NetFlow – The De Facto Standard For Traffic Analytics

1y ago
31 Views
1 Downloads
1.87 MB
55 Pages
Last View : 5d ago
Last Download : 6m ago
Upload by : Randy Pettway
Transcription

NetFlow – The De Facto Standard forTraffic AnalyticsA Webinar on NetFlow and its uses in EnterpriseNetworks for Bandwidth and Traffic AnalyticsDon Thomas JacobTechnical Marketing EngineerManageEngine NetFlow Analyzer

About ManageEngineNetworkServers reEvent Log vent nPerfMonitoringAssetManagementITIL ServiceDeskSQL ServerSyslogManagementPatchManagementNetworkConfig MgmtEnd ExchangeServerFirewall LogAnalyzerPasswordManagementManageEngine is an IT management vendor focused on bringing acomplete IT management portfolio to all types of enterprises

Today’s DiscussionToday’s Discussion The need for bandwidth monitoring and traffic analytics What is NetFlow Flexible NetFlow Supported Devices Use cases SNMP, Packet Sniffing or NetFlow Questions?

Need for Traffic AnalyticsWhat is Happening Profile your network UDP?TCP?Source?Who are the ‘Top Talkers’Understand application usage patternsProtocol distributionPerformance of QoS 2P?

Need for Traffic AnalyticsQuicker Troubleshooting Drill down to traffic spikes or bottlenecks on leased line Find root cause of Internet and application slowness Real time voice and video traffic analysis

Need for Traffic AnalyticsBigger, Faster and Complex Networks Erosion of network perimeter: Telecommuting Faster networks: 1G, 10G, 40G and now 100G Complex, meshed topology

Need for Traffic AnalyticsNetwork Security Increasing BYOD trend and telecommuting Remember the 2011 network attacks? Zero day malware goes undetected by IDS and IPS Are you hosting a SPAM bot or a DoS bot?

Need for Traffic AnalyticsCapacity Planning and Cost Savings Is a bandwidth upgrade necessary? How much is social media traffic usage? Identify congestion causing applications Save cost with informed decisions

Need for Traffic AnalyticsSLA Verification and Usage based Billing ISP meeting Committed Data Rate (CDR)? Validate ISP’s SLA reports with your custom reports Usage data and info for billing / chargeback

Need for Traffic AnalyticsCreate a high performing network Ensure optimal bandwidth usage Effect of network changes and new applications Validate QoS policies Performance of new technology: IPv6, MPLS, 40G or 100G,Voice and Video traffic, etc.

Need for Traffic AnalyticsIntroducing NetFlowTechnology developed by Cisco - Initially designed as aswitching pathNow the Primary IP Traffic accounting technologyAnswers the WHO, WHAT, WHEN and WHERE questionof network IP trafficAll major vendors now support flow export :NetFlow - Cisco, Adtran, 3COMsFlowIPFIXJ-Flow- Alcatel, HP, Brocade, Enterasys, Dell- Nortel- Juniper

What is NetFlow

What is NetFlowWhat is a FlowSeven (7) unique fields define a flowSource Interface (ifindex)ProtocolSource IP AddressDestination IP AddressSource PortDestination PortToS

What is NetFlowHow NetFlow Works Traffic passes through routing/switching device interface Flow created (remember the 7 fields) and stored in NetFlow cache Flows grouped and exported in UDP packets to collector based onactive and inactive flow timeoutNetFlow CacheFlow Analyzer

What is NetFlowNetFlow enabled interfaceCore NetworkEdge RouterNetFlow Packets Approximately 1500 bytesEach contains 20-50 flowrecordsUDP NetFlowNetFlow Collector

What is NetFlowWho ?When ?Source IP AddressDestination IP AddressSource PortDestination PortProtocolFlow Start and End timePacket CountOctet countQoS ?Path ?ToSTCP FlagsProtocolInput and Output Interface(ifindex)What ?Usage ?QoS ?NextHopSource AS InformationDestination AS InformationRoute ?

