High-speed Network and Service Monitoring. Luca Deri
|
|
|
- Cody Boone
- 8 years ago
- Views:
Transcription
1 High-speed Network and Service Monitoring Luca Deri
2 Who s ntop.org? Started in 1998 as open-source monitoring project for developing an easy to use passive monitoring application. Several project spin-off Accelerated packet capture 1 and 10 Gbit packet capture NetFlow/sFlow probes Peer-to-Peer VPN (n2n) 2
3 ntop.org at a Glance 3
4 Who is Using ntop Products? 4
5 Some Challenges SNMP is good for element management (e.g. router and server monitoring) but poor for traffic measurement. Not all routers/switches speak NetFlow/ sflow: we need to deploy soft probes. 1 and 10 Gbit networks can produce a lot of monitoring data: our monitoring apps must be able to handle all this traffic. 5
6 Networks are Changing [1/2] Wireless Edge Intranet Internet Central Mgmt Core Distribution Wired Edge 6
7 Networks are Changing [2/2] Without edge control there s no real network control. Central traffic monitoring isn t enough anymore: not all traffic flows through the center. Edge equipment is often very basic and it means that there s no visibility at the edge: think about this before purchasing your network equipment. 7
8 Typical Monitoring Deployment: LAN 8
9 Typical Monitoring Deployment: Internet Traffic 9
10 Typical Monitoring Deployment: Cloud and Intra-VM Monitoring 10
11 Some Lessons Learnt In order to monitoring the traffic we need to deploy a probe where the traffic is flowing. We need to make sure we can handle both NetFlow and sflow if we want to have complete network visibility. Cloud computing and server virtualization push us to monitor in-vm virtual networks. 11
12 How can ntop.org help me? ntop can act as central network monitoring console. nprobe can act as sflow and NetFlow proxy/probe/collector. 10 Gbit packet capture acceleration and filtering, in host and VMs, using PF_RING. Ability to query billion of flows with subsecond response time. 12
13 ntop: A Web-based Monitoring Console 13
14 What is ntop? 14
15 Network Inventory 15
16 Traffic Trends 16
17 Host Health 17
18 VoIP Support 18
19 ntop Scripting using Python HTTP(S) <html> </body>... </body> </html> handlepythonhttprequest(...) 19
20 Where is my traffic going to? 20
21 Flow-based Traffic Monitoring: nprobe 21
22 nprobe: IPFIX/NetFlow Probe sflow NetFlow Packet Capture nprobe Flow Export Data Dump Raw Files / MySQL / SQLite / FastBit 22
23 nprobe: Main Features Ability to keep up with Gbit speeds on Ethernet networks handling thousand of packets per second without packet sampling on commodity hardware. Support for major OS including Unix, Windows and MacOS X. Full NetFlow v9/ipfix and sflow (no probe) support V9 extensions: payload, network/application latency, VoIP, RTP. Ability to extend the probe with user-written plugins. BGP Peering with the router for full AS monitoring. 23
24 Problem Statement [1/2] NetFlow and sflow are the current state-of-theart standard for network traffic monitoring. As the number of generated flows can be quite high, operators often use sampling in order to reduce their number. Sampling leads to inaccuracy so it cannot always be used in production networks. Thus network operators have to face the problem of collecting and analyzing a large number of flow records. 24
25 Problem Statement [2/2] Where to store collected flows? Relational Databases Pros: Expressiveness of SQL for data search. Cons: Sacrifice flow collection speed and query response time. Raw Disk Archives Pros: Efficient flow-to-disk collection speed (> 250K flow/s). Cons: Limited query facilities as well search time proportional to the amount of collected data (i.e. no indexing is used). 25
26 What are we looking for? Ability to execute multidimensional queries on arbitrary large amounts of data with response time in the order of seconds (in many cases, milliseconds). Efficient yet simple flow record storage architecture in terms of disk space, query response time, and data collection duration. A system that operates on raw flow records without first reducing or summarizing them. The reduction of the time needed to explore a large dataset and the possibility to display query results in realtime, making the exploration process truly interactive. 26
27 nprobe + FastBit FastBit is not a database but a C++ library that implements efficient bitmap indexing methods. Data is represented as tables with rows and columns. A large table may be partitioned into many data partitions and each of them is stored on a distinct directory, with each column stored as a separated file in raw binary form. nprobe natively integrates FastBit support and it automatically creates the DB schema according to the flow records template. When a partition is fully dumped, columns to be indexed are first sorted then indexed. 27
