf{Host-based security does not scale}

Host-based security does not scale well: as the number of hosts at a
site increases, the ability to ensure that security is at a high level
for each host decreases. Secure management of just one system can be
demanding, managing many such systems could easily result in mistakes
and omissions. A contributing factor is that the role of system
management is often short-changed and performed in haste. As a result,
some systems will be less secure than other systems, and these systems
could be the weak links that will break the overall security
chain~\cite{b40}.
\end{itemize}


\section{Fault management}
\label{sec:faultmanagement}

Physical network problems account more than half of all network
problems. Locating the origins of such problems as fiber cut, the
earth is incorrect, adapter is broken or incorrectly joined, costs
network providers time and money. Network management systems have also
traditionally focused on the logical connection between the end user
and the network destination, since most network problems have been a
result of errors created by software applications~\cite{b24}. Finding
and repairing failures of software applications is usually difficult,
for example in such a case that the workstation sends but does not
receive packets, too many collisions occur or frames are too short or
too long.

Fault management is troubleshooting, fault localization, isolation and
correction. Today, the process of fault management needs to be
automated. Rapid and accurate correction of network problems has to
be created by the network or by the end user. Even if the entire
network was violated, the network management application should
work~\cite{b25}.

Expert\label{expertsystems} systems provide an efficient and cost
effective way of automating network fault management. By automating
fault management, problems and possible diagnosis can be done faster
and more efficiently. However, real-time performance represents a
problem for expert systems~\cite{b8}. Bounds on response times are
difficult to establish. There are also risks pushing the limits of
automation through the introduction of new or only partially proven
technologies.


\subsection{Transferring information}

There are two mechanisms of transferring network management
information from a managed entity to a manager: \textit{polling} and
\textit{sending alerts} (messages are initiated by managed
network elements). Advantages and disadvantages exist within both
methods. Most network management systems use an optimal combination of
alerts and polling in order to maintain advantages of each and
eliminate disadvantages of pure polling~\cite{rfc1224}.

Most systems poll the managed objects, search for error conditions and
illustrate the problem in graphical format or as a textual
message. Disadvantages of polling are the response time of problem
detection and the increased volume of network management
traffic. Having to poll many management information base (MIB)
variables per machine on a large number of machines is itself a
problem. The ability to monitor such a system is limited. Polling many
objects on many machines increases the amount of network management
traffic flowing across the network. It is possible to minimize this
through the use of hierarchies (polling a machine for a general status
of all the machines it polls). Anyway, the response time will be a
problem~\cite{rfc1224}.

If a system fails shortly after being polled, there may be a
significant delay before it is polled again. During this time, the
manager must assume that a failing system is acceptable. While
improving the mean time to detect failures, it might not greatly
improve the time to correct the failure. The problem will generally
not be repaired until it is detected.

There are problems attached also to the second method, sending alerts:
There is a possibility to lose of critical information and to
over-inform the manager. An ideal management system would generate
alerts to notify its management station of error conditions. However,
alerts cannot usually be delivered when the managed entity fails or the
network experiences problems. It is important to remember that failing
machines and networks can not be trusted to inform a manager that they
are failing. The manager should periodically poll to ensure
connectivity to remote stations, and to get copies of alerts that were
not delivered by the network~\cite{rfc1224}.

Alerts in a failing system can be generated so rapidly that they
impact functioning resources. An "open loop" system in which the flow
of alerts to a manager is fully asynchronous can result in an excess
of alerts being delivered. There may be a situation where all
available network bandwidth into the manager is saturated with
incoming alerts, thus preventing the manager from disabling the
mechanism generating the alerts. Methods are needed to limit the
volume of alert transmission and to assist in delivering a minimum
amount of information to a manager. Alarm correlation is done by
filtering secondary alarms, e.g. using expert systems\footnote{Expert
systems are discussed briefly on page~\pageref{expertsystems}}.

Many management tools also \textit{log} events with different formats
and different sources. These events should later be correlated using
time stamp to identify the source of the problem. Also topology
information is needed to identify the precise location of the problem.

Many devices have buffers reserved for logs.  When a buffer becomes
full, new logs are written over the oldest ones. If the buffer becomes
full quickly, some important logs may disappear before they are
noticed.  Buffers also consume disk space that could be used for other
purposes.

\subsection{Troubleshooting and fault localization}

Several diagnostic tools are used for troubleshooting and fault
localization purposes. These include ifconfig, arp, netstat, ping,
nslookup, dig, ripquery, traceroute, and etherfind~\cite[pages
260--262]{b33}.

\textit{The packet inter net groper (ping)} tests whether a remote
host can be reached. It sends an internet control message protocol
(ICMP) loopback request packet to a target IP address. The receiver
accepts the loopback request and issues a loopback response to the
initiator of the Ping command. It cannot be determined with
echo-response which one of the possible routes is violated, because
loopback request and loopback response may use different routes. Ping
can only be used to determine whether the target IP-address is
available or not. Another usage of ping is to measure the response
times of different packet sizes~\cite[page 33]{b4}.

Unlike ping, \textit{traceroute} forces every router to send back an
ICMP-control message. Most Traceroute applications send a sequence of
User Datagram Protocol (UDP)-packets to a randomly selected
UDP-port~\cite{b2}. Sometimes firewalls filter these packets from the
main traffic, when the tracing has come to an end.

After detecting a fault, operators should as soon as possible find the
root cause of the problem. Clearly defining the problem helps to
isolate the root cause from symptoms~\cite{b22}. Operators must also
determine what troubles it causes and to whom.