What is NetFlowCisco NetFlow VersionsCisco NetFlow VersionDescriptionVersion 1Original implementation, Now ObsoleteOnly IPv4 TrafficVersion 5Most widely used versionSupports AS reporting and few additional fieldsVersion 7Specific to Cisco catalyst switchesVersion 8Same as Version 5 but with Flow Aggregation optionsVersion 9Flexible, Customizable and template basedSupports new data fields

What is NetFlowMore on NetFlow ip flow-export version version [origin-as peer-as Select the version of NetFlow to be exported and type of AS info. ip flow-export destination address port Exactly what it says. e.g. ip flow-export destination 198.2.1.16 9996 ip flow export source interface The interface through which NetFlow packets are sent from cache to collector.Recommended to use an interface with the best route to the collector. ip flow-cache timeout inactive seconds The time period for which an expired flow will remain in the cache beforebeing exported. 15 seconds is the default as well as the recommended value ip flow-cache timeout active minutes Time period for which an active flow will remain in the cache before beingexported. 30 minutes is default but the recommended value is 1 minute.

NetFlow Version 9 – Flexible NetFlow

Flexible NetFlowNetFlow Version 9 – Flexible NetFlow Highly flexible flow export - Customized traffic monitoring with userdefined key and non key fields Ability to monitor a wide range of IP packet information which traditionalNetFlow did not have Analyze the effect of new technology implementations in your network:IPv6, VoIP, Webex, Telepresence or other voice and video solutions Some of the major custom fields supported are MPLS LabelsIPv6 TrafficNBAR protocolsLive performance of media flowsMulticast IP TrafficVLAN ID

Flexible NetFlowFlexible NetFlow StructureFlow ExporterFlow RecordFlow MonitorInterface

Flexible NetFlowFlexible NetFlow StructureFlow Exporterdestination 198.2.16.1sourceFlowLoopback0Monitortransport udp 9996export-protocol netflow-v9Interfaceoutput-features

Flexible NetFlowFlexible NetFlow StructureFlow RecordPre-Defined Flow Recordsnetflow-originalnetflow ipv4 original-inputUser-Defined Flow RecordsMatch statementsmatch ipv4 source addressmatch ipv4 destination addressmatch ipv4 protocolmatch transport source-portmatch transport destination-portmatch interface inputCollect statementscollect routing source ascollect transport tcp flagscollect counter bytescollect counter packetscollect flow direction

Flexible NetFlowFlexible NetFlow StructureFlow Monitorexporter exporter namerecord netflow-originalORrecord record name

Flexible NetFlowFlexible NetFlow StructureFlow MonitorInterfaceInterface fastethernet2/1ip flow monitor monitor name input

Flexible NetFlowConfig Example - User-Defined Flow Recordflow record NFArecordmatch ipv4 source addressmatch ipv4 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch ipv4 protocolmatch ipv4 tosmatch ipv4 dscpcollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect counter bytescollect counter packetscollect timestamp sys-uptime firstcollect timestamp sys-uptime lastcollect interface outputcollect flow directioncollect ipv4 idcollect ipv4 source maskcollect ipv4 destination mask

Flexible NetFlowConfig Example - Flow Exporter and Flow Monitorflow exporter NFAexporterdestination 192.16.1.82source loopback0transport udp 9996export-protocol netflow-v9flow monitor NFAmonitorexporter NFAexportercache timeout active 1cache timeout inactive 15record NFArecord or record netflow-originalInterface fastethernet1/2ip flow monitor NFAmonitor input

Flexible NetFlowNetFlow Performance ImpactCPU Utilization 10,000 active flows – 7.14 % additional CPU 65,000 active flows – 22.98 % additional CPUBandwidth Usage Estimate Around 2% to 3% additional bandwidth load on the NetFlowexporting link for the device

Flow Exporting Devices

Supported Devices - CiscoNetFlow supported Cisco devicesSiCisco Catalyst 3560Cisco 800Cisco 7200Cisco Catalyst 3750Cisco 1800Cisco 7600Cisco Catalyst 4500Cisco 1900Cisco 12000Cisco Catalyst 6500Cisco 2800Cisco ASR seriesCisco NexusCisco 3800Cisco ASA firewallCisco 3900

