Download
1 / 30
300 likes | 511 Vues
Practical use of Netflow technology. Ivan Ivanovic, RCUB/AMRES Géant3, Skopje, September 2011. Content. Netflow technology Configuration of netflow Data duplication Timers Data aggregation How to solve L2 problem Netflow probes Future of netflow Case study.
E N D
Practical use of Netflow technology Ivan Ivanovic, RCUB/AMRES Géant3, Skopje, September 2011.
Content Netflow technology Configuration of netflow Data duplication Timers Data aggregation How to solve L2 problem Netflow probes Future of netflow Case study
Netflow Technology – Terminology What is flow? Src/dst IP Src/dst ports Protocol QoS Total bytes, packets, fllows BGP src/dst AS Exporter ip In/out ports Timestamp …. …. Flow NetFlow statistic Router (Exporter)
Netflow Technology – Overview • Developed by Cisco • IETF standardization – IPFIX. • Netflow V5 and V9 are commonly used. • By default provide us information on the higher levels (L3-L4). • IPFIX (netflow V9) – Also called flexible netflow. • Netflow V9 has support for mpls, mac and IPV6… • In AMRES netflow is only protocol used for IPV6 monitoring. • Other vendors also support netflow protocol (netstream, jflow…). • Less than 1% of total traffic in network
How to start NetFlow data collection? • Most of the routers that are forwarding packets “in software” support NetFlow protocol. • Some of the switches support NetFlow protocol (Require specialized hardware) • Two groups of dvices regarding NetFlow configuration • Global control (older devices, in direction is commonly used) • Per interface control (newer devices, in or out direction can be used) • Globaly controlled allows statistic collecton only on all interfaces in one direction (commonly in/ingress) • Per interface control allows statistic collecton on the interface in in/ingress or out/egress direction.
NetFlow data duplication - Ingrees direction Host A NetFlow Collector
Netflow data duplication - Ingrees direction Gi0/3 Gi0/2 Gi0/1 Gi0/1 Host A
Netflow data duplication - Solution • Problem can be solved if device can control collection of netflow statistic per interface. • Using Ingress/Egress commands we can control collection of netflow statistic. • Some of the applications that collect netflow statistic have capabilities to automatically detect duplicated netflow statistic using combination of exported fields (src ip, dst ip , src port, dst port, protocol, QoS). • Applications (collectors) that support filtering based on static netflow fields provide very good solution against data duplication. • ICmyNet.Flow - http://netflow.rcub.bg.ac.rs
Netflow data duplication - Solution • Don’t use netflow statistic that has exporter ip address of device R2 and ingress interface Gi0/1 of device R2! Ignore this statistic Use this statistic Gi0/1 Gi0/1 Host A Host B
Netflow data duplication - Solution • Don’t use netlfow statistic that has exporter ip address of device R1 and in interface Gi0/1 of device R1! Ignore this statistic Use this statistic Gi0/1 Gi0/1 Host A Host B
Netflow Timers and Aggregation • Most people don't use them. • Some of the applications for netflow collection doesn't use timestamp fields in exported statistic. • Reasons for that are large amount of netflow data, solution is data aggregation. • Benefits of using aggregation are small databases and fast applications. • Shortcomings of using aggregation is lack of detail information. • What are netflow timers (aging)? • E.g. Cisco • Normal • Long • Fast (threshold ~100packets)
Netflow Timers – Long aging • Receiving application is using 5 minute aggregation
Netflow Timers – Fast aging(If your application can detect attack!)
Netflow timers • Exporter is collecting netflow statistic in local memory. • When memory table gets overloaded exporter ages out all flows in the memory. Then exporter sends all information to the collector and clears local memory • Special situation can cause memory overload: • Ping sweep • DNS lookups • Exporter can easily detect end of flows that use connection oriented protocol. • Exporter can only assume when flow, that use connectionless protocol, ended. • Memory overloading can have influence to the exporter behavior. • Using timers is the only way to age out some flows!
Netflow Probes • Very useful tool! • Lot of useful information can be found on the web page of the Swiss academic network • http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html • What is netflow probe? • How to use it? • Where to use it? • What do I get? • What do I lose?
Netflow Probe - L2 segment of the network! • L2 switches usually do not support netflow protocol. • L2 switches usually support port mirroring (SPAN)! • E.g. softflowd • http://www.mindrot.org/projects/softflowd/ • http://code.google.com/p/softflowd/
Netflow Probe – Port mirroring • Extra server (desktop pc). • Two Nic cards. • Two ports on the switch. eth1 eth0
Netflow Probe – Port mirroring • Institutions on the L2 segment.
Netflow Probe – Virtualization • Tested on Citrix XenServer • Older version of VmWare (3.5) support netflow protocol. eth0 eth0 eth0 eth0
Future of netflow • More and more netflow fields are becoming popular • Cisco is already using netflow to gather statistic about media traffic (Medianet) • Information’s like jitter, packet delay, packet loss could be also exported via netflow.