28 Handling Billion of Flows nprobe+fastbit vs MySQL Query MySQL nprobe + FastBit Q Q Q Q Q nprobe+fastbit vs nfdump nprobe+fastbit nfdump All measurements are in seconds 28
29 How to Add Geolocation Data [1/2] Routers are unable to export any geolocation information. NetFlow/IPFIX flows do not contain any information about geolocation into standard flow formats. Solution: Let the collector add geolocation information to flows received by routers Let nprobe export this information to collectors. 29
30 How to Add Geolocation Data [2/2] nprobe takes advantage of GeoIP library (GPL) to: Add geolocation information to flows Map IP addresses to ASN (Autonomous System Numbers) for adding ASN awareness. GeoIPASNum.dat (ASN) GeoLiteCity.dat (GeoLocation) 30
31 BGP Data Integration [1/2] nprobe Patricia Tree TCP Juniper Router BGP4 BGP Client (Net-BGP) Initial BGP Table Dump Live BGP Update 31
32 BGP Data Integration [2/2] # Constructor $update = Net::BGP::Update->new( NLRI => [ qw( 10/ /16 ) ], Withdraw => [ qw( / / /32 ) ], # For Net::BGP::NLRI Aggregator => [ 64512, ' ' ], AsPath => [ 64512, 64513, ], AtomicAggregate => 1, Communities => [ qw( 64512: :10001 ) ], LocalPref => 100, MED => 200, NextHop => ' ', Origin => INCOMPLETE, ); 32
33 nprobe: HTTP Traffic Analysis Plugin HTTP Protocol Dissector templates: [NFv ][IPFIX ] %HTTP_URL HTTP URL [NFv ][IPFIX ] %HTTP_RET_CODE HTTP return code (e.g. 200, ) [NFv ][IPFIX ] %HTTP_REFERER HTTP Referer [NFv ][IPFIX ] %HTTP_UA HTTP User Agent [NFv ][IPFIX ] %HTTP_MIME HTTP Mime Type # # Client Server Protocol Method URL HTTPReturnCode Location Referer UserAgent ContentType Bytes BeginTime EndTime Flow Hash Cookie Terminator ApplLatency # api.leoslyrics.com http GET /api_search.php?auth=mindquirk_harmonic&artist=franco +Battiato&songtitle=Povera+Patria 200 curl/ (powerpc-apple-darwin8.0) libcurl/ OpenSSL/0.9.7i zlib/1.2.3 text/xml C elyrics.net http GET /go/f/franco-battiato-lyrics/povera-patria-lyrics/ curl/ (powerpc-apple-darwin8.0) libcurl/ OpenSSL/0.9.7i zlib/ text/html S http GET /images/filewave01.gif Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/ (KHTML, like Gecko) Safari/ image/gif S http GET /images/iwas01b.gif Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/ (KHTML, like Gecko) Safari/ image/gif S http GET /images/filewave02.gif Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/ (KHTML, like Gecko) Safari/ image/gif S http GET / 200 Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/ (KHTML, like Gecko) Safari/ text/html S
34 nprobe: VoIP Traffic Analysis Plugin RTP templates: [NFv ][IPFIX ] %RTP_FIRST_SSRC First flow RTP Sync Source ID [NFv ][IPFIX ] %RTP_FIRST_TS First flow RTP timestamp [NFv ][IPFIX ] %RTP_LAST_SSRC Last flow RTP Sync Source ID [NFv ][IPFIX ] %RTP_LAST_TS Last flow RTP timestamp [NFv ][IPFIX ] %RTP_IN_JITTER RTP Jitter (ms * 1000) [NFv ][IPFIX ] %RTP_OUT_JITTER RTP Jitter (ms * 1000) [NFv ][IPFIX ] %RTP_IN_PKT_LOST Packet lost in stream [NFv ][IPFIX ] %RTP_OUT_PKT_LOST Packet lost in stream [NFv ][IPFIX ] %RTP_OUT_PAYLOAD_TYPE RTP payload type [NFv ][IPFIX ] %RTP_IN_MAX_DELTA Max delta (ms*100) between consecutive pkts [NFv ][IPFIX ] %RTP_OUT_MAX_DELTA Max delta (ms*100) between consecutive pkts Plugin SIP templates: [NFv ][IPFIX ] %SIP_CALL_ID [NFv ][IPFIX ] %SIP_CALLING_PARTY [NFv ][IPFIX ] %SIP_CALLED_PARTY [NFv ][IPFIX ] %SIP_RTP_CODECS [NFv ][IPFIX ] %SIP_INVITE_TIME [NFv ][IPFIX ] %SIP_TRYING_TIME [NFv ][IPFIX ] %SIP_RINGING_TIME [NFv ][IPFIX ] %SIP_OK_TIME [NFv ][IPFIX ] %SIP_BYE_TIME [NFv ][IPFIX ] %SIP_RTP_SRC_IP [NFv ][IPFIX ] %SIP_RTP_SRC_PORT [NFv ][IPFIX ] %SIP_RTP_DST_IP [NFv ][IPFIX ] %SIP_RTP_DST_PORT SIP call-id SIP Call initiator SIP Called party SIP RTP codecs SIP SysUptime (msec) of INVITE SIP SysUptime (msec) of Trying SIP SysUptime (msec) of RINGING SIP SysUptime (msec) of OK SIP SysUptime (msec) of BYE SIP RTP stream source IP SIP RTP stream source port SIP RTP stream dest IP SIP RTP stream dest port 34
35 nprobe: Further Traffic Analysis Plugin DNS Protocol Dissector templates: [NFv ][IPFIX ] %DNS_QUERY [NFv ][IPFIX ] %DNS_QUERY_ID [NFv ][IPFIX ] %DNS_QUERY_TYPE [NFv ][IPFIX ] %DNS_RET_CODE [NFv ][IPFIX ] %DNS_NUM_ANSWER DNS QUERY DNS query transaction Id DNS query type (e.g. 1=A,2=NS) DNS return code DNS # of returned answers Plugin MySQL Plugin templates: [NFv ][IPFIX ] %MYSQL_SERVER_VERSION MySQL server version [NFv ][IPFIX ] %MYSQL_USERNAME MySQL username [NFv ][IPFIX ] %MYSQL_DB MySQL database in use [NFv ][IPFIX ] %MYSQL_QUERY MySQL Query [NFv ][IPFIX ] %MYSQL_RESPONSE MySQL server response 35