Supported Devices – Other VendorsOther Vendors and Flow Formats sFlow: Alcatel, Brocade – Foundry, Dell, Enterasys, Extreme, Force 10,Fortinet, HP ProCurve, Juniper, Vyatta, etc. http://www.sflow.org/products J-Flow: Juniper devices IPFIX : To be developed as the standard for flow export. Described inRFC 3917. Based on NetFlow v9. AppFlow: Extension to IPFIX for application monitoring. Citrix NetScalercaptures app-specific network data and generates Appflow records NetStream: Huawei / 3COM devices

Some Use Cases

Profile your Network Which links are most utilized and under-utilized Who are the top takers and which are the top applications Understand application usage - Peak and non-peak usage, when,application volume and speed Traffic priorities and QoS performanceTraffic UsageSrc and DstTop AppsApp-wise QoS

Quicker TroubleshootingApplication Slowness – Check link utilization

Quicker TroubleshootingCheck top applications – HTTP more than business application

Quicker TroubleshootingIncorrect priority for business application

Monitoring New-Age Networks Specific IP Traffic header information captured - Low overhead on networkdevices Can work in high speed environments as well as new technologies likeMPLS or 100G networks

Network Security Non Signature based - Hence can detect zero day malware Detects anomalies coming beyond IDS/IPS and firewalls or even thoseoriginating from your LAN network

Network Security

Capacity Planning Decisions Is the bandwidth upgrade necessary? Analyze application usage. Limit or block bandwidth hogging applicationsusing QoS, ACL, etc. Check link utilization and business application distribution over time inlowest possible granularity – 1 minute. Do you still need more bandwidth? Informed decisions with reports to validate leads to higher cost savings

Capacity Planning Decisions

Capacity Planning Decisions

SLA Verification and Billing Verify the Committed Information Rate and Committed Data Rate withyour own usage based reports Generate billing reports and compare with ISP reports For department/project level billing : Account per network Billing based on 5 minute averages and 95th percentile. 95th percentilecan be IN and OUT merged or IN and OUT separate Design In-line with generic ISP based billing solutions

SLA Verification and Billing

SLA Verification and Billing

VoIP Quality IssuesAnalyze Application usage and VoIP Conversations

VoIP Quality Issues Bulk Data scheduled during business hours Both VoIP and bulk data applications under default priority Reschedule bulk data for non peak hours – Get traffic distributionreport over time to know peak and non-peak hours Assign QoS priority for VoIP traffic – Validate QoS policy performancefrom NetFlow conversation reports Study effect of network changes using various reports

SNMP, Packet Sniffing or NetFlow

SNMP, Packet Sniffing or NetFlowAnswering an FAQ SNMP: Basic method Traffic usage information from any SNMP capable device No details - Port, Protocol, IP Address of traffic cannot be seen Negligible overhead on network resources NetFlow: Optimal method Answers WHO, WHAT, WHEN and WHERE question on IP traffic Detailed information. Very less or ignorable overhead on network Packet Sniffing: Advanced and detailed Most detailed and In-depth information Every IP Traffic information captured Requires SPAN - High resource requirements and highly expensive

SNMP, Packet Sniffing or NetFlowWhen to Use? SNMP: No NetFlow available or detailed visibility is not required Accurate bandwidth usage reports is necessary Compare SNMP stats with NetFlow based reports to confirm report accuracy NetFlow: Implement throughout the network, on all supported devices, at all times Proactive reporting and troubleshooting Many use cases Packet Sniffing: Resource and data intensive with huge storage requirements Use in high priority environments like data centers, server farms Keep in standby mode and use when problems require packet level analysis

Conclusion Network uptime is a business requisite To create high performing networks, proactive monitoring is needed Use NetFlow, a non-intrusive, zero network impact technology tokeep a tab on your complete network Cost Savings: Less downtime, Informed decisions, Hold back onWAN optimization & bandwidth upgrades, Secure network Small enterprises: Packet Sniffing is highly expensive. Use SNMPreports and NetFlow Medium and Large enterprises : Proactive monitoring with NetFlow& Packet Sniffing for detailed analysis at packet level

