pmacct: introducing BGP na2vely into a NetFlow/sFlow collector

Size: px
Start display at page:

Download "pmacct: introducing BGP na2vely into a NetFlow/sFlow collector"

Transcription

1 pmacct: introducing BGP na2vely into a NetFlow/sFlow collector Paolo Lucente pmacct <paolo at pmacct dot net> Netnod 2012 spring meeting, Stockholm, 17 th Feb 2012

2 Square 0 NetFlow is not the only exis2ng export protocol Current trend is to build extensible protocol formats by means of templates (NetFlow v9, IPFIX) or modules (sflow) Export protocols, versions and templates (or modules) available are solely mandated by the underlying network hardware, ie.: Cisco? NetFlow (and NetFlow- Lite on switches?) Juniper? NetFlow and IPFIX (so baaaad as we speak!) on M/T/MX; sflow on EX Brocade? sflow!

3 pmacct is open- source, free, GPL ed sovware

4 pmacct: where is it siwng?

5 pmacct: typical usage scenarios

6 pmacct: arising usage scenarios Build traffic matrices Peering & content distribu2on Support Business Intelligence Support Traffic Engineering & CP

7 The BGP peer who came from NetFlow (and sflow) pmacct introduces a Quagga- based BGP daemon Implemented as a parallel thread within the collector Doesn t send UPDATEs and WITHDRAWs whatsoever Behaves as a passive BGP neighbor Maintains per- peer BGP RIBs Supports 32- bit ASNs Supports both IPv4 and IPv6 Joins NetFlow (or sflow) and BGP data basing on: NetFlow source address == BGP source address

8 The BGP peer who came from NetFlow (and sflow) (cont.d) Relevant implementa2on details: Bases on trust: peers are not defined but a max number of peers who can connect is defined instead Ensures ibgp peering by presen2ng itself as part of the AS of the neighbor, as read in the OPEN message Enables the following traffic aggrega2on primi2ves: AS path, Local Preference, MED, Peer ASNs (freely mixed with origin ASNs), Communi2es, Peer IPs Caveats: BGP mul2- path is not supported

9 GeWng BGP to the collector Let the collector BGP peer with all PE devices: facing peers, transit and customers. Determine memory footprint (below in MB/peer) K IPv4 routes, 50K IPv6 routes, 64- bit executable MB/peer ~ 9GB total 500 peers MB/peer >= MB/peer < Number of BGP peers

10 GeWng BGP to the collector (cont.d) Set the collector as ibgp peer at the PE devices: Configure it as a RR client for best results Collector acts as ibgp peer across (sub- )ASes BGP next- hop has to represent the remote edge of the network model: Typical scenario for MPLS networks Can be followed up to cover specific scenarios like: BGP confedera2ons Op2onally polish the AS- Path up from sub- ASNs default gateway defined due to par2al or default- only rou2ng tables

11 GeWng telemetry to the collector Export ingress- only measurements at all PE devices: facing peers, transit and customers. Traffic is routed to des2na2on, so plenty of informa2on on where it s going to It s crucial instead to get as much as possible about where traffic is coming from Leverage data reduc2on techniques at the PE: Sampling Aggrega2on (but be sure to carry IP prefixes!)

12 The BGP peer who came from NetFlow (and sflow) illustrated

13 Theory applied, SQL example (1/3) BGP Fields Counters Time shell> cat pmacct-create-db_bgp_v1.mysql [ ] create table acct_bgp ( Tag ); agent_id INT(4) UNSIGNED NOT NULL, as_src INT(4) UNSIGNED NOT NULL, as_dst INT(4) UNSIGNED NOT NULL, peer_as_src INT(4) UNSIGNED NOT NULL, peer_as_dst INT(4) UNSIGNED NOT NULL, peer_ip_src CHAR(15) NOT NULL, peer_ip_dst CHAR(15) NOT NULL, id=100 peer_src_as=<customer> comms CHAR(24) NOT NULL, as_path CHAR(21) NOT NULL, id=80 id=50 peer_src_as=<peer> peer_src_as=<ip transit> local_pref INT(4) UNSIGNED NOT NULL, [ ] med INT(4) UNSIGNED NOT NULL, packets INT UNSIGNED NOT NULL, bytes BIGINT UNSIGNED NOT NULL, stamp_inserted DATETIME NOT NULL, stamp_updated DATETIME, PRIMARY KEY ( ) shell> cat pretag.map shell> cat peers.map id=65534 ip=x in=a id=65533 ip=y in=b src_mac=j id=65532 ip=z in=c bgp_nexthop=w [ ] shell> mysql -u root -p < pmacct-create-db_bgp_v1.mysql

14 Theory applied, SQL example (2/3) See traffic delivered to a specific BGP peer mysql> SELECT peer_as_dst, bytes, stamp_inserted \ FROM acct_bgp \ WHERE peer_as_dst = <peer customer IP transit> \ GROUP BY peer_as_dst Same as above but also per loca2on if peering at mul2ple places mysql> SELECT peer_as_dst, peer_ip_dst, bytes, stamp_inserted \ FROM acct_bgp \ WHERE peer_as_dst = <peer customer IP transit> \ GROUP BY peer_as_dst, peer_ip_dst Simply replace dst with src in the above examples to see incoming traffic

