NetFlow: what happens in your network? (@ MUM Ljubljana...

NetFlow:whathappensinyournetwork?

byLorenzoBusatti

1MUM Ljubljana 2016 © Lorenzo Busatti, http://routing.wireless.academy

LorenzoBusatti

• FounderofGrifonline S.r.l.(1997)

• FounderofLinkwave (2006)

• MikroTik Trainer(2010)

• MemberofRIPE,AMS-IX,MIX-IT

MUM Ljubljana 2016 © Lorenzo Busatti, http://routing.wireless.academy 2

Aboutme


Aboutme

I'maMikroTik enthusiast


I'maMikroTik enthusiast


I'maMikroTik evangelist


Aboutme• Founder(2016)ofthe

NonProfitOrganizationforHighQualityTrainingPartners

Advertisingtime!


MyfriendAndrewCoxbookedtoolateforthisMUM,sothepresentationsslotswasalreadyfull.

Ipromisedhimtoquickadvertisehisfantasticproduct(andforfreeJ):

DedicatedtoMax


Thetrafficofyournetwork



Isoneofthemostimportants “things”.



Whatdoyouknowaboutit?



WhatisthegrowthofyourcustomertraffictoNetflix?



WhatarethetopASyoushouldpeerwith?



Whoisthetopbandwidthdrawer?



WithfewtoolsyoucanknowmorethanyoucanImagineJ


NetFlow inpills


• Isa“common”router’sfeature• Collect IPtrafficstatistics• Laterwillexport themto aNetFlow Collector• They’recalled:flowrecord• Theformatistemplatebased(sincethe

Version9):expandableforthefuture

NetFlow inRouterOS


• Yes,issupported!• Iscalled:TrafficFlow(NetFlow it’saCisconaming….)

• He’s“living”there:/ip traffic-flow

• ExistsinceROSv.2.9• TodaysupporttheVersions1,5,9• Checkthewikiforthedifferences….J

TrafficFlowinaction


NetFlowCollector

(andAnalyzer)

YOURWAN

YOURLAN

TheClient

The“Flows”

TwoIngredients


ANetFlowCollector

(andAnalyzer)

The“Flows”

TrafficFlowlimitations


• UptoRouterOS v.6.0willexportonly RXtrafficofaninterface• CurrentlyRouterOS doesnotexportBGPAS

numbersL• Hopetoseeimplementedsoon….J

The“boring”part

(butveryshort….)


Packettransportprotocol


• Therecords areexported using UDP• Thestandardport is the2055(user defined)• Therouterdoes not keep track offlow

records already exported• If aNetFlow packet is dropped all contained

records arelost forever• Doesn’t exportthe“payloads”• Thecontent isn’t encrypted

Generalstructure(v9)


NetFlow Packet header– Template• NetFlow Record 1• NetFlow Record 2• NetFlow Record n– Template• NetFlow Record n +1• NetFlow Record n +2• NetFlow Record n +n

Thepacketheader


• Versionnumber (v1�v5,v7�v8,v9)• Sequence number• Timestamp• Number ofrecords (v5orv8)orlistof

templates andrecords (v9)

TheTemplateformat


• ID• length• FieldCount• Field1Type• Field1Length• Field2Type• Field2Length• FieldN Type• FieldN Length

(some)v9Fields


IN_BYTESOUT_BYTESIN_PKTSOUT_PKTSPROTOCOLSRC_TOSTCP_FLAGSL4_SRC_PORTL4_DST_PORTIPV4_SRC_ADDRIPV4_DST_ADDR

DIRECTIONIPV4_NEXT_HOPIPV6_SRC_ADDRIPV6_DST_ADDRICMP_TYPEIN_SRC_MACIN_DST_MACOUT_DST_MACOUT_SRC_MACSRC_VLANDST_VLAN

SRC_ASDST_ASBGP_IPV4_NEXT_HOPIP_PROTOCOL_VERSIONMPLS_LABEL_(1-10)IF_NAMEIF_DESC

FORWARDINGSTATUS(lots ofsubcodes!!!)

Liveview


Thepacket Header

Liveview


TheTemplate

Liveview


One Flow

Summary

TheTrafficFlowwill“export”almost“everything”excepttheeffective“payload”


Settingup(therouter)


IP–>TrafficFlow


IP–>TrafficFlow- Targets


IP–>TrafficFlow->Status


Howmuchresourceswilltake(theflows)?


TrafficFlow“traffic”

Thereisnotanexact formulatocalculatetheexported“flows”,butI’llshowyoua”live”example.


TrafficFlow“traffic”


The“Flows”

Theroutertraffic

Thesessions

TheNetFlow Collectors(andAnalyzer)


WhatIneednow?• ACollectorwillcollecttheflowsexportedbyyourrouter.

• AnAnalyzer willmakethesedatareadableandusabletoyou.

• MostoftheCollectorsareAnalyzeralso.


Whichone?• Opensource;• Closedsource;• ForWindows;• ForLinux;• OntheCloud;• PaidVsFree;


Examples


Whichone?I’mnotaresellerorasalesrepresentativeofthesebrands.

Searchontheweband“trybeforebuy”(whenpossible).


Whichone?InthispresentationI’llshowyouanexampleusingthecloudservicesprovidedby:

http://polygraph.io


Themostinterestingpart:WhatcanIsee?????


Whichtraffic?Justfewexamples:• Bandwidthmonitoring• ApplicationsUsed• Identifyvisiteddomains• Toptalkers(customersandhost)• Geolocate traffic.• Attacksdetection.


Whichtraffic?• AndsinceRouterOS 6.33the fastpath


“Live”demo


“Live”demo


Youcanalsomakereports,watchandexportthestoreflows,and….....

“Live”demo


Security


ThesecurityisanotherapplicationoftheTrafficFlow.

Mycontentswillstophere,hopeyou’llenjoyadedicatedpresentationthisevening.

Wrapup


üWiththeTrafficFlowandaNetFlowAnalyzeryoucanknowwhathappeninyournetworkandthekindoftrafficexchangedbyyourcustomers

üFromthisprivilegedpointofviewyoucanmanage,planandpreventthe“things”ofyournetwork.

Wrapup


üIhopeyou’lldeploysoonyourprivileged“pointofobservation”J

Thankyou!

Q&A

http://[email protected]


NetFlow: what happens in your network? (@ MUM Ljubljana...

Documents

Transcript of NetFlow: what happens in your network? (@ MUM Ljubljana...