About NetFlow Analyzer

ManageEngine NetFlow Analyzer Solution for bandwidth monitoring, traffic analysis & network forensics Supports flow formats like NetFlow, sFlow, IPFIX, Appflow, etc. Many of Cisco’s major monitoring technologies supported: Cisco NetFlow Cisco Medianet – Perf Monitoring and Mediatrace Cisco CBQoS Cisco NBAR - via SNMP and Flexible NetFlow Cisco IPSLA - VoIP and Data Cisco WAAS reporting

ManageEngine NetFlow Analyzer Additional features:– Network behavior anomaly detection leveraging on Cisco NetFlow– Enhanced reporting on Cisco ASA NSEL flows– Reporting on Autonomous System information from NetFlow data Distributed architecture based enterprise edition available formonitoring more than 250 geo-distributed interfaces or more than 600high traffic interfaces Future enhancements include: Support for more Flexible NetFlow fields,Cisco PfR, Cisco Smart Logging and Telemetry, NBAR2

Questions?Over 4000 enterprises worldwide uses ManageEngineNetFlow Analyzer for traffic analyticsNetFlow Analyzer: www.netflowanalyzer.comTAC Team: netflowanalyzer-support@manageengine.comSales: sales@manageengine.comNetFlow Analyzer Blogs: https://blogs.netflowanalyzer.comUser Forums: http://forums.netflowanalyzer.com

Supported Devices - Cisco SiSi NetFlow supported Cisco devices Cisco Catalyst 3560 Cisco 800 Cisco 7200 Cisco Catalyst 3750 Cisco 1800 Cisco 7600 Cisco Catalyst 4500 Cisco 1900 Cisco 12000 Cisco Catalyst 6500 Cisco 2800 Cisco ASR se

Related Documents:

Cisco 3560 & 3750 NetFlow Configuration Guide Cisco Nexus 7000 NetFlow Configuration Cisco Nexus 1000v NetFlow Configuration Cisco ASR 9000 NetFlow Configuration Appendix. 3 Cisco NetFlow Configuration Cisco IOS NetFlow Configuration Guide Netflow Configuration In configuration mode issue the following to enable NetFlow Export:

Cisco 3560 & 3750 NetFlow Configuration Guide Cisco Nexus 7000 NetFlow Configuration Cisco Nexus 1000v NetFlow Configuration Cisco ASR 9000 NetFlow Configuration Appendix. 8 Cisco NetFlow Configuration Cisco 3560X & 3750X NetFlow Configuration Your software release may not support all the features documented in this module.File Size: 2MB

Configuring NetFlow on a Cisco 6500 Series Switch 148 Configuring NetFlow on a Cisco 6500 Series Switch 150 Configuring NetFlow on Cisco Routers 151 Contents NetFlow Configuration Guide, Cisco IOS Release 12.2SX viii . Configuring NetFlow on Cisco Routers 153 Configuring NetFlow Top Talkers 153

NetFlow-lite Aggregators and collectors can sit anywhere in the network, as long as L3 reachable NetFlow-lite Aggregators are transparent to NetFlow collector (NetFlow collectors receive aggregated flow data as if it's coming directly from the switch) NetFlow collector analyzes & correlates both NetFow and aggregated NetFlow-lite data

Example: Router enable Enteryourpasswordifprompted. configureterminal (Required)Entersglobalconfigurationmode. Example: Router# configure terminal Step 2 NetFlow Configuration Guide, Cisco IOS Release 15M&T 5 Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data How to Configure SNMP and use the NetFlow MIB to Monitor NetFlow Data

May 02, 2018 · D. Program Evaluation ͟The organization has provided a description of the framework for how each program will be evaluated. The framework should include all the elements below: ͟The evaluation methods are cost-effective for the organization ͟Quantitative and qualitative data is being collected (at Basics tier, data collection must have begun)

Aside: Myths about NetFlow Generation 30 Myth #1: NetFlow impacts performance Hardware implemented NetFlow has no performance impact Software implementation is typically significantly 15% processing overhead Myth #2: NetFlow has bandwidth overhead NetFlow is a summary protocol Traffic overhead is typically significantly 1% of

On an exceptional basis, Member States may request UNESCO to provide thé candidates with access to thé platform so they can complète thé form by themselves. Thèse requests must be addressed to esd rize unesco. or by 15 A ril 2021 UNESCO will provide thé nomineewith accessto thé platform via their émail address.