15 Theory applied, SQL example (3/3) See outgoing traffic breakdown to all BGP peers of the same kind (ie. peers, customers, transit) mysql> SELECT peer_as_dst, bytes, stamp_inserted \ FROM acct_bgp \ WHERE local_pref = <<peer customer IP transit> pref> \ GROUP BY peer_as_dst

16 Miscellaneous features implemented AS Path radius: AS PATHs can get long. This can easily get counter produc2ve (ie. waste space) Cuts AS Path down to the specified number of AS hops. Assump&on: people might be more interested into what happens around them. Communi2es paqern filter IP prefixes can have many communi2es aqached Only a small subset might be relevant to the accoun2ng infrastructure Hence filtering capabili2es are made available

17 The source peer AS issue Traffic is tradi2onally routed to des2na2on Problem #1: limited informa2on about where traffic enters the AS domain. Applying this to tradi2onal NetFlow it means: either origin ASNs OR peer ASNs Problem #2: asymmetric rou2ng. Applying this to tradi2onal NetFlow it means: FIB lookup on the source prefix; result: source peer AS is where traffic should have entered the AS domain, if it was symmetrical.

18 The source peer AS issue mi2gated Having per- peer BGP RIBs on- board paves the way to capture both origin AND peer ASNs Source peer AS is sta2cally mapped against: A whole port, ie. input port field. Source MAC address. Should be the way to go and depends on NetFlow v9 or sflow. BGP next- hop lookup against the source prefix: Only choice if running NetFlow v5 in scenarios where mul2ple peers are off a single port (ie. IXP) Accuracy is not really predictable Combine with input port to limit false posi2ves

19 Briefly on scalability A single collector might not fit it all: Memory: can t store all BGP full rou2ng tables CPU: can t cope with the pace of telemetry export Divide- et- impera approach is valid: Assign PEs (both telemetry and BGP) to collectors Assign collectors to RDBMSs; or cluster the RDBMS. The matrix can get big, but can be reduced: Keep smaller routers out of the equa2on Filter out specific services/customers on dense routers Focus on relevant traffic direc2on (ie. upstream if CDN, downstream if ISP) Sample or put thresholds on traffic relevance

20 Further informa2on hqp:// En22es on the provider IP address space Auto- discovery and automa2on hqp://wiki.pmacct.net/officialexamples Quick- start guide to setup a NetFlow/sFlow+BGP collector instance hqp://wiki.pmacct.net/implementa2onnotes Implementa2on notes (RDBMS, maintenance, etc.)

21 pmacct: introducing BGP na2vely into a NetFlow/sFlow collector Thanks for your attention! Questions? Paolo Lucente pmacct <paolo at pmacct dot net> Netnod 2012 spring meeting, Stockholm, 17 th Feb 2012

pmacct: introducing BGP natively into a NetFlow/sFlow collector

pmacct: introducing BGP natively into a NetFlow/sFlow collector pmacct: introducing BGP natively into a NetFlow/sFlow collector Paolo Lucente the pmacct project AS286 http://www.pmacct.net/ SwiNOG #19 meeting, Berne, 29 th Sep 2009 pmacct:

More information

Network traffic telemetry (NetFlow, IPFIX, sflow)

Network traffic telemetry (NetFlow, IPFIX, sflow) Network traffic telemetry (NetFlow, IPFIX, sflow) Paolo Lucente pmacct MENOG 13 mee+ng, Kuwait City Sep 2013 Network traffic telemetry (NetFlow, IPFIX, sflow) Agenda o whoami: Paolo & pmacct o Ramblings:

More information

Building traffic matrices to support peering decisions

Building traffic matrices to support peering decisions Building traffic matrices t supprt peering decisins Pal Lucente the pmacct prject AS286 http://www.pmacct.net/ EPF #5 meeting, Cannes, France Sep 2010 Building traffic matrices t

More information

NetFlow & BGP multi-path: quo vadis?

NetFlow & BGP multi-path: quo vadis? NetFlow & BGP multi-path: quo vadis? Paolo Lucente Elisa Jasinska Netnod, Stockholm Agenda About Netflix About pmacct Brief digression on BGP ADD-PATHS Putting all

More information

Traffic analysis with NetFlow

Traffic analysis with NetFlow Traffic analysis with NetFlow Paolo Lucente http://www.pmacct.net/ RIPE Regional meeting, Dubrovnik Sep 2011 Traffic analysis with NetFlow Agenda o o whoami: Paolo & pmacct Ramblings:

More information

NetFlow & BGP multi-path: quo vadis?