36 nprobe: Network Performance and Response Time 36
37 nprobe: Network Awareness 37
38 How can I Improve my Internet Presence? 38
39 Interactive Data Search 39
40 Packet Capture Acceleration: PF_RING 40
41 Socket Packet Ring (PF_RING) Application A Application Z mmap() Outgoing Packets Userspace Kernel Read Index Socket (ring) Write Index Socket (ring) PF_RING Network Adapter Incoming Packets 41
42 PF_RING: Benefits It creates a straight path for incoming packets in order to make them first-class citizens. No need to use custom network cards: any card is supported. Transparent to applications: legacy applications need to be recompiled in order to use it. No kernel or low-level programming is required. Developers familiar with network applications can immediately take advantage of it without having to learn new APIs. 42
43 PF_RING Packet Journey [1/2] Packet Received Parse Packet (up to layer 4) Defragment packet (optional) Same as above for PF_RING socket clusters Added the packet to PF_RING sockets that potentially match it (packet and socket device match) Return control to the kernel 43
44 PF_RING Packet Journey [2/2] Add Packet to PF_RING Packet Filtering Sampling Rate Check Queue Packet on PF_RING PF_RING Reflector Check Back to PF_RING 44
45 PF_RING in VMs: vpf_ring KVM Hypervisor VM Guest vpf_ring KVM Kernel Modules Userspace Kernel PF_RING 45
46 PF_RING Packet-to-Disk: n2disk n2disk Controller Commands Responses Notifications Userspace Kernel Packet Buffer Kernel Thread PF_RING VFS n2disk n2disk (only userland) n2disk (kernel+userland) 750 Kpps Quad-Xeon with 8 RAID disks 650 Kpps Atom with single SATA Disk 46
47 Towards 10 Gbit Monitoring 47
48 Modern Networking Architectures 48
49 Scaling to 10 Gbit: Divide et Impera CPU manufacturers are scaling with multicore. Multicore equations: - more cores = more total CPU power - more cores = less single core power Software scales with multicore only if it can exploit it: - multiprocess or multithread A simply faster 10 Gbit NIC is not enough: - one 10G card means that several threads need to compete for packets hence that a lot of time will be wasted on semaphores 49
50 Multicore+Networking Design Flaws Thread Thread Thread Thread nprobe Userland Single Resource Competition Linux Device Driver Merge & Split Sequential Queue Polling RX Queue RX Queue RX Queue RX Queue MSI-X RSS (Resource Side Scaling) 10 Gbit PHY 50
51 PF_RING+TNAPI No Mutex Needed Userland Thread Thread Thread Thread Virtual PF_RING Ethernet Queue PF_RING Threaded Polling RX Queue RX Queue RX Queue RX Queue RSS (Resource Side Scaling) [Hardware per-flow Balancing] 1 Gbit / 10 Gbit NIC TNAPI 51
52 Intel Ethernet Controller [1/2] Latest generation of Intel 10 Gbit Ethernet Controller. Ability do define up to perfect rules per port (unlimited hashing rules). Commodity adapter (<350 USD/port). Hardware support for virtualization (i.e. in-nic L2 Switch) and multi RX/TX queues. Limitation: OSs exploits only basic NIC capabilities. 52
53 Intel Ethernet Controller [2/2] In packet filtering is performed in hardware at wire rate. Filtering is necessary to decide to which RX queue a packet must be assigned. Assigning a packet to a non-existing RX queue (<= number of available CPU cores) drops the packet. 53
54 Using Hardware Filters in Real Life Signaling-based realtime multimedia (e.g. VoIP, IPTV) monitoring. Network Troubleshooting: Wireshark. Traffic Classification and Balancing. Lawful Interception of IP Traffic. 10 Gbit Firewalling. 54
55 Towards 10 Gbit Snorting User space Kernel space PF_RING RX 0 Queue RX 1 Queue RX 2 Queue RX 3 Queue Packets Filtering Rules (via PF_RING DAQ) RSS (Resource Side Scaling) 1-10 Gbit PHY 55
56 Divide et Impera Network Monitoring Servers Selective Packet Drop on Gbit Traffic Splitter / Switch 10 Gbit Ingress Stream 56
57 References Home Page: Platforms: Win32 (except PF_RING) and Unix. License: Gnu Public License (GPL) and Commercial. 57
Who is Generating all This Traffic?
Who is Generating all This Traffic? Network Monitoring in Practice Luca Deri Who s ntop.org? Started in 1998 as open-source monitoring project for developing an easy to use passive monitoring
10 Gbit Hardware Packet Filtering Using Commodity Network Adapters. Luca Deri <deri@ntop.org> Joseph Gasparakis <joseph.gasparakis@intel.
