• Enabling NetFlow on a Catalyst 6500

    Configuring NetFlow on Cisco IOS XR Software

    ManageEngine NetFlow Analyzer v8600

    KeyGen -> java -jar xxx.jar

    กำหนดให้อนุญาติการเก็บข้อมูล Flow ที่วิ่งเข้า (ingress) Interface

    Router(config-if)#ip flow ingress

    ดูข้อมูลโดยใช้คำสั่ง show ip cache flow

    Router#sho ip cac flo<br />IP packet size distribution (11215434 total packets):<br />&nbsp;  1-32&nbsp;  64&nbsp;  96&nbsp; 128&nbsp; 160&nbsp; 192&nbsp; 224&nbsp; 256&nbsp; 288&nbsp; 320&nbsp; 352&nbsp; 384&nbsp; 416&nbsp; 448&nbsp; 480<br />&nbsp;  .001 .254 .685 .014 .000 .018 .008 .000 .005 .003 .000 .001 .001 .000 .000<br /><br />&nbsp; &nbsp; 512&nbsp; 544&nbsp; 576 1024 1536 2048 2560 3072 3584 4096 4608<br />&nbsp;  .000 .000 .001 .000 .000 .000 .000 .000 .000 .000 .000<br /><br />IP Flow Switching Cache, 278544 bytes<br />&nbsp; 5 active, 4091 inactive, 3581241 added<br />&nbsp; 59673255 ager polls, 0 flow alloc failures<br />&nbsp; Active flows timeout in 30 minutes<br />&nbsp; Inactive flows timeout in 15 seconds<br />IP Sub Flow Cache, 25800 bytes<br />&nbsp; 5 active, 1019 inactive, 3581241 added, 3581241 added to flow<br />&nbsp; 0 alloc failures, 0 force free<br />&nbsp; 1 chunk, 2 chunks added<br />&nbsp; last clearing of statistics never<br />Protocol&nbsp; &nbsp; &nbsp; &nbsp;  Total&nbsp; &nbsp; Flows&nbsp;  Packets Bytes&nbsp; Packets Active(Sec) Idle(Sec)<br />--------&nbsp; &nbsp; &nbsp; &nbsp;  Flows&nbsp; &nbsp;  /Sec&nbsp; &nbsp;  /Flow&nbsp; /Pkt&nbsp; &nbsp;  /Sec&nbsp; &nbsp;  /Flow&nbsp; &nbsp;  /Flow<br />TCP-other&nbsp; &nbsp; &nbsp;  340168&nbsp; &nbsp; &nbsp; 0.0&nbsp; &nbsp; &nbsp; &nbsp;  2&nbsp; &nbsp; 53&nbsp; &nbsp; &nbsp; 0.1&nbsp; &nbsp; &nbsp;  1.3&nbsp; &nbsp; &nbsp; 13.4<br />UDP-DNS&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  1495&nbsp; &nbsp; &nbsp; 0.0&nbsp; &nbsp; &nbsp; &nbsp;  1&nbsp; &nbsp; 64&nbsp; &nbsp; &nbsp; 0.0&nbsp; &nbsp; &nbsp;  0.0&nbsp; &nbsp; &nbsp; 15.5<br />UDP-other&nbsp; &nbsp; &nbsp;  872145&nbsp; &nbsp; &nbsp; 0.2&nbsp; &nbsp; &nbsp; &nbsp;  8&nbsp; &nbsp; 76&nbsp; &nbsp; &nbsp; 1.6&nbsp; &nbsp; &nbsp;  0.2&nbsp; &nbsp; &nbsp; 15.4<br />Total:&nbsp; &nbsp; &nbsp; &nbsp;  1213808&nbsp; &nbsp; &nbsp; 0.2&nbsp; &nbsp; &nbsp; &nbsp;  3&nbsp; &nbsp; 77&nbsp; &nbsp; &nbsp; 1.7&nbsp; &nbsp; &nbsp;  0.7&nbsp; &nbsp; &nbsp; 15.5<br /><br />SrcIf&nbsp; &nbsp; &nbsp; &nbsp;  SrcIPaddress&nbsp; &nbsp; DstIf&nbsp; &nbsp; &nbsp; &nbsp;  DstIPaddress&nbsp; &nbsp; Pr SrcP DstP&nbsp; Pkts<br />Fa0/1&nbsp; &nbsp; &nbsp; &nbsp;; &nbsp;  Local&nbsp; &nbsp; &nbsp; &nbsp;;  01 0000 0800&nbsp; 1755 <br />Fa0/1&nbsp; &nbsp; &nbsp; &nbsp;; &nbsp;  Local&nbsp; &nbsp; &nbsp; &nbsp;;  01 0000 0800&nbsp; 1753 <br />Fa0/1&nbsp; &nbsp; &nbsp; &nbsp;; &nbsp; &nbsp; Local&nbsp; &nbsp; &nbsp; &nbsp;;  11 103C 00A1&nbsp; &nbsp;  1 <br />Fa0/1&nbsp; &nbsp; &nbsp; &nbsp;; &nbsp;  Local&nbsp; &nbsp; &nbsp; &nbsp;;  06 E430 0016&nbsp; &nbsp; 41