NetFlow & BGP multi-path: quo vadis? NetFlow & BGP multi-path: quo vadis? Paolo Lucente Elisa Jasinska NANOG61, Bellevue Agenda About Netflix About pmacct Brief digression on BGP ADD-PATHS Putting all

More information

Collec'ng NetFlow with pmacct

Collec'ng NetFlow with pmacct Collec'ng NetFlow with pmacct Paolo Lucente pmacct SEE 3 mee'ng, Sofia Apr 2014 Presenta'on history 1.1: MENOG 13 mee'ng, Kuwait City, Sep 2013 1.2: SEE 3 mee'ng, Sofia, Apr 2014 Collec'ng NetFlow with

More information

Collec+ng NetFlow with pmacct

Collec+ng NetFlow with pmacct Collec+ng NetFlow with pmacct Paolo Lucente pmacct MENOG 13 mee+ng, Kuwait City Sep 2013 Collec+ng NetFlow with pmacct Agenda o o o o o Introduction pmacct architecture & benefits example, data aggregation:

More information

APNIC elearning: BGP Attributes

APNIC elearning: BGP Attributes APNIC elearning: BGP Attributes Contact: training@apnic.net erou04_v1.0 Overview BGP Attributes Well-known and Optional Attributes AS Path AS Loop Detection ibgp and ebgp Next Hop Next Hop Best Practice

More information

The Value of Flow Data for Peering Decisions

The Value of Flow Data for Peering Decisions The Value of Flow Data for Peering Decisions Hurricane Electric IPv6 Native Backbone Massive Peering! Martin J. Levy Director, IPv6 Strategy Hurricane Electric 22 nd August 2012 Introduction Goal of this

More information

APNIC elearning: BGP Basics. Contact: training@apnic.net. erou03_v1.0

APNIC elearning: BGP Basics. Contact: training@apnic.net. erou03_v1.0 erou03_v1.0 APNIC elearning: BGP Basics Contact: training@apnic.net Overview What is BGP? BGP Features Path Vector Routing Protocol Peering and Transit BGP General Operation BGP Terminology BGP Attributes

More information

BGP Best Path Selection Algorithm

BGP Best Path Selection Algorithm BGP Best Path Selection Algorithm Document ID: 13753 Contents Introduction Prerequisites Requirements Components Used Conventions Why Routers Ignore Paths How the Best Path Algorithm Works Example: BGP

More information

Administra0via. STP lab due Wednesday (in BE 301a!), 5/15 BGP quiz Thursday (remember required reading), 5/16

Administra0via. STP lab due Wednesday (in BE 301a!), 5/15 BGP quiz Thursday (remember required reading), 5/16 BGP Brad Smith Administra0via How are the labs going? This week STP quiz Thursday, 5/9 Next week STP lab due Wednesday (in BE 301a!), 5/15 BGP quiz Thursday (remember required reading), 5/16 Following

More information

BGP DDoS Mitigation. Gunter Van de Velde. Sr Technical Leader NOSTG, Cisco Systems. May 2013. 2012 Cisco and/or its affiliates. All rights reserved.

BGP DDoS Mitigation. Gunter Van de Velde. Sr Technical Leader NOSTG, Cisco Systems. May 2013. 2012 Cisco and/or its affiliates. All rights reserved. BGP DDoS Mitigation Gunter Van de Velde Sr Technical Leader NOSTG, Cisco Systems May 2013 2012 Cisco and/or its affiliates. All rights reserved. 1 A simple DDoS mitigation mechanism explained Bertrand

More information

NetFlow-Lite offers network administrators and engineers the following capabilities:

NetFlow-Lite offers network administrators and engineers the following capabilities: Solution Overview Cisco NetFlow-Lite Introduction As networks become more complex and organizations enable more applications, traffic patterns become more diverse and unpredictable. Organizations require

More information

Internetworking II: VPNs, MPLS, and Traffic Engineering

Internetworking II: VPNs, MPLS, and Traffic Engineering Internetworking II: VPNs, MPLS, and Traffic Engineering 3035/GZ01 Networked Systems Kyle Jamieson Lecture 10 Department of Computer Science University College London Taxonomy of communica@on networks Virtual

More information

Passively Detecting Remote Connectivity Issues Using Flow Accounting. 2nd EMANICS Workshop on Netflow/IPFIX usage in network management

Passively Detecting Remote Connectivity Issues Using Flow Accounting. 2nd EMANICS Workshop on Netflow/IPFIX usage in network management Passively Detecting Remote Connectivity Issues Using Flow Accounting 2nd EMANICS Workshop on Netflow/IPFIX usage in network management 08.10.2009 Jacobs University Bremen, Germany Tim Kleefass, Simon Leinen

More information

BGP Attributes and Path Selection

BGP Attributes and Path Selection BGP Attributes and Path Selection ISP Workshops Last updated 29 th March 2015 1 BGP Attributes BGP s policy tool kit 2 What Is an Attribute?... Next Hop AS Path MED...... p Part of a BGP Update p Describes

More information

NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes

NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes NetFlow Aggregation This document describes the Cisco IOS NetFlow Aggregation feature, which allows Cisco NetFlow users to summarize NetFlow export data on an IOS router before the data is exported to

More information

CS 457 Lecture 19 Global Internet - BGP. Fall 2011

CS 457 Lecture 19 Global Internet - BGP. Fall 2011 CS 457 Lecture 19 Global Internet - BGP Fall 2011 Decision Process Calculate degree of preference for each route in Adj-RIB-In as follows (apply following steps until one route is left): select route with