10 Gbit Hardware Packet Filtering Using Commodity Network Adapters Luca Deri Joseph Gasparakis 10 Gbit Monitoring Challenges [1/2] High number of packets to
Open Source in Network Administration: the ntop Project
Open Source in Network Administration: the ntop Project Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:
Monitoring high-speed networks using ntop. Luca Deri <deri@ntop.org>
Monitoring high-speed networks using ntop Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:
Application Latency Monitoring using nprobe
Application Latency Monitoring using nprobe Luca Deri Problem Statement Users demand services measurements. Network boxes provide simple, aggregated network measurements. You cannot always
Getting More Information On Your Network Performance
Getting More Information On Your Network Performance Luca Deri Network Traffic is a Moving Target For years network administrators have identified traffic protocols and services using IP
Open Source VoIP Traffic Monitoring
Open Source VoIP Traffic Monitoring Luca Deri Why VoIP is a Hot Topic? Thanks to open source projects (e.g. Asterisk, Gizmo), and custom Linux distributions (e.g. Asterisk@Home) setting up a VoIP
Towards 100 Gbit Flow-Based Network Monitoring. Luca Deri <deri@ntop.org> Alfredo Cardigliano <cardigliano@ntop.org>
Towards 100 Gbit Flow-Based Network Monitoring Luca Deri Alfredo Cardigliano Outlook 1.Motivation: Towards 100 Gbit Traffic Monitoring 2.Our Heritage: ntop Tools
From traditional to alternative approach to storage and analysis of flow data. Petr Velan, Martin Zadnik
From traditional to alternative approach to storage and analysis of flow data Petr Velan, Martin Zadnik Introduction Network flow monitoring Visibility of network traffic Flow analysis and storage enables
Wire-speed Packet Capture and Transmission
Wire-speed Packet Capture and Transmission Luca Deri Packet Capture: Open Issues Monitoring low speed (100 Mbit) networks is already possible using commodity hardware and tools based on libpcap.
High-Speed Network Traffic Monitoring Using ntopng. Luca Deri @lucaderi
High-Speed Network Traffic Monitoring Using ntopng Luca Deri @lucaderi Some History In 1998, the original ntop has been created. It was a C-based app embedding a web server able to capture traffic and
Open Source VoIP Traffic Monitoring
Open Source VoIP Traffic Monitoring Luca Deri What is VoIP? VoIP is the routing of voice conversations over the Internet or through any other IP-based network (Wikipedia). Advantages: It allows
Increasing Data Center Network Visibility with Cisco NetFlow-Lite
Increasing Data Center Network Visibility with Cisco NetFlow-Lite Luca Deri ntop, IIT-CNR Pisa, Italy deri@ntop.org Ellie Chou, Zach Cherian, Kedar Karmarkar Cisco Systems San Jose, CA, USA {wjchou, zcherian,
Increasing Data Center Network Visibility with Cisco NetFlow-Lite
Increasing Data Center Network Visibility with Cisco NetFlow-Lite Luca Deri ntop, IIT-CNR Pisa, Italy deri@ntop.org Ellie Chou, Zach Cherian, Kedar Karmarkar Cisco Systems San Jose, CA, USA {wjchou, zcherian,
Best of Breed of an ITIL based IT Monitoring. The System Management strategy of NetEye
Best of Breed of an ITIL based IT Monitoring The System Management strategy of NetEye by Georg Kostner 5/11/2012 1 IT Services and IT Service Management IT Services means provisioning of added value for
Monitoring Network Traffic using ntopng
Monitoring Network Traffic using ntopng Luca Deri Outlook What are the main activities of ntop.org? ntop s view on network monitoring. From ntop to ntopng. ntopng architecture and design.
Large-Scale Flow Monitoring Through Open Source Software
Large-Scale Flow Monitoring Through Open Source Software Luca Deri 1 Monitoring Goals Analysis of LAN and WAN Traffic Unaggregated raw data storage for the near past (-3 days) and long-term
Infrastructure for active and passive measurements at 10Gbps and beyond
Infrastructure for active and passive measurements at 10Gbps and beyond Best Practice Document Produced by UNINETT led working group on network monitoring (UFS 142) Author: Arne Øslebø August 2014 1 TERENA
Practical Experience with IPFIX Flow Collectors
Practical Experience with IPFIX Flow Collectors Petr Velan CESNET, z.s.p.o. Zikova 4, 160 00 Praha 6, Czech Republic petr.velan@cesnet.cz Abstract As the number of Internet applications grows, the number
Monitoring Mobile Network Traffic (3G/LTE) Luca Deri <deri@ntop.org>
Monitoring Mobile Network Traffic (3G/LTE)! Luca Deri Overview Introduction to mobile traffic monitoring! Analysing mobile traffic with Wireshark! Monitoring mobile traffic using ntop nprobe,
The ntop Project: Open Source Network Monitoring
The ntop Project: Open Source Network Monitoring Luca Deri 1 Agenda 1. What can ntop do for me? 2. ntop and network security 3. Integration with commercial protocols 4. Embedding ntop 5. Work in
ntopng: Realtime Network Traffic View
ntopng: Realtime Network Traffic View Luca Deri 3/28/14 1 ntop in 1998 In 1998, the original ntop has been created. Available for Unix and Windows under GPL. Contrary to many tools available
Monitoring Mobile Network Traffic (3G/LTE) Luca Deri <deri@ntop.org>
Monitoring Mobile Network Traffic (3G/LTE)! Luca Deri ntop and Wireshark ntopng nprobe n2disk Live Capture PF_RING Read Pcap's Capture Network Replay disk2n 2 Overview Introduction to mobile
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 1 内 容 流 量 分 析 简 介 IPv6 下 的 新 问 题 和 挑 战 协 议 格 式 变 更 用 户 行 为 特 征 变 更 安 全 问 题 演 化 流 量 导 出 手 段 变 化 设 备 参 考 配 置 流 量 工 具 总 结 2 流 量 分 析 简 介 流 量 分 析 目 标 who, what, where,
Monitoring Network Traffic using ntopng
Monitoring Network Traffic using ntopng Luca Deri Outlook What are the main activities of ntop.org? ntop s view on network monitoring. From ntop to ntopng. ntopng architecture and design.
