Autonomous NetFlow Probe

Size: px
Start display at page:

Download "Autonomous NetFlow Probe"

Transcription

1 Autonomous Ladislav Lhotka Martin Žádník TF-CSIRT meeting, September 15, 2005

2 Outline 1 2 Specification Hardware Firmware Software 3 4 Short-term fixes Test Plan Phase 2 5

3 Outline 1 2 Specification Hardware Firmware Software 3 4 Short-term fixes Test Plan Phase 2 5

4 NetFlow version 9 defined in RFC 3954 (informational) flexible and extensible templates for data and options supports IPv6 independent of transport protocol (UDP, TCP, SCTP) basis for future IETF protocol (IPFIX)

5 Traditional Setup exporter collector BUT: your router may not support NetFlow v9 (or you:-) router is an L3 system vulnerable fixed set of templates rigid sampling schemes

6 Autonomous Probe probe exporter collector

7 Advantages stealth device no access to NetFlow v9 aware router needed additional flexibility: finer control of export data user-defined templates adaptive sampling pre-processing data in hardware correlation with other monitoring sources

8 Disadvantages routers see more traffic some data fields don t make sense (next hops) AS information can be supplied by running BGP

9 Outline Specification Hardware Firmware Software 1 2 Specification Hardware Firmware Software 3 4 Short-term fixes Test Plan Phase 2 5

10 Phase 1 Specification Specification Hardware Firmware Software Linux PC with hardware accelerator T-splitter with Gigabit Ethernet interfaces operate at 1 Gbps line rate (one-way) simultaneous monitoring of IPv4 and IPv6 NetFlow version 9 output cache for 64K flows user-configurable active and inactive timeout

11 The Hardware Specification Hardware Firmware Software COMBO6 motherboard connected to PCI COMBO-4MTX interface card with 4 metallic Gigabit Ethernet ports Both cards were developed for Liberouter/6NET project and used in SCAMPI Other interface card can also be used, e.g., COMBO6-4SFP with SFP transceivers

12 Specification Hardware Firmware Software Lhotka, Z a dnı k COMBO6

13 Specification Hardware Firmware Software COMBO6+COMBO-4MTX Lhotka, Z a dnı k

14 Firmware features Specification Hardware Firmware Software cache for 64 Kflows hash function: CRC-64 with random initialization probability of flow collision 10 4 configurable timeouts: active s inactive 0 60s maskable key fields 50 MHz clock rate theoretical throughput limit 800 Mb/s (will be increased to 100 MHz soon)

15 Block Diagram Specification Hardware Firmware Software 1 Gb/s IBUF hash mem. hash FIFO active records empty items export HFE HASH HSRCH MAN SCTRL statistical FIFO

16 Device driver Specification Hardware Firmware Software module for Linux kernel flow records transferred in chunks via PCI DMA applications share a single physical memory area with flow records common ring buffer applications may lock multiple records zero copy (records mapped directly into the app. memory area) applications access the driver through a library (libcsflow) contains common functions aids debugging of applications

17 Exporter Specification Hardware Firmware Software generates valid NetFlow v9 data (RFC 3954) supports 8 templates: TCP, UDP, ICMP, OTHER for both IPv4 and IPv6 configurable period of re-sending templates Current limitations (to be removed): single collector bugs (bogus IPv6 byte counts,...)

18 Outline 1 2 Specification Hardware Firmware Software 3 4 Short-term fixes Test Plan Phase 2 5

19 Tests with FTAS collector live IPv4/IPv6 traffic from a large campus peak rate 14 Kflows/s collector software: FTAS by Tom Košňar results look reasonable

20 Performance Limiting factors small packets: HFE (415 Kpackets) big packets: system throughput due to 50 MHz clock (735 Mb/s)

21 Outline Short-term fixes Test Plan Phase Specification Hardware Firmware Software 3 4 Short-term fixes Test Plan Phase 2 5

22 Pending improvements Short-term fixes Test Plan Phase Gb/s line rate really soon 100 MHz clock Optimized HFE design is ready for testing 2 Finish the exporter NetFlow v9 options & option templates arbitrary number of collectors probe control IPv6 transport debugging

23 Planned tests for GN2/JRA2 Short-term fixes Test Plan Phase 2 CESNET ordered and will cover manufacturing expenses for 5 pcs of COMBO6+COMBO-4MTX (available in October)... and will lend them to interested JRA2 partners and provide support for installation and operation Recommended setup: connect to a dedicated switch port mirror traffic from other port(s) The device should be tested with various collectors heavy traffic loads real-life IPv4 and IPv6 traffic mix

24 Phase 2 Plans Short-term fixes Test Plan Phase 2 new motherboards COMBO6X for 64/66 PCI and PCI-X COMBO6E for Express PCI new interface cards special NetFlow version with more static RAM support for STM-16 10GE issue with 10 Gbps Phyters 1,6 Gb/s throughput 1 million flows more flexible records (MAC addr., VLAN tags) standard sampling sample and hold

25 Further Options Short-term fixes Test Plan Phase 2 adaptive sampling flow counting extension (Estan et al., SIGCOMM04) Combination with other functions: packet filtering payload scanning IPFIX implementation????