More information

Advanced BGP Policy. Advanced Topics

Advanced BGP Policy. Advanced Topics Advanced BGP Policy George Wu TCOM690 Advanced Topics Route redundancy Load balancing Routing Symmetry 1 Route Optimization Issues Redundancy provide multiple alternate paths usually multiple connections

More information

J-Flow on J Series Services Routers and Branch SRX Series Services Gateways

J-Flow on J Series Services Routers and Branch SRX Series Services Gateways APPLICATION NOTE Juniper Flow Monitoring J-Flow on J Series Services Routers and Branch SRX Series Services Gateways Copyright 2011, Juniper Networks, Inc. 1 APPLICATION NOTE - Juniper Flow Monitoring

More information

Exploiting BGP Scoping Services to Violate Internet Transit Policies

Exploiting BGP Scoping Services to Violate Internet Transit Policies This paper was presented as part of the 14th IEEE Global Internet Symposium (GI) 2011 at IEEE INFOCOM 2011 Exploiting BGP Scoping Services to Violate Internet Transit Policies Pierre Francois ICTEAM Université

More information

NetFlow/IPFIX Various Thoughts

NetFlow/IPFIX Various Thoughts NetFlow/IPFIX Various Thoughts Paul Aitken & Benoit Claise 3 rd NMRG Workshop on NetFlow/IPFIX Usage in Network Management, July 2010 1 B #1 Application Visibility Business Case NetFlow (L3/L4) DPI Application

More information

IP accounting reloaded, the pmacct project: NetFlow, sflow, SQL, RRD, stream classification and much more. Paolo Lucente <paolo at pmacct dot net>

IP accounting reloaded, the pmacct project: NetFlow, sflow, SQL, RRD, stream classification and much more. Paolo Lucente <paolo at pmacct dot net> IP accounting reloaded, the pmacct project: NetFlow, sflow, SQL, RRD, stream classification and much more Paolo Lucente UKNOF 6, Southampton, 19 Jan 2007 IP accounting reloaded,

More information

Cisco IOS Flexible NetFlow Technology

Cisco IOS Flexible NetFlow Technology Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application

More information

NetFlow Tracker Overview. Mike McGrath x ccie CTO mike@crannog-software.com

NetFlow Tracker Overview. Mike McGrath x ccie CTO mike@crannog-software.com NetFlow Tracker Overview Mike McGrath x ccie CTO mike@crannog-software.com 2006 Copyright Crannog Software www.crannog-software.com 1 Copyright Crannog Software www.crannog-software.com 2 LEVELS OF NETWORK

More information

! JANOG36!BoF!! maoke@bbix.net! paolo@pmacct.net!! JANOG36!mee:ng,!Kitakyushu!!Jul!2015!

! JANOG36!BoF!! maoke@bbix.net! paolo@pmacct.net!! JANOG36!mee:ng,!Kitakyushu!!Jul!2015! ! JANOG36!BoF!! maoke@bbix.net! paolo@pmacct.net!! JANOG36!mee:ng,!Kitakyushu!!Jul!2015! Introduc:on! JANOG36!mee:ng,!Kitakyushu!!Jul!2015! pmacct!is!openjsource,!free,!gpl ed!sooware! libpcap MySQL PgSQL

More information

- Multiprotocol Label Switching -

- Multiprotocol Label Switching - 1 - Multiprotocol Label Switching - Multiprotocol Label Switching Multiprotocol Label Switching (MPLS) is a Layer-2 switching technology. MPLS-enabled routers apply numerical labels to packets, and can

More information

Border Gateway Protocol BGP4 (2)

Border Gateway Protocol BGP4 (2) Border Gateway Protocol BGP4 (2) Professor Richard Harris School of Engineering and Advanced Technology (SEAT) Presentation Outline Border Gateway Protocol - Continued Computer Networks - 1/2 Learning

More information

Flow Analysis. Make A Right Policy for Your Network. GenieNRM

Flow Analysis. Make A Right Policy for Your Network. GenieNRM Flow Analysis Make A Right Policy for Your Network GenieNRM Why Flow Analysis? Resolve Network Managers Challenge as follow: How can I know the Detail and Real-Time situation of my network? How can I do

More information

Open Source in Network Administration: the ntop Project

Open Source in Network Administration: the ntop Project Open Source in Network Administration: the ntop Project Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:

More information

HP Networking BGP and MPLS technology training

HP Networking BGP and MPLS technology training Course overview HP Networking BGP and MPLS technology training (HL046_00429577) The HP Networking BGP and MPLS technology training provides networking professionals the knowledge necessary for designing,

More information

WAN Topologies MPLS. 2006, Cisco Systems, Inc. All rights reserved. Presentation_ID.scr. 2006 Cisco Systems, Inc. All rights reserved.