At first it is useful to find the parts of the network, where the
fault can not be, by eliminating processes. These parts can be
neglected. If the problem is very serious and difficult, the network
can be divided into smaller parts to be inspected one by
one. Connectivity tests are also used to find the violated devices. At
the same time it can be detected whether the fault is local or
widespread. By testing the data integrity it can be found out if
a part of the packets are lost by transmission. Delays are also to be
tested, because some faults result from excessive delays~\cite{b2}.


\subsection{Testing}

\textit{Measuring the accessibility} of devices helps us to collect
information about the status of the network. In general, some points
are selected to measure connections. Measurements are done by a
control device. After measurements, the results are interpreted.

Measuring the accessibility is not a complete method. For example,
controlling only routers is not enough. If the router has been set up
so that it gives preference to packet switching, it will send packets
normally even if it is heavily loaded and perhaps can not answer to
messages of the controlling device. Another example is that two
devices that can be reached might not have a connection with each
other.

Another method of testing is to \textit{control routing
tables}. Routing should change only when the topology of the network
changes. If there are changes at other times, there is probably
something wrong with the network.

Routing tables express the topology of the network. Finding out the
network topology from routing tables is more difficult than
controlling accessibility~\cite{b2}. In order to get information from
routers to routing tables, routers must be Simple network
management protocol (SNMP) compatible, dynamic routing tables must
support sending request or routing information must be tapped from a
routing protocol. These requirements are not necessarily realized
although SNMP is a commonly used protocol. Analysis of the routing
tables can concentrate on the parts of the network which are most
susceptible to failures.


\section{Accounting management}
\label{sec:accountingmanagement}

Accounting management deals with information that concerns individual
users, including following issues:
\begin{itemize}

\item \textbf{Usage measurement}

Usage measurement is collecting data for charging, and processing the
data. It has to be reliable, and sometimes it has to be done in real
time.

\item \textbf{Tariffing/pricing}

A tariff is a set of data used to determine the charges for services
used. It depends on the service, origination and destination, tariff
period, and day.

\item \textbf{Collections and finance}

This includes administration of customer accounts, informing
customers, payment dates, payment amount, and collection of payments.

\item \textbf{Enterprise control}

Enterprise control is responsible for proper financial management
of an enterprise. It includes identifying and ensuring financial
accountability of officers. Also checks and balances needed for
financial operation of an enterprise are included~\cite[pages
64--66]{b34}.
\end{itemize}

A system which generates data for accounting purposes is called an
accounting management agent. Accounting managers are systems which
interrogate accounting management data or obtain it in other ways. If
accounting management is distributed across various systems, all
systems may be required to control their own area
themselves. Furthermore, a system may request information from other
systems in order to square its accounts~\cite[pages 188--189]{b42}.

Accounting data is sensitive information. The collector must provide
confidentiality at the point of collection, through transmission and
up to the point where the data is delivered. The delivery function may
also require authentication of the origin and the destination and
provision for connection integrity (if connections are
utilized). Security services can be provided for example by
SNMPv3\footnote{See section~\ref{sec:snmp} for Simple Network
Management Protocol (SNMP).}.


\subsection{Internet pricing}

Internet pricing contains four basic elements (see
figure~\ref{fig:pricing}). An access-fee is usually a monthly
charge for using an access link of the network. The price depends on
the capacity of the link. Setting up connections or making
reservations can be charged separately. Usage-fee can be used
to charge services on time-, volume-, or QoS-basis. This fee
determines the actual resource usage of a
customer. Content-fee depends on the application content. It
may be omitted (e.g., telephony, fax, e-mail services where the
content is provided by the user), billed separately (e.g., Helsingin
Sanomat on-line edition), or integrated into the telecommunications
charging system (e.g., commercial 0900 numbers in Finland)~\cite{b47}.

\begin{figure}[htb]
\begin{center}
\epsfxsize.5\textwidth
\epsfbox{kuvat/pricing}
\caption{Components of Internet pricing~\cite{b47}}
\label{fig:pricing}
\end{center}
\end{figure}

The current pricing model is based on an assumption of a single
best-effort service model that provides similar service to all
customers. Service provider and customer do not have a direct control
over the actual service in terms of parameters determining volume,
connection time\footnote{Connection time for connectionless
communications would be difficult to measure (except for dialup
access).}, and QoS.

Accounting is usually based on mechanisms offered by commercially
available routers and switches. The most commonly used approach
employs packet filtering and statistical sampling. However, it is
difficult to charge for usage-based traffic since the granularity of
these methods is too coarse and the measurement overhead
significant~\cite{b47}.

Another problem concerning accounting data collection in routers is
whether packets should be counted on entry to or on exit from a
router\footnote{The nature of IP is that not every packet received by
a router is actually passed to an output port, but can be discarded
for example at times of congestion.}~\cite{rfc1272}.

For volume measurements the IETF Real-time Traffic Flow Measurement
(rtfm) working group has proposed standards to meter flows and to
distribute this accounting information via SNMP~\cite{b47}.

The Remote Authentication Dial-In User Service (RADIUS) is a protocol
specified by the IETF radius working group. It helps managing the
Internet access links. Since these links are sensitive to security and
accounting, authentication of dial-in users and negotiation of
configuration data are provided. RADIUS services are implemented by most router
manufactures. Accounting data can be collected on a time-, packet-, or
octet-basis for a particular service~\cite{b47}.