26 Outline 1 2 Specification Hardware Firmware Software 3 4 Short-term fixes Test Plan Phase 2 5

27 The results look promising so far. In combination with existing collectors it can be useful now and for various purposes. CESNET is looking for a commercial partner to finalize it as a product. A lot of room for improvements and further research. Source code for software and firmware available from our CVS: Guinea pigs needed!

28 The results look promising so far. In combination with existing collectors it can be useful now and for various purposes. CESNET is looking for a commercial partner to finalize it as a product. A lot of room for improvements and further research. Source code for software and firmware available from our CVS: Guinea pigs needed!

29 The results look promising so far. In combination with existing collectors it can be useful now and for various purposes. CESNET is looking for a commercial partner to finalize it as a product. A lot of room for improvements and further research. Source code for software and firmware available from our CVS: Guinea pigs needed!

30 The results look promising so far. In combination with existing collectors it can be useful now and for various purposes. CESNET is looking for a commercial partner to finalize it as a product. A lot of room for improvements and further research. Source code for software and firmware available from our CVS: Guinea pigs needed!

31 The results look promising so far. In combination with existing collectors it can be useful now and for various purposes. CESNET is looking for a commercial partner to finalize it as a product. A lot of room for improvements and further research. Source code for software and firmware available from our CVS: Guinea pigs needed!

32 The results look promising so far. In combination with existing collectors it can be useful now and for various purposes. CESNET is looking for a commercial partner to finalize it as a product. A lot of room for improvements and further research. Source code for software and firmware available from our CVS: Guinea pigs needed!

HANIC 100G: Hardware accelerator for 100 Gbps network traffic monitoring

HANIC 100G: Hardware accelerator for 100 Gbps network traffic monitoring CESNET Technical Report 2/2014 HANIC 100G: Hardware accelerator for 100 Gbps network traffic monitoring VIKTOR PUš, LUKÁš KEKELY, MARTIN ŠPINLER, VÁCLAV HUMMEL, JAN PALIČKA Received 3. 10. 2014 Abstract

More information

NetFlow probe on NetFPGA

NetFlow probe on NetFPGA Verze #1.00, 2008-12-12 NetFlow probe on NetFPGA Introduction With ever-growing volume of data being transferred over the Internet, the need for reliable monitoring becomes more urgent. Monitoring devices

More information

Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX

Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX Martin Elich 1,3, Matěj Grégr 1,2 and Pavel Čeleda1,3 1 CESNET, z.s.p.o., Prague, Czech Republic 2 Brno University of Technology,

More information

Scalable Extraction, Aggregation, and Response to Network Intelligence

Scalable Extraction, Aggregation, and Response to Network Intelligence Scalable Extraction, Aggregation, and Response to Network Intelligence Agenda Explain the two major limitations of using Netflow for Network Monitoring Scalability and Visibility How to resolve these issues

More information

Open Flow Controller and Switch Datasheet

Open Flow Controller and Switch Datasheet Open Flow Controller and Switch Datasheet California State University Chico Alan Braithwaite Spring 2013 Block Diagram Figure 1. High Level Block Diagram The project will consist of a network development

More information

High-Density Network Flow Monitoring

High-Density Network Flow Monitoring Petr Velan petr.velan@cesnet.cz High-Density Network Flow Monitoring IM2015 12 May 2015, Ottawa Motivation What is high-density flow monitoring? Monitor high traffic in as little rack units as possible

More information

Performance of Software Switching

Performance of Software Switching Performance of Software Switching Based on papers in IEEE HPSR 2011 and IFIP/ACM Performance 2011 Nuutti Varis, Jukka Manner Department of Communications and Networking (COMNET) Agenda Motivation Performance

More information

OpenFlow with Intel 82599. Voravit Tanyingyong, Markus Hidell, Peter Sjödin

OpenFlow with Intel 82599. Voravit Tanyingyong, Markus Hidell, Peter Sjödin OpenFlow with Intel 82599 Voravit Tanyingyong, Markus Hidell, Peter Sjödin Outline Background Goal Design Experiment and Evaluation Conclusion OpenFlow SW HW Open up commercial network hardware for experiment

More information

Wireshark in a Multi-Core Environment Using Hardware Acceleration Presenter: Pete Sanders, Napatech Inc. Sharkfest 2009 Stanford University

Wireshark in a Multi-Core Environment Using Hardware Acceleration Presenter: Pete Sanders, Napatech Inc. Sharkfest 2009 Stanford University Wireshark in a Multi-Core Environment Using Hardware Acceleration Presenter: Pete Sanders, Napatech Inc. Sharkfest 2009 Stanford University Napatech - Sharkfest 2009 1 Presentation Overview About Napatech