WAN Topologies MPLS. 2006, Cisco Systems, Inc. All rights reserved. Presentation_ID.scr. 2006 Cisco Systems, Inc. All rights reserved. MPLS WAN Topologies 1 Multiprotocol Label Switching (MPLS) IETF standard, RFC3031 Basic idea was to combine IP routing protocols with a forwarding algoritm based on a header with fixed length label instead

More information

How Routers Forward Packets

How Routers Forward Packets Autumn 2010 philip.heimer@hh.se MULTIPROTOCOL LABEL SWITCHING (MPLS) AND MPLS VPNS How Routers Forward Packets Process switching Hardly ever used today Router lookinginside the packet, at the ipaddress,

More information

sflow Why You Should Use It And Like It NANOG 39 February 04-07, 2007

sflow Why You Should Use It And Like It NANOG 39 February 04-07, 2007 sflow Why You Should Use It And Like It NANOG 39 February 04-07, 2007 Richard A. Steenbergen nlayer Communications, Inc. What is sflow? sflow is a standards based protocol for exporting

More information

and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs

and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs ICmyNet.Flow: NetFlow based traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF Faculty

More information

IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令

IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 1 内 容 流 量 分 析 简 介 IPv6 下 的 新 问 题 和 挑 战 协 议 格 式 变 更 用 户 行 为 特 征 变 更 安 全 问 题 演 化 流 量 导 出 手 段 变 化 设 备 参 考 配 置 流 量 工 具 总 结 2 流 量 分 析 简 介 流 量 分 析 目 标 who, what, where,

More information

NetStream (Integrated) Technology White Paper HUAWEI TECHNOLOGIES CO., LTD. Issue 01. Date 2012-9-6

NetStream (Integrated) Technology White Paper HUAWEI TECHNOLOGIES CO., LTD. Issue 01. Date 2012-9-6 (Integrated) Technology White Paper Issue 01 Date 2012-9-6 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means

More information

Netflow Overview. PacNOG 6 Nadi, Fiji

Netflow Overview. PacNOG 6 Nadi, Fiji Netflow Overview PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools

More information

Scalable Extraction, Aggregation, and Response to Network Intelligence

Scalable Extraction, Aggregation, and Response to Network Intelligence Scalable Extraction, Aggregation, and Response to Network Intelligence Agenda Explain the two major limitations of using Netflow for Network Monitoring Scalability and Visibility How to resolve these issues

More information

BGP Convergence in much less than a second Clarence Filsfils - cf@cisco.com

BGP Convergence in much less than a second Clarence Filsfils - cf@cisco.com BGP Convergence in much less than a second Clarence Filsfils - cf@cisco.com 1 Down Convergence T1 Down Convergence T2 Default metric = 1 Src R R 20 F Dst Link L Assume a flow from Src to Dest T1: when

More information

Monitoring high-speed networks using ntop. Luca Deri <deri@ntop.org>

Monitoring high-speed networks using ntop. Luca Deri <deri@ntop.org> Monitoring high-speed networks using ntop Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:

More information

Network Monitoring and Management NetFlow Overview

Network Monitoring and Management NetFlow Overview Network Monitoring and Management NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)

More information

BGP: Frequently Asked Questions

BGP: Frequently Asked Questions BGP: Frequently Asked Questions Document ID: 5816 Contents Introduction How do I configure BGP? How do I configure BGP with the use of a loopback address? What is the order of preference of attributes

More information

IPv6 over MPLS VPN. Contents. Prerequisites. Document ID: 112085. Requirements

IPv6 over MPLS VPN. Contents. Prerequisites. Document ID: 112085. Requirements IPv6 over MPLS VPN Document ID: 112085 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram VRF Configuration Multiprotocol BGP (MP BGP) Configuration

More information

plixer Scrutinizer Competitor Worksheet Visualization of Network Health Unauthorized application deployments Detect DNS communication tunnels

plixer Scrutinizer Competitor Worksheet Visualization of Network Health Unauthorized application deployments Detect DNS communication tunnels Scrutinizer Competitor Worksheet Scrutinizer Malware Incident Response Scrutinizer is a massively scalable, distributed flow collection system that provides a single interface for all traffic related to

More information

Understanding Route Redistribution & Filtering

Understanding Route Redistribution & Filtering Understanding Route Redistribution & Filtering When to Redistribute and Filter PAN-OS 5.0 Revision B 2013, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Overview... 3 Route Redistribution......

More information

Understanding Route Aggregation in BGP

Understanding Route Aggregation in BGP Understanding Route Aggregation in BGP Document ID: 5441 Contents Introduction Prerequisites Requirements Components Used Conventions Network Diagram Aggregate Without the as set Argument Aggregate with

More information

BGP Basics. BGP Uses TCP 179 ibgp - BGP Peers in the same AS ebgp - BGP Peers in different AS's. 64512-65535 Private BGP ASN. BGP Router Processes

BGP Basics. BGP Uses TCP 179 ibgp - BGP Peers in the same AS ebgp - BGP Peers in different AS's. 64512-65535 Private BGP ASN. BGP Router Processes BGP Basics BGPv4 - RFC 4271 - IPv6 support Path vector routing protocol EGP Routing between AS'es Classless Transit Area - Area used to reach other areas. Requires full routing table (no default routes).

