NetFlow: what happens in your network? (@ MUM Ljubljana...

NetFlow:whathappensinyournetwork?

byLorenzoBusatti

1MUM Ljubljana 2016 © Lorenzo Busatti, http://routing.wireless.academy

LorenzoBusatti

• FounderofGrifonline S.r.l.(1997)

• FounderofLinkwave (2006)

• MikroTik Trainer(2010)

• MemberofRIPE,AMS-IX,MIX-IT

MUM Ljubljana 2016 © Lorenzo Busatti, http://routing.wireless.academy 2

Aboutme

I'maMikroTik enthusiast

I'maMikroTik evangelist

Aboutme• Founder(2016)ofthe

NonProfitOrganizationforHighQualityTrainingPartners

Advertisingtime!

MyfriendAndrewCoxbookedtoolateforthisMUM,sothepresentationsslotswasalreadyfull.

Ipromisedhimtoquickadvertisehisfantasticproduct(andforfreeJ):

DedicatedtoMax

Thetrafficofyournetwork

Isoneofthemostimportants “things”.

Whatdoyouknowaboutit?

WhatisthegrowthofyourcustomertraffictoNetflix?

WhatarethetopASyoushouldpeerwith?

Whoisthetopbandwidthdrawer?

WithfewtoolsyoucanknowmorethanyoucanImagineJ

NetFlow inpills

• Isa“common”router’sfeature• Collect IPtrafficstatistics• Laterwillexport themto aNetFlow Collector• They’recalled:flowrecord• Theformatistemplatebased(sincethe

Version9):expandableforthefuture

NetFlow inRouterOS

• Yes,issupported!• Iscalled:TrafficFlow(NetFlow it’saCisconaming….)

• He’s“living”there:/ip traffic-flow

• ExistsinceROSv.2.9• TodaysupporttheVersions1,5,9• Checkthewikiforthedifferences….J

TrafficFlowinaction

NetFlowCollector

(andAnalyzer)

YOURWAN

YOURLAN

TheClient

The“Flows”

TwoIngredients

ANetFlowCollector

(andAnalyzer)

The“Flows”

TrafficFlowlimitations

• UptoRouterOS v.6.0willexportonly RXtrafficofaninterface• CurrentlyRouterOS doesnotexportBGPAS

numbersL• Hopetoseeimplementedsoon….J

The“boring”part

(butveryshort….)

Packettransportprotocol

• Therecords areexported using UDP• Thestandardport is the2055(user defined)• Therouterdoes not keep track offlow

records already exported• If aNetFlow packet is dropped all contained

records arelost forever• Doesn’t exportthe“payloads”• Thecontent isn’t encrypted

Generalstructure(v9)

NetFlow Packet header– Template• NetFlow Record 1• NetFlow Record 2• NetFlow Record n– Template• NetFlow Record n +1• NetFlow Record n +2• NetFlow Record n +n

Thepacketheader

• Versionnumber (v1�v5,v7�v8,v9)• Sequence number• Timestamp• Number ofrecords (v5orv8)orlistof

templates andrecords (v9)

TheTemplateformat

• ID• length• FieldCount• Field1Type• Field1Length• Field2Type• Field2Length• FieldN Type• FieldN Length

(some)v9Fields

IN_BYTESOUT_BYTESIN_PKTSOUT_PKTSPROTOCOLSRC_TOSTCP_FLAGSL4_SRC_PORTL4_DST_PORTIPV4_SRC_ADDRIPV4_DST_ADDR

DIRECTIONIPV4_NEXT_HOPIPV6_SRC_ADDRIPV6_DST_ADDRICMP_TYPEIN_SRC_MACIN_DST_MACOUT_DST_MACOUT_SRC_MACSRC_VLANDST_VLAN

SRC_ASDST_ASBGP_IPV4_NEXT_HOPIP_PROTOCOL_VERSIONMPLS_LABEL_(1-10)IF_NAMEIF_DESC

FORWARDINGSTATUS(lots ofsubcodes!!!)

Liveview

Thepacket Header

Liveview

TheTemplate

Liveview

One Flow

Summary

TheTrafficFlowwill“export”almost“everything”excepttheeffective“payload”

Settingup(therouter)

IP–>TrafficFlow

IP–>TrafficFlow- Targets

IP–>TrafficFlow->Status

Howmuchresourceswilltake(theflows)?

TrafficFlow“traffic”

Thereisnotanexact formulatocalculatetheexported“flows”,butI’llshowyoua”live”example.

TrafficFlow“traffic”

The“Flows”

Theroutertraffic

Thesessions

TheNetFlow Collectors(andAnalyzer)

WhatIneednow?• ACollectorwillcollecttheflowsexportedbyyourrouter.

