The First International Workshop on Traffic Monitoring and Analysis (TMA 2009) was an initiative from the COST Action IC0703 Data Traffic Monitoring and Analysis: Theory, Techniques, Tools and Applications for the Future Networks (www.cost-tma.eu). The COST program is an intergovernmental framework for European Cooperation in Science and Technology, allowing the coordination of nationally funded research on a European level. Each COST Action contributes to reducing the fragmentation in research and opening the European Research Area to cooperation worldwide. Traffic monitoring and analysis (TMA) is now an important research topic within the field of networking. It involves many research groups worldwide that are coll- tively advancing our understanding of the Internet. The importance of TMA research is motivated by the fact that modern packet n- works are highly complex and ever-evolving objects. Understanding, developing and managing such environments is difficult and expensive in practice. Traffic monitoring is a key methodology for understanding telecommunication technology and improving its operation, and the recent advances in this field suggest that evolved TMA-based techniques can play a key role in the operation of real networks. Moreover, TMA offers a basis for prevention and response in network security, as typically the det- tion of attacks and intrusions requires the analysis of detailed traffic records. On the more theoretical side, TMA is an attractive research topic for many reasons.