More information

Introduction to Netflow

Introduction to Netflow Introduction to Netflow Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)

More information

Understanding Virtual Router and Virtual Systems

Understanding Virtual Router and Virtual Systems Understanding Virtual Router and Virtual Systems PAN- OS 6.0 Humair Ali Professional Services Content Table of Contents VIRTUAL ROUTER... 5 CONNECTED... 8 STATIC ROUTING... 9 OSPF... 11 BGP... 17 IMPORT

More information

Atsushi Kobayashi Yutaka Hirokawa Hiroshi Kurakami NTT Information Sharing Laboratories

Atsushi Kobayashi Yutaka Hirokawa Hiroshi Kurakami NTT Information Sharing Laboratories SASUKE Traffic Monitoring Tool Traffic Shift Monitoring Based on Correlation between BGP Messages and Flow Data Atsushi Kobayashi Yutaka Hirokawa Hiroshi Kurakami NTT Information Sharing Laboratories 1

More information

Simple Multihoming. ISP Workshops. Last updated 30 th March 2015

Simple Multihoming. ISP Workshops. Last updated 30 th March 2015 Simple Multihoming ISP Workshops Last updated 30 th March 2015 1 Why Multihome? p Redundancy n One connection to internet means the network is dependent on: p Local router (configuration, software, hardware)

More information

Flow Analysis Versus Packet Analysis. What Should You Choose?

Flow Analysis Versus Packet Analysis. What Should You Choose? Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation

More information

Exterior Gateway Protocols (BGP)

Exterior Gateway Protocols (BGP) Exterior Gateway Protocols (BGP) Internet Structure Large ISP Large ISP Stub Dial-Up ISP Small ISP Stub Stub Stub Autonomous Systems (AS) Internet is not a single network! The Internet is a collection

More information

Internetworking II: MPLS, Security, and Traffic Engineering

Internetworking II: MPLS, Security, and Traffic Engineering Internetworking II: MPLS, Security, and Traffic Engineering 3035/GZ01 Networked Systems Kyle Jamieson Department of Computer Science University College London Last Fme: Internetworking IP interconnects

More information

IPv6 network management. Where and when?

IPv6 network management. Where and when? IPv6 network management 1 Contributions Simon Muyal, RENATER Bernard Tuy, RENATER Jérôme Durand, RENATER Ralf Wolter, Cisco Patrick Grossetête, Cisco Munechika Sumikawa, Hitachi Patrick Paul, 6WIND 2 Agenda

More information

TE in action. Some problems that TE tries to solve. Concept of Traffic Engineering (TE)

TE in action. Some problems that TE tries to solve. Concept of Traffic Engineering (TE) 1/28 2/28 TE in action S-38.3192 Verkkopalvelujen tuotanto S-38.3192 Network Service Provisioning Networking laboratory 3/28 4/28 Concept of Traffic Engineering (TE) Traffic Engineering (TE) (Traffic Management)

More information

Border Gateway Protocol (BGP)

Border Gateway Protocol (BGP) Border Gateway Protocol (BGP) Petr Grygárek rek 1 Role of Autonomous Systems on the Internet 2 Autonomous systems Not possible to maintain complete Internet topology information on all routers big database,

More information

Cisco Catalyst 4948E NetFlow- lite

Cisco Catalyst 4948E NetFlow- lite Cisco Catalyst 4948E NetFlow- lite Applica6on Visibility in Data Center Why Applica+on Visibility in Data Center Efficient Opera+on What applica6ons are consuming bandwidth Who is using them When they

More information

BGP FORGOTTEN BUT USEFUL FEATURES. Piotr Wojciechowski (CCIE #25543)

BGP FORGOTTEN BUT USEFUL FEATURES. Piotr Wojciechowski (CCIE #25543) BGP FORGOTTEN BUT USEFUL FEATURES Piotr Wojciechowski (CCIE #25543) ABOUT ME Senior Network Engineer MSO at VeriFone Inc. Previously Network Solutions Architect at one of top polish IT integrators CCIE

More information

MPLS-based Layer 3 VPNs

MPLS-based Layer 3 VPNs MPLS-based Layer 3 VPNs Overall objective The purpose of this lab is to study Layer 3 Virtual Private Networks (L3VPNs) created using MPLS and BGP. A VPN is an extension of a private network that uses

More information

Load balancing and traffic control in BGP

Load balancing and traffic control in BGP DD2491 p2 2011 Load balancing and traffic control in BGP Olof Hagsand KTH CSC 1 Issues in load balancing Load balancing: spread traffic on several paths instead of a single. Why? Use resources better Can

More information

Using OSPF in an MPLS VPN Environment

Using OSPF in an MPLS VPN Environment Using OSPF in an MPLS VPN Environment Overview This module introduces the interaction between multi-protocol Border Gateway Protocol (MP-BGP) running between Provider Edge routers (s) and Open Shortest

More information

DD2491 p1 2008. Load balancing BGP. Johan Nicklasson KTHNOC/NADA

DD2491 p1 2008. Load balancing BGP. Johan Nicklasson KTHNOC/NADA DD2491 p1 2008 Load balancing BGP Johan Nicklasson KTHNOC/NADA Dual home When do you need to be dual homed? How should you be dual homed? Same provider. Different providers. What do you need to have in

More information

8. 網路流量管理 Network Traffic Management

8. 網路流量管理 Network Traffic Management 8. 網路流量管理 Network Traffic Management Measurement vs. Metrics end-to-end performance topology, configuration, routing, link properties state active measurements active routes active topology link bit error