• AnAnalyzer willmakethesedatareadableandusabletoyou.

• MostoftheCollectorsareAnalyzeralso.

Whichone?• Opensource;• Closedsource;• ForWindows;• ForLinux;• OntheCloud;• PaidVsFree;

Examples

Whichone?I’mnotaresellerorasalesrepresentativeofthesebrands.

Searchontheweband“trybeforebuy”(whenpossible).

Whichone?InthispresentationI’llshowyouanexampleusingthecloudservicesprovidedby:

http://polygraph.io

Themostinterestingpart:WhatcanIsee?????

Whichtraffic?Justfewexamples:• Bandwidthmonitoring• ApplicationsUsed• Identifyvisiteddomains• Toptalkers(customersandhost)• Geolocate traffic.• Attacksdetection.

Whichtraffic?• AndsinceRouterOS 6.33the fastpath

“Live”demo

Youcanalsomakereports,watchandexportthestoreflows,and….....

“Live”demo

Security

ThesecurityisanotherapplicationoftheTrafficFlow.

Mycontentswillstophere,hopeyou’llenjoyadedicatedpresentationthisevening.

Wrapup

üWiththeTrafficFlowandaNetFlowAnalyzeryoucanknowwhathappeninyournetworkandthekindoftrafficexchangedbyyourcustomers

üFromthisprivilegedpointofviewyoucanmanage,planandpreventthe“things”ofyournetwork.

Wrapup

üIhopeyou’lldeploysoonyourprivileged“pointofobservation”J

Thankyou!

http://training.grifonline.ittraining@grifonline.it

NetFlow: what happens in your network? (@ MUM Ljubljana...

Documents

Transcript of NetFlow: what happens in your network? (@ MUM Ljubljana...

Network Operations Analytics - NetFlow Logic · Network Operations Analytics (NFI Module) NetFlow Integrator 2.4.4.0 NetFlow Integrator Module. This component contains analytics for

NetFlow Configuration Guide

MikroTik MUM Slovenia 2016 Brian Horn WISP …mum.mikrotik.com/presentations/EU16/presentation... · Document Do you have a documentation standard? Now would be a good time to implement

Configuring SNMP and using the NetFlow MIB to Monitor ......Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlowisatechnologythatprovideshighlygranularper-flowstatisticsontrafficinaCiscorouter.The

AdventNet ManageEngine NetFlow Anayzer :: Help Docuementationmanageengine.pt/products/netflow/NetFlowAnalyzer_UserGuide.pdf · AdventNet ManageEngine NetFlow Anayzer :: Help Docuementation

Netflow analyzer- Datasheet

Cisco IOS NetFlow

Scrutinizer NetFlow & sFlow Analyzer · Scrutinizer NetFlow and sFlow Analysis Scrutinizer is a NetFlow and sFlow analyzer that provides incredibly det ailed network utilization information

Scrutinizer NetFlow & sFlowAnalyzer · Scrutinizer NetFlow and sFlowAnalysis Scrutinizer is a NetFlow and sFlow analyzer that provides incredibly detailed network utilization information

NetFlow Optimizer™ · o Cisco ASA o Cisco devices generating AVC ... NetFlow v5/v9, Flexible NetFlow, NetFlow Options, IPFIX, sFlow (both data records and counter records), J-Flow,

Netflow(6500 Specific)

NetFlow Feature

Configuring NetFlow Aggregation Caches · Configuring NetFlow Aggregation Caches ThismodulecontainsinformationaboutandinstructionsforconfiguringNetFlowaggregationcaches.The ...

NetFlow Optimizer™

How to Get NetFlow from Cisco 3750s and Other Non-NetFlow … · StealthWatch NetFlow Replicator • Dedicated NetFlow replication appliance • Designed to copy and redistribute

AlienVault NetFlow Collection

ManageEngine NetFlow Analyzer - Professional Edition · ManageEngine NetFlow Analyzer – Professional Edition 5 Zoho Corporation Introduction ManageEngine NetFlow Analyzer is a web-based

Configuring NetFlow and NDE - CiscoChapter 56 Configuring NetFlow and NDE Understanding How NetFlow and NDE Work • NetFlow and NDE on the PFC, page 56-2 NetFlow and NDE Overview

NetFlow Integrator Standard · NetFlow Integrator Standard Edition Administrators Guide NetFlow Logic Confidential 3 Overview How NetFlow Integrator Works NetFlow Integrator (NFI)

Flexible NetFlow - Cisco · 10 Flexible NetFlow collect. collect counter Toconfigurethenumberofbytesorpacketsinaflowasanon …