More information

Infrastructure for active and passive measurements at 10Gbps and beyond

Infrastructure for active and passive measurements at 10Gbps and beyond Infrastructure for active and passive measurements at 10Gbps and beyond Best Practice Document Produced by UNINETT led working group on network monitoring (UFS 142) Author: Arne Øslebø August 2014 1 TERENA

More information

NetFlow/IPFIX Various Thoughts

NetFlow/IPFIX Various Thoughts NetFlow/IPFIX Various Thoughts Paul Aitken & Benoit Claise 3 rd NMRG Workshop on NetFlow/IPFIX Usage in Network Management, July 2010 1 B #1 Application Visibility Business Case NetFlow (L3/L4) DPI Application

More information

10/100/1000Mbps Ethernet MAC with Protocol Acceleration MAC-NET Core with Avalon Interface

10/100/1000Mbps Ethernet MAC with Protocol Acceleration MAC-NET Core with Avalon Interface 1 Introduction Ethernet is available in different speeds (10/100/1000 and 10000Mbps) and provides connectivity to meet a wide range of needs from desktop to switches. MorethanIP IP solutions provide a

More information

Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX

Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX Martin Elich 1, Matěj Grégr 2 and Pavel Čeleda1 1 CESNET, z.s.p.o., Zikova 4, 160 00 Prague, Czech Republic martin.elich@gmail.com,

More information

NetStream (Integrated) Technology White Paper HUAWEI TECHNOLOGIES CO., LTD. Issue 01. Date 2012-9-6

NetStream (Integrated) Technology White Paper HUAWEI TECHNOLOGIES CO., LTD. Issue 01. Date 2012-9-6 (Integrated) Technology White Paper Issue 01 Date 2012-9-6 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means

More information

SCAMPI Programmable hardware for network monitoring. Masaryk University

SCAMPI Programmable hardware for network monitoring. Masaryk University SCAMPI Programmable hardware for network monitoring Jiří Novotný Masaryk University Arne Øslebø Uninett Jun 8, 2004 Rhodos SCAMPI overview 2.5 year 5 th Framework

More information

Flow Monitor Configuration. Content CHAPTER 1 MIRROR CONFIGURATION... 1-1 CHAPTER 2 RSPAN CONFIGURATION... 2-1 CHAPTER 3 SFLOW CONFIGURATION...

Flow Monitor Configuration. Content CHAPTER 1 MIRROR CONFIGURATION... 1-1 CHAPTER 2 RSPAN CONFIGURATION... 2-1 CHAPTER 3 SFLOW CONFIGURATION... Content Content CHAPTER 1 MIRROR CONFIGURATION... 1-1 1.1 INTRODUCTION TO MIRROR... 1-1 1.2 MIRROR CONFIGURATION TASK LIST... 1-1 1.3 MIRROR EXAMPLES... 1-2 1.4 DEVICE MIRROR TROUBLESHOOTING... 1-3 CHAPTER

More information

The new frontier of the DATA acquisition using 1 and 10 Gb/s Ethernet links. Filippo Costa on behalf of the ALICE DAQ group

The new frontier of the DATA acquisition using 1 and 10 Gb/s Ethernet links. Filippo Costa on behalf of the ALICE DAQ group The new frontier of the DATA acquisition using 1 and 10 Gb/s Ethernet links Filippo Costa on behalf of the ALICE DAQ group DATE software 2 DATE (ALICE Data Acquisition and Test Environment) ALICE is a

More information

IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令

IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 1 内 容 流 量 分 析 简 介 IPv6 下 的 新 问 题 和 挑 战 协 议 格 式 变 更 用 户 行 为 特 征 变 更 安 全 问 题 演 化 流 量 导 出 手 段 变 化 设 备 参 考 配 置 流 量 工 具 总 结 2 流 量 分 析 简 介 流 量 分 析 目 标 who, what, where,

More information

Cisco IOS Flexible NetFlow Technology

Cisco IOS Flexible NetFlow Technology Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application

More information

Lab 4.1.2 Characterizing Network Applications

Lab 4.1.2 Characterizing Network Applications Lab 4.1.2 Characterizing Network Applications Objective Device Designation Device Name Address Subnet Mask Discovery Server Business Services 172.17.1.1 255.255.0.0 R1 FC-CPE-1 Fa0/1 172.17.0.1 Fa0/0 10.0.0.1

More information

Internet Management and Measurements Measurements

Internet Management and Measurements Measurements Internet Management and Measurements Measurements Ramin Sadre, Aiko Pras Design and Analysis of Communication Systems Group University of Twente, 2010 Measurements What is being measured? Why do you measure?