̶The leading indicator of employee engagement is based on the quality of the relationship between employee and supervisor Empower your managers! ̶Help them understand the impact on the organization ̶Share important changes, plan options, tasks, and deadlines ̶Provide key messages and talking points ̶Prepare them to answer employee questions

NetFlow-enabled device. NetFlow builds its cache by processing the first packet of a flow through the standard switching path. It maintains a flow record within the NetFlow cache for all active flows. Each flow record in the NetFlow cache contains key fields, as well as additional non-key fields, that can be used later for exporting data

Flexible NetFlow Configuration Guide, Cisco IOS Release 15.2(3)E and Later (Catalyst 3750-X and 3560-X Switches) 3 Configuring Flexible NetFlow Information About Flexible Netflow . Flexible NetFlow Configuration Guide, Cisco IOS Release 15.2(3)E and Later (Catalyst 3750-X and 3560-X Switches) 17 Configur

NetFlow Cisco Catalyst 6500 NetFlow Collector . Cisco NetFlow Support 20 2011 Lancope , Inc. . Cisco 2800 Cisco 7600 Cisco 1700 Cisco Catalyst 6500 Cisco ASR Cisco 3560/3750-X Cisco ASA Cisco ISR G2 Hardware Supported Cisco Catalyst 4500 . Wide Support for NetFlow Nortel Networks Junip

Chính Văn.- Còn đức Thế tôn thì tuệ giác cực kỳ trong sạch 8: hiện hành bất nhị 9, đạt đến vô tướng 10, đứng vào chỗ đứng của các đức Thế tôn 11, thể hiện tính bình đẳng của các Ngài, đến chỗ không còn chướng ngại 12, giáo pháp không thể khuynh đảo, tâm thức không bị cản trở, cái được

Cisco Catalyst 3560/3750 Standard 3750 and 3560 switches do not support NetFlow. The 3750-X and 3560-X L3 switches only support NetFlow if they have the C3KX-SM-10G Service module; and in this case the only option is using Flexible NetFlow. The tasks involved in creating a Flexible NetFlow configuration are: 1.

NetFlow version 9 or IPFIX format, extracts key information such as src/dst IP address, TCP/UDP port, packet length, etc., it constructs temporary flow cache, extrapolate flow statistics by correlating sampling rate w/ sampled packets, exports aggregated and extrapolated data to NetFlow collectors in standard IPFIX or NetFlow v5/v9 .

NetFlow Configuration Guide, Cisco IOS Release 15M&T 4 Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands How to Configure NetFlow Top Talkers using

The Flexible NetFlow (FnF) is the configuration interface on the router or switch which allows the user to take advantage of NetFlow v9, al-lowing users to configure and customize what information is export-ed in flow records. FnF is perfectly suited to collect VRF IDs required by the company's security policies. In general, Flexible NetFlow con-

topics at Cisco Live, Black Hat, and other customer-facing cyber security conferences. In addition, John contributes to the Cisco Security Portal through the publication of white- . NetFlow v7 Flow Header Format and Flow Record Format 42 NetFlow Version 9 43 NetFlow and IPFIX Comparison 57 Summary 57 Chapter 3 Cisco Flexible NetFlow 59

Software Configuration Guide—Release 12.2(37)SG OL-12524-01 44 Configuring NetFlow This chapter describes how to configure NetFlow Stat istics on the Catalyst 4500 series switches. It also provides guidelines, procedures, and configuration examples. Note To use the NetFlow feature, you must have the Supervisor Engine V-10GE (the functionality is

Le genou de Lucy. Odile Jacob. 1999. Coppens Y. Pré-textes. L’homme préhistorique en morceaux. Eds Odile Jacob. 2011. Costentin J., Delaveau P. Café, thé, chocolat, les bons effets sur le cerveau et pour le corps. Editions Odile Jacob. 2010. Crawford M., Marsh D. The driving force : food in human evolution and the future.