    • [li]IP packet size distribution จะเป็นการบอกจำนวน Packet ที่ขนาดต่างๆ[/li]
      [li]IP Flow Switching Cache จะบอกจำนวนไบท์ทั้งหมดของ Flow ที่ถูกดักจับได้ รวมถึงบอกรายละเอียดของข้อกำหนด Flow เช่น Inactive flow จะมีเวลาในการเกิด timeout 15 วินาที และ ความยาวของ flow ที่ active จะไม่เกิน 30 นาที[/li]
      [li]IP Sub Flow Cache จะบอกจำนวนไบท์ทั้งหมดจาก Sub Flow[/li]
      [li]Protocol จะบอกว่าการดักจับพบ Protocol อะไรบ้างและรายละเอียดการทำงานเป็นอย่างไร[/li]
      [li]ส่วนสุดท้ายจะบอกรายละเอียดของข้อมูล IP/Port ของ Packet ที่ดักจับได้จาก interface f0/1[/li]

    Introduction to Accounting Principles with NetFlow and NBAR

    Why do We Need Accounting?


    Accounting Reports - Business Justification


    Bandwidth/Capacity Reports
    • [li]What is eating up my network resources?[/li]
      [li]When do I need a capacity upgrade?[/li]
      [li]What is causing congestion?[/li]

    Subscriber Demographic Reports
    • [li]What percentage is using P2P/gaming application?[/li]
      [li]What are the usage patterns of different subscriber groups?[/li]
      [li]What is the cost impact of my top subscribers?[/li]

    Server Activity
    • [li]What are the popular Web hosts used?[/li]
      [li]What are the popular streaming sites?[/li]

    Voice Reports
    • [li]Quality of experience of VoIP calls[/li]
      [li]Minutes spent on VoIP services[/li]
      [li]Total and concurrent calls per VoIP service[/li]
      [li]Compare managed vs. non-facility service[/li]

    Security Reports
    • [li]Which subscribers are infected and attacking others?[/li]
      [li]Which subscribers are spamming?[/li]
      [li]Which subscriber is attacking network resources?[/li]

    Accounting Architecture:

    The Theory


    The Reality


    Distinguish Between Accounting and Billing


    Why NetFlow?


    Network Operation
    • [li]Capacity Planning[/li]
      [li]Historic Data Collection and Trend Analysis[/li]
      [li]Network Performance Analysis[/li]
      [li]Unified Visibility Across Networks[/li]

    Security Operation
    • [li]Real-time Anomaly Behavior Monitoring[/li]
      [li]Eliminate Network Blind Spots[/li]
      [li]Reduce Time, Cost, and Complexity for Threat Detection and Response[/li]

    • [li]Provides User Accountability[/li]
      [li]Supplies Risk Measurability and Reporting[/li]
      [li]Enables Industry and Government Regulations: PCI, HIPAA, SCA.5DA, SOX, etc.[/li]

    Typical NetFlow Deployment


    NetFlow Architecture


    What Is a Traditional IP Flow?

    [list type=decimal][li]Inspect a packet's seven key fields and identify the values[/li]
    [li]If the set of key field values is unique create a flow record or cache entry[/li]
    [li]When the flow terminates export the flow to the collector[/li][/list]
    NetFlow Key Fields Creating Flow Records

    [list type=decimal][li]Inspect packet for key field values[/li]
    [li]Compare set of values to NetFlow cache[/li]
    [li]If the set of values are unique create a flow in cache[/li]
    [li]Inspect the next packet[/li][/list]
    There are Four Types of NetFlow Fields
    • [li]Key fields
      Key fields define the flow record
      An attribute in the packet used to create a flow record
      If the set of key field values is unique a new flow is created[/li]
      [li]Non-key fields
      These are used not to define a flow, instead they provide additional information[/li]
      [li]Value fields
      These are additional fields and counters, such as packet and byte counter, start and stop time stamps[/li]
      [li]Lookup fields
      These are additional information that are added to the flow, such as next hop address, source/destination AS number, etc.[/li]

    Traditional Layer 3 NetFlow Cache


    NetFlow Processing Order
    [list type=decimal][li]Pre-Processing
    • [li]Packet Sampling[/li]
    [li]Features and Services
    • [li]IPv4[/li]
    • [li]Aggregation[/li]
      [li]Non-key fields lookup[/li]
    Comprehensive Hardware Support
    • [li]Not Supported Access Switches 37xx, 36xx, 35xx, 29xx[/li]
      [li]Enterprise and Aggregation/Edge
      Cisco IOS Software Release 12.2S
      Cisco 7200/7500, 7300 Series
      Cisco 4500, 10000, 7600 Series ASIC
      Cisco Catalyst 6500[/li]
      Release 12.0S/Cisco IOS-XR
      Cisco 12000 Series ASIC
      CRS-1 ASIC[/li]
      Cisco IOS Software Releases T Train
      Cisco 800, 1700, 1800, 2600, 2800, 3700, 3800, 7200/7300 Series[/li]