NetFlow Tracker Overview. Mike McGrath x ccie CTO mike@crannog-software.com
NetFlow Tracker Overview Mike McGrath x ccie CTO mike@crannog-software.com 2006 Copyright Crannog Software www.crannog-software.com 1 Copyright Crannog Software www.crannog-software.com 2 LEVELS OF NETWORK
vpf_ring: Towards Wire-Speed Network Monitoring Using Virtual Machines
vpf_ring: Towards Wire-Speed Network Monitoring Using Virtual Machines Alfredo Cardigliano 1 Luca Deri 1 2 1 ntop, 2 IIT-CNR Pisa, Italy Joseph Gasparakis Intel Corporation Shannon, Ireland Francesco Fusco
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA What is ReporterAnalyzer? ReporterAnalyzer gives network professionals insight into how application traffic is impacting network performance.
pmacct: introducing BGP natively into a NetFlow/sFlow collector
pmacct: introducing BGP natively into a NetFlow/sFlow collector Paolo Lucente the pmacct project AS286 http://www.pmacct.net/ SwiNOG #19 meeting, Berne, 29 th Sep 2009 pmacct:
mbits Network Operations Centrec
mbits Network Operations Centrec The mbits Network Operations Centre (NOC) is co-located and fully operationally integrated with the mbits Service Desk. The NOC is staffed by fulltime mbits employees,
Application Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1
Application Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1 This document supports the version of each product listed and supports all subsequent versions until the document
Wire-Speed Hardware-Assisted Traffic Filtering with Mainstream Network Adapters
Wire-Speed Hardware-Assisted Traffic Filtering with Mainstream Network Adapters Luca Deri 1, Joseph Gasparakis 2, Peter Waskiewicz Jr 3, Francesco Fusco 4 5 1 ntop, Pisa, Italy 2 Intel Corporation, Embedded
Programmable Networking with Open vswitch
Programmable Networking with Open vswitch Jesse Gross LinuxCon September, 2013 2009 VMware Inc. All rights reserved Background: The Evolution of Data Centers Virtualization has created data center workloads
Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX
Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX Martin Elich 1,3, Matěj Grégr 1,2 and Pavel Čeleda1,3 1 CESNET, z.s.p.o., Prague, Czech Republic 2 Brno University of Technology,
Cisco NetFlow TM Briefing Paper. Release 2.2 Monday, 02 August 2004
Cisco NetFlow TM Briefing Paper Release 2.2 Monday, 02 August 2004 Contents EXECUTIVE SUMMARY...3 THE PROBLEM...3 THE TRADITIONAL SOLUTIONS...4 COMPARISON WITH OTHER TECHNIQUES...6 CISCO NETFLOW OVERVIEW...7
Apache CloudStack 4.x (incubating) Network Setup: excerpt from Installation Guide. Revised February 28, 2013 2:32 pm Pacific
Apache CloudStack 4.x (incubating) Network Setup: excerpt from Installation Guide Revised February 28, 2013 2:32 pm Pacific Apache CloudStack 4.x (incubating) Network Setup: excerpt from Installation Guide
and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs
ICmyNet.Flow: NetFlow based traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF Faculty
WhatsUp Gold 2016 Getting Started Guide
WhatsUp Gold 2016 Getting Started Guide Contents CHAPTER 1 Welcome Welcome to WhatsUp Gold... 1 About WhatsUp Gold... 1 WhatsUp Gold Editions... 2 Deploying Deploying WhatsUp Gold... 5 STEP 1: Prepare
NetFlow & BGP multi-path: quo vadis?
NetFlow & BGP multi-path: quo vadis? Paolo Lucente Elisa Jasinska Netnod, Stockholm Agenda About Netflix About pmacct Brief digression on BGP ADD-PATHS Putting all
Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software. Luca Deri January 2003
Passively Monitoring Networks at Gigabit Speeds Using Commodity Hardware and Open Source Software Luca Deri January 2003 Current Situation: Applications Most modern applications are bandwidth hungry (P2P).
Network Probe User Guide
Network Probe User Guide Network Probe User Guide Table of Contents 1. Introduction...1 2. Installation...2 Windows installation...2 Linux installation...3 Mac installation...4 License key...5 Deployment...5
Running custom scripts which allow you to remotely and securely run a script you wrote on Windows, Mac, Linux, and Unix devices.