More information

Stress Testing Switches and Routers

Stress Testing Switches and Routers Stress Testing Switches and Routers Rev 4 How to perform a simple stress test on a Layer 2 switch device step-by-step. APPLICATION NOTE The Xena testers can verify traffic forwarding performance, protocol

More information

J-Flow on J Series Services Routers and Branch SRX Series Services Gateways

J-Flow on J Series Services Routers and Branch SRX Series Services Gateways APPLICATION NOTE Juniper Flow Monitoring J-Flow on J Series Services Routers and Branch SRX Series Services Gateways Copyright 2011, Juniper Networks, Inc. 1 APPLICATION NOTE - Juniper Flow Monitoring

More information

NetFlow-Lite offers network administrators and engineers the following capabilities:

NetFlow-Lite offers network administrators and engineers the following capabilities: Solution Overview Cisco NetFlow-Lite Introduction As networks become more complex and organizations enable more applications, traffic patterns become more diverse and unpredictable. Organizations require

More information

Monitoring high-speed networks using ntop. Luca Deri

Monitoring high-speed networks using ntop. Luca Deri <deri@ntop.org> Monitoring high-speed networks using ntop Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:

More information

10/100/1000 Ethernet MAC with Protocol Acceleration MAC-NET Core

10/100/1000 Ethernet MAC with Protocol Acceleration MAC-NET Core 1 Introduction The implements, in conjunction with a triple speed 10/100/1000 MAC, Layer 3 network acceleration functions, which are designed to accelerate the processing of various common networking protocols

More information

NfSen Plugin Supporting The Virtual Network Monitoring

NfSen Plugin Supporting The Virtual Network Monitoring NfSen Plugin Supporting The Virtual Network Monitoring Vojtěch Krmíček krmicek@liberouter.org Pavel Čeleda celeda@ics.muni.cz Jiří Novotný novotny@cesnet.cz Part I Monitoring of Virtual Network Environments

More information

Configuring Flexible NetFlow

Configuring Flexible NetFlow CHAPTER 62 Note Flexible NetFlow is only supported on Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X. Flow is defined as a unique set of key fields attributes, which might include fields

More information

High-Density Network Flow Monitoring

High-Density Network Flow Monitoring High-Density Network Flow Monitoring Petr Velan CESNET, z.s.p.o. Zikova 4, 160 00 Praha 6, Czech Republic petr.velan@cesnet.cz Viktor Puš CESNET, z.s.p.o. Zikova 4, 160 00 Praha 6, Czech Republic pus@cesnet.cz

More information

Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export

Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export Last Updated: November 28, 2011 This module contains the minimum amount of information about and instructions necessary for configuring

More information

A Transport Protocol for Multimedia Wireless Sensor Networks

A Transport Protocol for Multimedia Wireless Sensor Networks A Transport Protocol for Multimedia Wireless Sensor Networks Duarte Meneses, António Grilo, Paulo Rogério Pereira 1 NGI'2011: A Transport Protocol for Multimedia Wireless Sensor Networks Introduction Wireless

More information

EdgeRouter Lite 3-Port Router. Datasheet. Model: ERLite-3. Sophisticated Routing Features. Advanced Security, Monitoring, and Management

EdgeRouter Lite 3-Port Router. Datasheet. Model: ERLite-3. Sophisticated Routing Features. Advanced Security, Monitoring, and Management EdgeRouter Lite 3-Port Router Model: ERLite-3 Sophisticated Routing Features Advanced Security, Monitoring, and Management High-Performance Gigabit Ports Advanced 3-Port Router Introducing the EdgeRouter

More information

Wireshark Developer and User Conference

Wireshark Developer and User Conference Wireshark Developer and User Conference Using NetFlow to Analyze Your Network June 15 th, 2011 Christopher J. White Manager Applica6ons and Analy6cs, Cascade Riverbed Technology cwhite@riverbed.com SHARKFEST

More information

Cisco NetFlow Generation Appliance (NGA) 3140

Cisco NetFlow Generation Appliance (NGA) 3140 Q&A Cisco NetFlow Generation Appliance (NGA) 3140 General Overview Q. What is Cisco NetFlow Generation Appliance (NGA) 3140? A. Cisco NetFlow Generation Appliance 3140 is purpose-built, high-performance

More information

Integrated Traffic Monitoring

Integrated Traffic Monitoring 61202880L1-29.1F November 2009 Configuration Guide This configuration guide describes integrated traffic monitoring (ITM) and its use on ADTRAN Operating System (AOS) products. Including an overview of

More information

C-GEP 100 Monitoring application user manual

C-GEP 100 Monitoring application user manual C-GEP 100 Monitoring application user manual 1 Introduction: C-GEP is a very versatile platform for network monitoring applications. The ever growing need for network bandwith like HD video streaming and

More information

ABW - Short-timescale passive bandwidth monitoring

ABW - Short-timescale passive bandwidth monitoring ABW - Short-timescale passive bandwidth monitoring Sven Ubik (CESNET, Czech Republic), Demetres Antoniades (ICS-FORTH, Greece), Arne Oslebo (UNINETT, Norway) November 18, 2006 Abstract Bandwidth usage