    NetFlow Versions
    [table][tr][td]NetFlow Version[/td][td]Comments[/td][/tr]
    [tr][td]5[/td][td]Most Common Version[/td][/tr]
    [tr][td]7[/td][td]Specific to Cisco Catalyst 6500 and 7600 Series Switches
    Similar to Version 5, but Does Not Include AS, Interface, TCP Flag, and ToS Information[/td][/tr]
    [tr][td]8[/td][td]Choice 11 Aggregation Schemes
    Reduces Resource Usage[/td][/tr]
    [tr][td]9[/td][td]Flexible, Extensible File Export Format to Enable Easier
    Support of Additional Fields and Technologies; Coming Out
    Now MPLS, Multicast, and BGP Next Hop[/td][/tr][/table]

    Version 5 - Fixed Export Format

    • [li]Packet count[/li]
      [li]Byte count[/li]

    Time of Day
    • [li]Start sysUpTime[/li]
      [li]End sysUpTime[/li]

    Port Utilization
    • [li]Input ifIndex[/li]
      [li]Output ifIndex[/li]

    • [li]Type of service[/li]
      [li]TCP flags[/li]

    • [li]Source IP address[/li]
      [li]Destination IP address[/li]

    • [li]Source TCP/UDP port[/li]
      [li]Destination TCP/UDP port[/li]

    Routing and Peering
    • [li]Next hop address[/li]
      [li]Source AS number[/li]
      [li]Dest. AS number[/li]
      [li]Source prefix mask[/li]
      [li]Dest. prefix mask[/li]

    Version 5 is still used extensively

    Version 8 - Fixed Aggregation Format
    • [li]Router-based aggregation[/li]
      [li]Enables router to summarize NetFlow data[/li]
      [li]Reduces NetFlow export data volume[/li]
      [li]Decreases NetFlow export bandwidth requirements[/li]
      [li]Currently 11 aggregation schemes
      Five original schemes
      Six new schemes with the ToS byte field[/li]
      [li]Several aggregations can be enabled simultaneously[/li]

    Note: NetFlow version 9 can be used for router-based aggregation and is recommended if the collector supports v9

    Extensibility and Flexibility Phases Approach
    • [li]Why a new export protocol?
      Build a flexible and extensible export format
      Advantage: able to add new technologies/data types very quickly Example: MPLS, IPv6, BGP next hop, multicast, etc.[/li]
      [li]NetFlow Version 9
      New concept: template records, data records
      Advantages: extensibility
      Integrate new technologies/data types quicker
      Integrate new aggregations quicker[/li]

    Template Record - Example


    Data Record - Example


    NetFlow v9 Export Packet

    • [li]Matching ID numbers are the way to associate template to the data records[/li]
      [li]The header follows the same format as prior NetFlow versions so collectors will be backward compatible[/li]
      [li]Each data record represents one flow[/li]
      [li]If exported flows have different fields, they cannot be contained in the same template record (i.e., BGP next hop cannot be combined with MPLS-aware, NetFlow records)[/li]

    IETF: IP Flow Information Export WG (IPFIX)
    • [li]IPFIX protocol specifications
      Changes in terminology but same NetFlow Version 9 principles
      Improvements vs. NetFlow version 9: SCTP-PR, security, variable length information element, IANA registration, etc.
      Generic streaming protocol, not flow-centric anymore
        Threat: confidentiality, integrity, authorization
        Solution: DTLS on SCTP-PR[/li]
      [li]IPFIX information model
      Most NetFlow version 9 information elements ID are kept
      Proprietary information element specification[/li]
      [li]Is IPFIX important to you?[/li]
      [li]RFC3954 "Cisco Systems NetFlow Services Export Version 9"[/li]
      [li]RFC3917 "Requirements for IP Flow Information Export"[/li]
      [li]RFC3955 "Evaluation of Candidate Protocols for IPFIX"[/li]
      [li]RFC5101 "Specification of the IPFIX Protocol for the Exchange of IP Traffic Flow Information"[/li]
      [li]RFC5102 "Information Model for IP Flow Information Export"[/li]
      [li]RFC5103 "Bidirectional Flow Export using IP Flow Information Export (IPFIX)"[/li]

    NetFlow Configuration Commands (Software Platforms)
    • [li]Configure Cisco Express Forward (CEF) Switching
      ip cef[/li]
      [li]Configure NetFlow per interface - NetFlow Collects Flows
      ip flow ingress
      (or ip route-cache flow) - Older Cisco IOS Versions Use This Command, Hidden in 12.4 and 12.4T[/li]
      [li]Configure the export version - Set Export Packet Format
      i.e., ip flow-export Version 5
      ip flow-export version <version> [origin as|peer-as|bgp-nexthop][/li]
      [li]Configure the export destination - Optional for Collector
      i.e., ip flow-export destination 65001
      ip flow-export destination <address> <port>[/li]
      [li]Interface to define export devices, usually a loopback - Enables Collector to Identify the Exporting Device
      ip flow-export source <interface>[/li]