More information

RFC 2547bis: BGP/MPLS VPN Fundamentals

RFC 2547bis: BGP/MPLS VPN Fundamentals White Paper RFC 2547bis: BGP/MPLS VPN Fundamentals Chuck Semeria Marketing Engineer Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA 408 745 2001 or 888 JUNIPER www.juniper.net

More information

Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data

Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides

More information

How To Understand Bg

How To Understand Bg Table of Contents BGP Case Studies...1 BGP4 Case Studies Section 1...3 Contents...3 Introduction...3 How Does BGP Work?...3 ebgp and ibgp...3 Enabling BGP Routing...4 Forming BGP Neighbors...4 BGP and

More information

IPv6 and 4-byte ASN Update

IPv6 and 4-byte ASN Update IPv6 and 4-byte ASN Update Philip Smith PacNOG 8 Pohnpei, FSM 22nd-27th November 2010 1 IPv6 Update 2 2004 Today Resurgence in demand for IPv4 address space 5% address space still unallocated

More information

IPv6 network management. 6DEPLOY. IPv6 Deployment and Support

IPv6 network management. 6DEPLOY. IPv6 Deployment and Support IPv6 network management 6DEPLOY. IPv6 Deployment and Support 1 Contributions Simon Muyal, RENATER Bernard Tuy, RENATER Jérôme Durand, RENATER Ralf Wolter, Cisco Patrick Grossetête, Cisco 10/28/2010 IPv6

More information

Introduction to MPLS-based VPNs

Introduction to MPLS-based VPNs Introduction to MPLS-based VPNs Ferit Yegenoglu, Ph.D. ISOCORE ferit@isocore.com Outline Introduction BGP/MPLS VPNs Network Architecture Overview Main Features of BGP/MPLS VPNs Required Protocol Extensions

More information

Tutorial: Options for Blackhole and Discard Routing. Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia

Tutorial: Options for Blackhole and Discard Routing. Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia Tutorial: Options for Blackhole and Discard Routing Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia Caveats and Assumptions The views presented here are those of the authors and they do not

More information

Traffic Monitoring using sflow

Traffic Monitoring using sflow Making the Network Visible www.sflow.org Traffic Monitoring using sflow With the ever-increasing reliance on network services for business critical applications, the smallest change in network usage can

More information

MPLS. Cisco MPLS. Cisco Router Challenge 227. MPLS Introduction. The most up-to-date version of this test is at: http://networksims.com/i01.

MPLS. Cisco MPLS. Cisco Router Challenge 227. MPLS Introduction. The most up-to-date version of this test is at: http://networksims.com/i01. MPLS Cisco MPLS MPLS Introduction The most up-to-date version of this test is at: http://networksims.com/i01.html Cisco Router Challenge 227 Outline This challenge involves basic frame-mode MPLS configuration.

More information

E6998-02: Internet Routing

E6998-02: Internet Routing E6998-02: Internet Routing Lecture 13 Border Gateway Protocol, Part II John Ioannidis AT&T Labs Research ji+ir@cs.columbia.edu Copyright 2002 by John Ioannidis. All Rights Reserved. Announcements Lectures

More information

Agenda. sflow intro. sflow architecture. sflow config example. Summary

Agenda. sflow intro. sflow architecture. sflow config example. Summary sflow Features Agenda sflow intro. sflow architecture sflow config example Summary 1 What is sflow? sflow is a technology for monitoring traffic in data networks containing switches and routers. S9700

More information

Introduction to Cisco IOS Flexible NetFlow

Introduction to Cisco IOS Flexible NetFlow Introduction to Cisco IOS Flexible NetFlow Last updated: September 2008 The next-generation in flow technology allowing optimization of the network infrastructure, reducing operation costs, improving capacity

More information

CCT vs. CCENT Skill Set Comparison

CCT vs. CCENT Skill Set Comparison Operation of IP Data Networks Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs Select the components required to meet a given network specification

More information

IK2205 Inter-domain Routing

IK2205 Inter-domain Routing IK2205 Inter-domain Routing Lecture 5 Voravit Tanyingyong, voravit@kth.se Outline Redundancy, Symmetry, and Load Balancing Redundancy Symmetry Load balancing Scenarios Controlling Routing Inside the AS

More information

Interdomain Routing. Project Report

Interdomain Routing. Project Report Interdomain Routing Project Report Network Infrastructure improvement proposal To Company A Team 4: Zhang Li Bin Yang Md. Safiqul Islam Saurabh Arora Network Infrastructure Improvement Interdomain routing

More information

BGP Link Bandwidth. Finding Feature Information. Prerequisites for BGP Link Bandwidth

BGP Link Bandwidth. Finding Feature Information. Prerequisites for BGP Link Bandwidth The Border Gateway Protocol (BGP) Link Bandwidth feature is used to advertise the bandwidth of an autonomous system exit link as an extended community. This feature is configured for links between directly

More information

Data Center Use Cases and Trends

Data Center Use Cases and Trends Data Center Use Cases and Trends Amod Dani Managing Director, India Engineering & Operations http://www.arista.com Open 2014 Open Networking Networking Foundation India Symposium, January 31 February 1,