More information

Network traffic monitoring and management. Sonia Panchen sonia.panchen@inmon.com 11 th November 2010

Network traffic monitoring and management. Sonia Panchen sonia.panchen@inmon.com 11 th November 2010 Network traffic monitoring and management Sonia Panchen sonia.panchen@inmon.com 11 th November 2010 Lecture outline What is network traffic management? Traffic management applications Traffic monitoring

More information

Configuring NetFlow-lite

Configuring NetFlow-lite CHAPTER 55 Note NetFlow-lite is only supported on Catalyst 4948E Ethernet Switch. This chapter describes how to configure NetFlow-lite on the Catalyst 4948E switch. NetFlow-lite provides traffic monitoring

More information

Gigabit Ethernet Design

Gigabit Ethernet Design Gigabit Ethernet Design Laura Jeanne Knapp Network Consultant 1-919-254-8801 laura@lauraknapp.com www.lauraknapp.com Tom Hadley Network Consultant 1-919-301-3052 tmhadley@us.ibm.com HSEdes_ 010 ed and

More information

Introduction to Cisco IOS Flexible NetFlow

Introduction to Cisco IOS Flexible NetFlow Introduction to Cisco IOS Flexible NetFlow Last updated: September 2008 The next-generation in flow technology allowing optimization of the network infrastructure, reducing operation costs, improving capacity

More information

Datasheet. Advanced Network Routers. Models: ERPro-8, ER-8, ERPoe-5, ERLite-3. Sophisticated Routing Features

Datasheet. Advanced Network Routers. Models: ERPro-8, ER-8, ERPoe-5, ERLite-3. Sophisticated Routing Features Advanced Network Routers Models: ERPro-8, ER-8, ERPoe-5, ERLite-3 Sophisticated Routing Features Advanced Security, Monitoring, and Management High-Performance Gigabit Ports Advanced Routing Technology

More information

Network Analysis Modules

Network Analysis Modules CHAPTER 6 This chapter describes the (NAMs) and contains the following sections: Network Analysis Module (WS-SVC-NAM-1), page 6-2 Network Analysis Module (WS-SVC-NAM-2), page 6-4 NAMs monitor and analyze

More information

Agenda. Cisco Research SCRIPT and the Big Picture. Building Blocks for the SCRIPT Project

Agenda. Cisco Research SCRIPT and the Big Picture. Building Blocks for the SCRIPT Project Cisco Research SCRIPT and the Big Picture Ralf Wolter, Cisco Systems 1 Agenda Building Blocks for the SCRIPT Project Cisco Research Center (CRC) NetFlow: the story and the challenge IPFIX @ IETF Cisco

More information

The Value of Flow Data for Peering Decisions

The Value of Flow Data for Peering Decisions The Value of Flow Data for Peering Decisions Hurricane Electric IPv6 Native Backbone Massive Peering! Martin J. Levy Director, IPv6 Strategy Hurricane Electric 22 nd August 2012 Introduction Goal of this

More information

and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs

and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs ICmyNet.Flow: NetFlow based traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF Faculty

More information

Cisco IOS Flexible NetFlow Command Reference

Cisco IOS Flexible NetFlow Command Reference Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION

More information

IPv6/IPv4 Automatic Dual Authentication Technique for Campus Network

IPv6/IPv4 Automatic Dual Authentication Technique for Campus Network IPv6/IPv4 Automatic Dual Authentication Technique for Campus Network S. CHITPINITYON, S. SANGUANPONG, K. KOHT-ARSA, W. PITTAYAPITAK, S. ERJONGMANEE AND P. WATANAPONGSE Agenda Introduction Design And Implementation

More information

Ethernet Link SGI-4844F

Ethernet Link SGI-4844F Ethernet Link SGI-4844F 44 ports 100/1000Mbps SFP + 4 Combo port RJ-45 + 100/1000Mbps SFP slot Layer 2+ Managed Ethernet Switch Overview LinkPro SGI-4844F is a layer-2+ gigabit access switch equipped with

More information

The Lagopus SDN Software Switch. 3.1 SDN and OpenFlow. 3. Cloud Computing Technology

The Lagopus SDN Software Switch. 3.1 SDN and OpenFlow. 3. Cloud Computing Technology 3. The Lagopus SDN Software Switch Here we explain the capabilities of the new Lagopus software switch in detail, starting with the basics of SDN and OpenFlow. 3.1 SDN and OpenFlow Those engaged in network-related

More information

Comprehensive IP Traffic Monitoring with FTAS System

Comprehensive IP Traffic Monitoring with FTAS System Comprehensive IP Traffic Monitoring with FTAS System Tomáš Košňar kosnar@cesnet.cz CESNET, association of legal entities Prague, Czech Republic Abstract System FTAS is designed for large-scale continuous