About Foglight NMS Foglight NMS is a comprehensive device, application, and traffic monitoring and troubleshooting solution. It is capable of securely monitoring single and multi-site networks of all sizes,
SDN software switch Lagopus and NFV enabled software node
SDN software switch Lagopus and NFV enabled software node Kazuaki OBANA NTT Network Innovation Laboratories SDN software switch Lagopus 1 Motivation Agile and flexible networking Full automation in provisioning,
Intel DPDK Boosts Server Appliance Performance White Paper
Intel DPDK Boosts Server Appliance Performance Intel DPDK Boosts Server Appliance Performance Introduction As network speeds increase to 40G and above, both in the enterprise and data center, the bottlenecks
STANDPOINT FOR QUALITY-OF-SERVICE MEASUREMENT
STANDPOINT FOR QUALITY-OF-SERVICE MEASUREMENT 1. TIMING ACCURACY The accurate multi-point measurements require accurate synchronization of clocks of the measurement devices. If for example time stamps
Traffic analysis with NetFlow
Traffic analysis with NetFlow Paolo Lucente http://www.pmacct.net/ RIPE Regional meeting, Dubrovnik Sep 2011 Traffic analysis with NetFlow Agenda o o whoami: Paolo & pmacct Ramblings:
Beyond Monitoring Root-Cause Analysis
WHITE PAPER With the introduction of NetFlow and similar flow-based technologies, solutions based on flow-based data have become the most popular methods of network monitoring. While effective, flow-based
NetFlow/IPFIX Various Thoughts
NetFlow/IPFIX Various Thoughts Paul Aitken & Benoit Claise 3 rd NMRG Workshop on NetFlow/IPFIX Usage in Network Management, July 2010 1 B #1 Application Visibility Business Case NetFlow (L3/L4) DPI Application
Emerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc.
Emerald Network Collector Version 4.0 Emerald Management Suite IEA Software, Inc. Table Of Contents Purpose... 3 Overview... 3 Modules... 3 Installation... 3 Configuration... 3 Filter Definitions... 4
Introduction to Netflow
Introduction to Netflow Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
SLA para aplicaciones en redes WAN. Alvaro Cayo Urrutia
SLA para aplicaciones en redes WAN Alvaro Cayo Urrutia Quién es FLUKE NETWORKS? Enterprise SuperVision (ESV) Soluciones portátiles de prueba y análisis LAN y WAN distribuidas Infrastructure SuperVision
High-Speed Network Traffic Monitoring Using ntopng
High-Speed Network Traffic Monitoring Using ntopng Luca Deri Simone Mainardi Introduction ntop develops of open source network traffic monitoring applications. ntop
PRACTICAL EXPERIENCES BUILDING AN IPFIX BASED OPEN SOURCE BOTNET DETECTOR. ` Mark Graham
PRACTICAL EXPERIENCES OF BUILDING AN IPFIX BASED OPEN SOURCE BOTNET DETECTOR ` Mark Graham OUTLINE RESEARCH PROBLEM: Botnet detection in Cloud Providers FLOW: IPFIX and NetFlow CONCEPTUAL FRAMEWORK: Build
I3: Maximizing Packet Capture Performance. Andrew Brown
I3: Maximizing Packet Capture Performance Andrew Brown Agenda Why do captures drop packets, how can you tell? Software considerations Hardware considerations Potential hardware improvements Test configurations/parameters
ntop.org / nmon.net nprobe nbox and n2disk User s Guide Open Source Software and Hardware NetFlow v5/v9 Probe and Packet-to-Disk
ntop.org / nmon.net nprobe nbox and n2disk User s Guide Open Source Software and Hardware NetFlow v5/v9 Probe and Packet-to-Disk Version 5.2 April 2009 2002-09 nbox e-mail contact nbox@nmon.net nbox web
Network Monitoring and Management NetFlow Overview
Network Monitoring and Management NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
PANDORA FMS NETWORK DEVICE MONITORING
NETWORK DEVICE MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS is able to monitor all network devices available on the marke such as Routers, Switches, Modems, Access points,
MEASURING WORKLOAD PERFORMANCE IS THE INFRASTRUCTURE A PROBLEM?
MEASURING WORKLOAD PERFORMANCE IS THE INFRASTRUCTURE A PROBLEM? Ashutosh Shinde Performance Architect ashutosh_shinde@hotmail.com Validating if the workload generated by the load generating tools is applied
How To Get Started With Whatsup Gold
WhatsUp Gold v16.2 Getting Started Guide Co Welcome Welcome to WhatsUp Gold... 1 About WhatsUp Gold... 1 WhatsUp Gold Editions... 2 Deploying Deploying WhatsUp Gold... 4 STEP 1: Prepare the network...