More information

Module 12 Multihoming to the Same ISP

Module 12 Multihoming to the Same ISP Module 12 Multihoming to the Same ISP Objective: To investigate various methods for multihoming onto the same upstream s backbone Prerequisites: Module 11 and Multihoming Presentation The following will

More information

basic BGP in Huawei CLI

basic BGP in Huawei CLI basic BGP in Huawei CLI BGP stands for Border Gateway Protocol. It is widely used among Internet Service Providers to make core routing decisions on the Internet. The current BGP version is BGP-4 defined

More information

Transitioning to BGP. ISP Workshops. Last updated 24 April 2013

Transitioning to BGP. ISP Workshops. Last updated 24 April 2013 Transitioning to BGP ISP Workshops Last updated 24 April 2013 1 Scaling the network How to get out of carrying all prefixes in IGP 2 Why use BGP rather than IGP? p IGP has Limitations: n The more routing

More information

Claudio Jeker. RIPE 41 Meeting Amsterdam, 15. January 2002. oppermann@pipeline.ch. jeker@n-r-g.com. Using BGP topology information for DNS RR sorting

Claudio Jeker. RIPE 41 Meeting Amsterdam, 15. January 2002. oppermann@pipeline.ch. jeker@n-r-g.com. Using BGP topology information for DNS RR sorting BGPDNS Using BGP topology information for DNS RR sorting a scalable way of multi-homing André Oppermann oppermann@pipeline.ch Claudio Jeker jeker@n-r-g.com RIPE 41 Meeting Amsterdam, 15. January 2002 What

More information

Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export

Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export Last Updated: November 28, 2011 This module contains the minimum amount of information about and instructions necessary for configuring

More information

Introduction Inter-AS L3VPN

Introduction Inter-AS L3VPN Introduction Inter-AS L3VPN 1 Extending VPN services over Inter-AS networks VPN Sites attached to different MPLS VPN Service Providers How do you distribute and share VPN routes between ASs Back- to- Back

More information

CISCO INFORMATION TECHNOLOGY AT WORK CASE STUDY: CISCO IOS NETFLOW TECHNOLOGY

CISCO INFORMATION TECHNOLOGY AT WORK CASE STUDY: CISCO IOS NETFLOW TECHNOLOGY CISCO INFORMATION TECHNOLOGY AT WORK CASE STUDY: CISCO IOS NETFLOW TECHNOLOGY CISCO INFORMATION TECHNOLOGY SEPTEMBER 2004 1 Overview Challenge To troubleshoot capacity and quality problems and to understand

More information

Building A Cheaper Peering Router. (Actually it s more about buying a cheaper router and applying some routing tricks)

Building A Cheaper Peering Router. (Actually it s more about buying a cheaper router and applying some routing tricks) Building A Cheaper Peering Router (Actually it s more about buying a cheaper router and applying some routing tricks) Tom Scholl nlayer Communications, Inc. 1 What s this all about?

More information

Fast Re-Route in IP/MPLS networks using Ericsson s IP Operating System

Fast Re-Route in IP/MPLS networks using Ericsson s IP Operating System Fast Re-Route in IP/MPLS networks using s IP Operating System Introduction: Today, Internet routers employ several routing protocols to exchange routes. As a router learns its potential routes, it builds

More information

DD2491 p1 2008. Inter-domain routing and BGP part I Olof Hagsand KTH/CSC

DD2491 p1 2008. Inter-domain routing and BGP part I Olof Hagsand KTH/CSC DD2491 p1 2008 Inter-domain routing and BGP part I Olof Hagsand KTH/CSC Inter-domain routing The objective of inter-domain routing is to bind together all the thousands of independent IP networks that

More information

Network congestion control using NetFlow

Network congestion control using NetFlow Network congestion control using NetFlow Maxim A. Kolosovskiy Elena N. Kryuchkova Altai State Technical University, Russia Abstract The goal of congestion control is to avoid congestion in network elements.

More information

MONITORING NETWORK TRAFFIC USING sflow TECHNOLOGY ON EX SERIES ETHERNET SWITCHES

MONITORING NETWORK TRAFFIC USING sflow TECHNOLOGY ON EX SERIES ETHERNET SWITCHES APPLICATION NOTE MONITORING NETWORK TRAFFIC USING sflow TECHNOLOGY ON EX SERIES ETHERNET SWITCHES Exporting sflow to Collectors Through a Separate Virtual Routing Instance Copyright 2010, Juniper Networks,

More information

How To Make A Network Secure

How To Make A Network Secure 1 2 3 4 -Lower yellow line is graduate student enrollment -Red line is undergradate enrollment -Green line is total enrollment -2008 numbers are projected to be near 20,000 (on-campus) not including distance

More information

Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting

Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Document ID: 70974 Introduction Prerequisites Requirements Components Used Conventions Background Information Configure Network Diagram

More information

Network traffic monitoring and management. Sonia Panchen sonia.panchen@inmon.com 11 th November 2010

Network traffic monitoring and management. Sonia Panchen sonia.panchen@inmon.com 11 th November 2010 Network traffic monitoring and management Sonia Panchen sonia.panchen@inmon.com 11 th November 2010 Lecture outline What is network traffic management? Traffic management applications Traffic monitoring

More information