More information

Datasheet. Advanced Gigabit Ethernet Routers. Models: ER-X, ER-X-SFP. Sophisticated Routing Features. Advanced Security, Monitoring, and Management

Datasheet. Advanced Gigabit Ethernet Routers. Models: ER-X, ER-X-SFP. Sophisticated Routing Features. Advanced Security, Monitoring, and Management Advanced Gigabit Ethernet Routers Models: ER-X, ER-X-SFP Sophisticated Routing Features Advanced Security, Monitoring, and Management High-Performance Gigabit Ports PoE Adapter UniFi AP AC Computer Overview

More information

ABW - Short-timescale passive bandwidth monitoring

ABW - Short-timescale passive bandwidth monitoring ABW - Short-timescale passive bandwidth monitoring Sven Ubik (CESNET, Czech Republic), Demetres Antoniades (ICS-FORTH, Greece), Arne Oslebo (UNINETT, Norway) Abstract Bandwidth usage monitoring is important

More information

Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document

Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document Produced by AMRES NMS Group (AMRES BPD 104) Author: Ivan Ivanović November 2011 TERENA 2010. All rights reserved.

More information

Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting

Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Document ID: 70974 Introduction Prerequisites Requirements Components Used Conventions Background Information Configure Network Diagram

More information

Welcome to the Dawn of Open-Source Networking. Linux IP Routers Bob Gilligan gilligan@vyatta.com

Welcome to the Dawn of Open-Source Networking. Linux IP Routers Bob Gilligan gilligan@vyatta.com Welcome to the Dawn of Open-Source Networking. Linux IP Routers Bob Gilligan gilligan@vyatta.com Outline About Vyatta: Open source project, and software product Areas we re working on or interested in

More information

XMVAE Gigabit Ethernet Modules

XMVAE Gigabit Ethernet Modules XMVAE Gigabit Ethernet Modules Ixia's XMVAE Gigabit Ethernet Load Modules offer complete Layer 2-3 network and application testing functionality in a single test system for Automotive Ethernet switch and

More information

Flow Analysis. Make A Right Policy for Your Network. GenieNRM

Flow Analysis. Make A Right Policy for Your Network. GenieNRM Flow Analysis Make A Right Policy for Your Network GenieNRM Why Flow Analysis? Resolve Network Managers Challenge as follow: How can I know the Detail and Real-Time situation of my network? How can I do

More information

Network Traffic Performance & Security Monitoring

Network Traffic Performance & Security Monitoring Network Traffic Performance & Security Monitoring Project proposal minimal project Orsenna;Invea-Tech FLOWMON PROBES 1000 & 100 Contents 1. Introduction... 2 1.1. General System Requirements... 2 1.2.

More information

Integrated Traffic Monitoring

Integrated Traffic Monitoring 61202880L1-29.1E July 2008 Configuration Guide This configuration guide describes integrated traffic monitoring (ITM) and its use on ADTRAN Operating System (AOS) products. Including an overview of the

More information

AGIPD Interface Electronic Prototyping

AGIPD Interface Electronic Prototyping AGIPD Interface Electronic Prototyping P.Goettlicher I. Sheviakov M. Zimmer - Hardware Setup, Measurements - ADC (AD9252 14bit x 8ch x 50msps ) readout - Custom 10G Ethernet performance - Conclusions Test

More information

SDN AND SECURITY: Why Take Over the Hosts When You Can Take Over the Network

SDN AND SECURITY: Why Take Over the Hosts When You Can Take Over the Network SDN AND SECURITY: Why Take Over the s When You Can Take Over the Network SESSION ID: TECH0R03 Robert M. Hinden Check Point Fellow Check Point Software What are the SDN Security Challenges? Vulnerability

More information

Configuring NetFlow. Information About NetFlow. NetFlow Overview. Send document comments to nexus7k-docfeedback@cisco.com. CHAPTER

Configuring NetFlow. Information About NetFlow. NetFlow Overview. Send document comments to nexus7k-docfeedback@cisco.com. CHAPTER CHAPTER 16 This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices. This chapter includes the following sections: Information About NetFlow, page 16-1 Licensing Requirements

More information

PANDORA FMS NETWORK DEVICES MONITORING

PANDORA FMS NETWORK DEVICES MONITORING NETWORK DEVICES MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS can monitor all the network devices available in the market, like Routers, Switches, Modems, Access points,

More information

NetFlow Configuration Guide, Cisco IOS Release 12.4

NetFlow Configuration Guide, Cisco IOS Release 12.4 NetFlow Configuration Guide, Cisco IOS Release 12.4 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)

More information

Flow Based Traffic Analysis

Flow Based Traffic Analysis Flow based Traffic Analysis Muraleedharan N C-DAC Bangalore Electronics City murali@ncb.ernet.in Challenges in Packet level traffic Analysis Network traffic grows in volume and complexity Capture and decode