PANDORA FMS NETWORK DEVICES MONITORING
NETWORK DEVICES MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS can monitor all the network devices available in the market, like Routers, Switches, Modems, Access points,
Wireshark in a Multi-Core Environment Using Hardware Acceleration Presenter: Pete Sanders, Napatech Inc. Sharkfest 2009 Stanford University
Wireshark in a Multi-Core Environment Using Hardware Acceleration Presenter: Pete Sanders, Napatech Inc. Sharkfest 2009 Stanford University Napatech - Sharkfest 2009 1 Presentation Overview About Napatech
Wireshark Developer and User Conference
Wireshark Developer and User Conference Using NetFlow to Analyze Your Network June 15 th, 2011 Christopher J. White Manager Applica6ons and Analy6cs, Cascade Riverbed Technology cwhite@riverbed.com SHARKFEST
Scalable Extraction, Aggregation, and Response to Network Intelligence
Scalable Extraction, Aggregation, and Response to Network Intelligence Agenda Explain the two major limitations of using Netflow for Network Monitoring Scalability and Visibility How to resolve these issues
vpf_ring: Towards Wire-Speed Network Monitoring Using Virtual Machines
vpf_ring: Towards Wire-Speed Network Monitoring Using Virtual Machines Alfredo Cardigliano 1 Luca Deri 1,2 ntop 1, IIT-CNR 2 Pisa, Italy {cardigliano, deri}@ntop.org Joseph Gasparakis Intel Corporation
Enabling Technologies for Distributed Computing
Enabling Technologies for Distributed Computing Dr. Sanjay P. Ahuja, Ph.D. Fidelity National Financial Distinguished Professor of CIS School of Computing, UNF Multi-core CPUs and Multithreading Technologies
Network Simulation Traffic, Paths and Impairment
Network Simulation Traffic, Paths and Impairment Summary Network simulation software and hardware appliances can emulate networks and network hardware. Wide Area Network (WAN) emulation, by simulating
End-to-End Network Centric Performance Management
End-to-End Network Centric Performance Management Gordon Bolt gbolt@opnet.com Application Performance Networks exist to support applications and services Application or End-User Experience is what matters
Ethernet-based Software Defined Network (SDN) Cloud Computing Research Center for Mobile Applications (CCMA), ITRI 雲 端 運 算 行 動 應 用 研 究 中 心
Ethernet-based Software Defined Network (SDN) Cloud Computing Research Center for Mobile Applications (CCMA), ITRI 雲 端 運 算 行 動 應 用 研 究 中 心 1 SDN Introduction Decoupling of control plane from data plane
The Lagopus SDN Software Switch. 3.1 SDN and OpenFlow. 3. Cloud Computing Technology
3. The Lagopus SDN Software Switch Here we explain the capabilities of the new Lagopus software switch in detail, starting with the basics of SDN and OpenFlow. 3.1 SDN and OpenFlow Those engaged in network-related
Experiences Deploying and Operating a Large-Scale Monitoring Infrastructure
1 Experiences Deploying and Operating a Large-Scale Monitoring Infrastructure 25 th NORDUnet conference Arne Øslebø arne.oslebo@uninett.no Outline Background and motivation Typical setup Deployment map
Software Datapath Acceleration for Stateless Packet Processing
June 22, 2010 Software Datapath Acceleration for Stateless Packet Processing FTF-NET-F0817 Ravi Malhotra Software Architect Reg. U.S. Pat. & Tm. Off. BeeKit, BeeStack, CoreNet, the Energy Efficient Solutions
Use case: Merging heterogeneous network measurement data
Use case: Merging heterogeneous network measurement data Jorge E. López de Vergara and Javier Aracil Jorge.lopez_vergara@uam.es Credits to Rubén García-Valcárcel, Iván González, Rafael Leira, Víctor Moreno,
Enhancing Hypervisor and Cloud Solutions Using Embedded Linux Iisko Lappalainen MontaVista
Enhancing Hypervisor and Cloud Solutions Using Embedded Linux Iisko Lappalainen MontaVista Setting the Stage This presentation will discuss the usage of Linux as a base component of hypervisor components
redborder IPS redborder Just common sense IPS overview Common sense
redborder Just common sense overview redborder at a Glance redborder 2013 rb rb Flow Traffic collector and visualization. Netflow v5/9, sflow, IPFIX, Flexible Netflow, AVC, NBAR2, rb DDoS Extremely high
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy
ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to
High-performance vnic framework for hypervisor-based NFV with userspace vswitch Yoshihiro Nakajima, Hitoshi Masutani, Hirokazu Takahashi NTT Labs.
High-performance vnic framework for hypervisor-based NFV with userspace vswitch Yoshihiro Nakajima, Hitoshi Masutani, Hirokazu Takahashi NTT Labs. 0 Outline Motivation and background Issues on current
WhatsUpGold. v3.0. WhatsConnected User Guide
WhatsUpGold v3.0 WhatsConnected User Guide Contents CHAPTER 1 Welcome to WhatsConnected Finding more information and updates... 2 Sending feedback... 3 CHAPTER 2 Installing and Configuring WhatsConnected
NetFlow & BGP multi-path: quo vadis?