More information

Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag

Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag 2005 SWITCH What I am going to present: The Motivation. What are NfSen and nfdump? The Tools in Action. Outlook

More information

Open Source in Network Administration: the ntop Project

Open Source in Network Administration: the ntop Project Open Source in Network Administration: the ntop Project Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:

More information

Introduction to Netflow

Introduction to Netflow Introduction to Netflow Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)

More information

Building a better NetFlow

Building a better NetFlow Building a better NetFlow (to appear in SIGCOMM 2004) Cristian Estan, Ken Keys, David Moore, George Varghese University of California, San Diego IETF60 Aug 4, 2004 IPFIX WG UCSD CSE Disclaimers "NetFlow"

More information

Configuring NetFlow. Information About NetFlow. Send document comments to nexus1k-docfeedback@cisco.com. CHAPTER

Configuring NetFlow. Information About NetFlow. Send document comments to nexus1k-docfeedback@cisco.com. CHAPTER CHAPTER 11 Use this chapter to configure NetFlow to characterize IP traffic based on its source, destination, timing, and application information, to assess network availability and performance. This chapter

More information

Teaching Networking Hardware

Teaching Networking Hardware Teaching Networking Hardware Stanford High Performance Network Group Presented By: Martin Casado Gregory Watson Martin Casado Nick McKeown June, 2005 Motivation (networking hardware experience needed in

More information

Measuring Platform Architecture Based on the IPFIX Standard

Measuring Platform Architecture Based on the IPFIX Standard Measuring Platform Architecture Based on the IPFIX Standard Alžbeta Kleinová, Anton Baláž, Jana Trelová, Norbert Ádám Department of Computers and Informatics, Technical University of Košice Letná 9, 042

More information

UPPER LAYER SWITCHING

UPPER LAYER SWITCHING 52-20-40 DATA COMMUNICATIONS MANAGEMENT UPPER LAYER SWITCHING Gilbert Held INSIDE Upper Layer Operations; Address Translation; Layer 3 Switching; Layer 4 Switching OVERVIEW The first series of LAN switches

More information

The SCAMPI Scaleable Monitoring Platform for the Internet. Baiba Kaskina TERENA baiba@terena.nl

The SCAMPI Scaleable Monitoring Platform for the Internet. Baiba Kaskina TERENA baiba@terena.nl The SCAMPI Scaleable Monitoring Platform for the Internet Baiba Kaskina TERENA baiba@terena.nl Agenda Project overview Project objectives Project partners Work packages Technical information SCAMPI architecture

More information

NetFlow: What is it, why and how to use it? Miloš Zeković, milos.zekovic@soneco.rs. ICmyNet Chief Customer Officer Soneco d.o.o.

NetFlow: What is it, why and how to use it? Miloš Zeković, milos.zekovic@soneco.rs. ICmyNet Chief Customer Officer Soneco d.o.o. NetFlow: What is it, why and how to use it?, milos.zekovic@soneco.rs Soneco d.o.o. Serbia Agenda What is NetFlow? What are the benefits? How to deploy NetFlow? Questions 2 / 22 What is NetFlow? NetFlow

More information

Configuring NetFlow. Information About NetFlow. NetFlow Overview. Send document comments to nexus7k-docfeedback@cisco.com. CHAPTER

Configuring NetFlow. Information About NetFlow. NetFlow Overview. Send document comments to nexus7k-docfeedback@cisco.com. CHAPTER CHAPTER 19 This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices. This chapter includes the following sections: Information About NetFlow, page 19-1 Licensing Requirements

More information

Cisco NetFlow TM Briefing Paper. Release 2.2 Monday, 02 August 2004

Cisco NetFlow TM Briefing Paper. Release 2.2 Monday, 02 August 2004 Cisco NetFlow TM Briefing Paper Release 2.2 Monday, 02 August 2004 Contents EXECUTIVE SUMMARY...3 THE PROBLEM...3 THE TRADITIONAL SOLUTIONS...4 COMPARISON WITH OTHER TECHNIQUES...6 CISCO NETFLOW OVERVIEW...7

More information

Network Monitoring and Management NetFlow Overview

Network Monitoring and Management NetFlow Overview Network Monitoring and Management NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)

More information

PANDORA FMS NETWORK DEVICE MONITORING

PANDORA FMS NETWORK DEVICE MONITORING NETWORK DEVICE MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS is able to monitor all network devices available on the marke such as Routers, Switches, Modems, Access points,

More information

Netflow Overview. PacNOG 6 Nadi, Fiji

Netflow Overview. PacNOG 6 Nadi, Fiji Netflow Overview PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools

More information

Flow Analysis Versus Packet Analysis. What Should You Choose?