NetFlow & BGP multi-path: quo vadis? Paolo Lucente Elisa Jasinska NANOG61, Bellevue Agenda About Netflix About pmacct Brief digression on BGP ADD-PATHS Putting all
Securing and Monitoring BYOD Networks using NetFlow
Securing and Monitoring BYOD Networks using NetFlow How NetFlow can help with Security Analysis, Application Detection and Traffic Monitoring Don Thomas Jacob Technical Marketing Engineer ManageEngine
Reducing Network Traffic in CERNET
Linuxflow: A High Speed Backbone Measurement Facility ZhiChun Li (lizc@serv.edu.cn( lizc@serv.edu.cn) Hui Zhang (hzhang@cernet.edu.cn( hzhang@cernet.edu.cn) CERNET, Tsinghua Univ,, China CHINA EDUCATION
How To Set Up Foglight Nms For A Proof Of Concept
Page 1 of 5 Foglight NMS Overview Foglight Network Management System (NMS) is a robust and complete network monitoring solution that allows you to thoroughly and efficiently manage your network. It is
MySQL Cluster 7.0 - New Features. Johan Andersson MySQL Cluster Consulting johan.andersson@sun.com
MySQL Cluster 7.0 - New Features Johan Andersson MySQL Cluster Consulting johan.andersson@sun.com Mat Keep MySQL Cluster Product Management matthew.keep@sun.com Copyright 2009 MySQL Sun Microsystems. The
NetFlow-Lite offers network administrators and engineers the following capabilities:
Solution Overview Cisco NetFlow-Lite Introduction As networks become more complex and organizations enable more applications, traffic patterns become more diverse and unpredictable. Organizations require
Maintaining Non-Stop Services with Multi Layer Monitoring
Maintaining Non-Stop Services with Multi Layer Monitoring Lahav Savir System Architect and CEO of Emind Systems lahavs@emindsys.com www.emindsys.com The approach Non-stop applications can t leave on their
Sources and Applications of. Performance and Security- Augmented Flow Data
Sources and Applications of Performance and Security- Augmented Flow Data Avi Freedman, CEO FloCon 2016 January 2016 Background: NetFlow/IPFIX/sFlow NetFlow is: A 20-year old technology now supported in
Linux KVM Virtual Traffic Monitoring
Linux KVM Virtual Traffic Monitoring East-West traffic visibility Scott Harvey Director of Engineering October 7th, 2015 apcon.com Speaker Bio Scott Harvey Director of Engineering at APCON Responsible
Network Management Deployment Guide
Smart Business Architecture Borderless Networks for Midsized organizations Network Management Deployment Guide Revision: H1CY10 Cisco Smart Business Architecture Borderless Networks for Midsized organizations
SonicOS 5.8: NetFlow Reporting
SonicOS 5.8: NetFlow Reporting Document Scope Rapid growth of IP networks has created interest in new business applications and services. These new services have resulted in increases in demand for network
mesdn: Mobile Extension of SDN Mostafa Uddin Advisor: Dr. Tamer Nadeem Old Dominion University
mesdn: Mobile Extension of SDN Mostafa Uddin Advisor: Dr. Tamer Nadeem Old Dominion University Very brief on SDN Networks are very hard to manage and evolve. Data Plane: Fwding state + Packet header forwarding
Exploiting Commodity Multi-core Systems for Network Traffic Analysis
Exploiting Commodity Multi-core Systems for Network Traffic Analysis Luca Deri ntop.org Pisa, Italy deri@ntop.org Francesco Fusco IBM Zurich Research Laboratory Rüschlikon, Switzerland ffu@zurich.ibm.com
Network Monitoring Comparison
Network Monitoring Comparison vs Network Monitoring is essential for every network administrator. It determines how effective your IT team is at solving problems or even completely eliminating them. Even
Fluke Networks NetFlow Tracker
Fluke Networks NetFlow Tracker Quick Install Guide for Product Evaluations Pre-installation and Installation Tasks Minimum System Requirements The type of system required to run NetFlow Tracker depends
Quantum Hyper- V plugin
Quantum Hyper- V plugin Project blueprint Author: Alessandro Pilotti Version: 1.0 Date: 01/10/2012 Hyper-V reintroduction in OpenStack with the Folsom release was primarily focused
QRadar Security Intelligence Platform Appliances
DATASHEET Total Security Intelligence An IBM Company QRadar Security Intelligence Platform Appliances QRadar Security Intelligence Platform appliances combine typically disparate network and security management
ehealth and VoIP Overview
ehealth and VoIP Overview Voice over IP (VoIP) configurations can be very complex. Your network could contain a variety of devices, applications, and configuration capabilities to support voice traffic.
OpenFlow with Intel 82599. Voravit Tanyingyong, Markus Hidell, Peter Sjödin
OpenFlow with Intel 82599 Voravit Tanyingyong, Markus Hidell, Peter Sjödin Outline Background Goal Design Experiment and Evaluation Conclusion OpenFlow SW HW Open up commercial network hardware for experiment
Using MySQL for Big Data Advantage Integrate for Insight Sastry Vedantam sastry.vedantam@oracle.com
Using MySQL for Big Data Advantage Integrate for Insight Sastry Vedantam sastry.vedantam@oracle.com Agenda The rise of Big Data & Hadoop MySQL in the Big Data Lifecycle MySQL Solutions for Big Data Q&A
Flow-based network accounting with Linux
Flow-based network accounting with Linux Harald Welte netfilter core team / hmw-consulting.de / Astaro AG laforge@netfilter.org Abstract Many networking scenarios require some form of network accounting