Flow Analysis Versus Packet Analysis. What Should You Choose? Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation

More information

ABW Short-timescale passive bandwidth monitoring

ABW Short-timescale passive bandwidth monitoring CESNET technical report number 3/2007 ABW Short-timescale passive bandwidth monitoring Sven Ubik (CESNET), Demetres Antoniades (ICS-FORTH), Arne Oslebo (UNINETT) 7.12.2006 1 Abstract Bandwidth usage monitoring

More information

Network Protocol Configuration

Network Protocol Configuration Table of Contents Table of Contents Chapter 1 Configuring IP Addressing... 1 1.1 IP Introduction... 1 1.1.1 IP... 1 1.1.2 IP Routing Protocol... 1 1.2 Configuring IP Address Task List... 2 1.3 Configuring

More information

Stress-Testing a Gbps Intrusion Prevention Device on DETER

Stress-Testing a Gbps Intrusion Prevention Device on DETER Stress-Testing a Gbps Intrusion Prevention Device on DETER Nicholas Weaver Vern Paxson ICSI Acknowledgements Joint work with Jose Chema Gonzalez Sponsored by NSF/DHS ANI-0335290 (EMIST) DOE DE-F602-04ER25638

More information

Data Sheet. DPtech Anti-DDoS Series. Overview

Data Sheet. DPtech Anti-DDoS Series. Overview Data Sheet DPtech Anti-DDoS Series DPtech Anti-DDoS Series Overview DoS (Denial of Service) leverage various service requests to exhaust victims system resources, causing the victim to deny service to

More information

Network Monitoring Based on IP Data Flows

Network Monitoring Based on IP Data Flows Network Monitoring Based on IP Data Flows Best Practice Document Produced by CESNET led working group on Network monitoring (CBPD131) Author:MartinŽádník March2010 TERENA 2010. All rights reserved. Document

More information

OpenFlow Based Load Balancing

OpenFlow Based Load Balancing OpenFlow Based Load Balancing Hardeep Uppal and Dane Brandon University of Washington CSE561: Networking Project Report Abstract: In today s high-traffic internet, it is often desirable to have multiple

More information

Linuxflow: A High Speed Backbone Measurement Facility

Linuxflow: A High Speed Backbone Measurement Facility Linuxflow: A High Speed Backbone Measurement Facility ZhiChun Li (lizc@serv.edu.cn( lizc@serv.edu.cn) Hui Zhang (hzhang@cernet.edu.cn( hzhang@cernet.edu.cn) CERNET, Tsinghua Univ,, China CHINA EDUCATION

More information

Network Monitoring Based on IP Data Flows Best Practice Document

Network Monitoring Based on IP Data Flows Best Practice Document Network Monitoring Based on IP Data Flows Best Practice Document Produced by CESNET led working group on Network monitoring (CBPD131) Authors: Martin Žádník March 2010 TERENA 2010. All rights reserved.

More information

D1.2 Network Load Balancing

D1.2 Network Load Balancing D1. Network Load Balancing Ronald van der Pol, Freek Dijkstra, Igor Idziejczak, and Mark Meijerink SARA Computing and Networking Services, Science Park 11, 9 XG Amsterdam, The Netherlands June ronald.vanderpol@sara.nl,freek.dijkstra@sara.nl,

More information

Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data

Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides

More information

Wire-speed Packet Capture and Transmission

Wire-speed Packet Capture and Transmission Wire-speed Packet Capture and Transmission Luca Deri Packet Capture: Open Issues Monitoring low speed (100 Mbit) networks is already possible using commodity hardware and tools based on libpcap.

More information

NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes

NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes NetFlow Aggregation This document describes the Cisco IOS NetFlow Aggregation feature, which allows Cisco NetFlow users to summarize NetFlow export data on an IOS router before the data is exported to

More information

Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software. Luca Deri January 2003

Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software. Luca Deri January 2003 Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software Luca Deri January 2003 Current Situation: Applications Most modern applications are bandwidth hungry (P2P).

More information

Cisco ASA and NetFlow Using ASA NetFlow with LiveAction Flow Software

Cisco ASA and NetFlow Using ASA NetFlow with LiveAction Flow Software LiveAction Application Note Cisco ASA and NetFlow Using ASA NetFlow with LiveAction Flow Software January 2013 http://www.actionpacked.com Table of Contents 1. Introduction... 1 2. ASA NetFlow Security

More information

Network Management & Monitoring

Network Management & Monitoring Network Management & Monitoring NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)

More information

NetFlow Configuration Guide, Cisco IOS Release 15M&T

NetFlow Configuration Guide, Cisco IOS Release 15M&T Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION

More information

SolarWinds Technical Reference

SolarWinds Technical Reference SolarWinds Technical Reference Configuring Devices for Flow Collection Introduction... 3 Cisco... 3 Cisco Catalyst 3560/3750... 4 Cisco Catalyst 4500... 7 Cisco Catalyst 6500... 9 Cisco Nexus 7000/7010...

More information