NetFlow: what happens in your network?
|
|
|
- Conrad Barnett
- 8 years ago
- Views:
Transcription
1 NetFlow: what happens in your network? by Lorenzo Busatti MUM Ljubljana 2016 Lorenzo Busatti, 1
2 About me Lorenzo Busatti Founder of Grifonline S.r.l. (1997) Founder of Linkwave (2006) MikroTik Trainer (2010) Member of RIPE, AMS-IX, MIX-IT MUM Ljubljana 2016 Lorenzo Busatti, 2
3 About me MUM Ljubljana 2016 Lorenzo Busatti, 3
4 I'm a MikroTik enthusiast MUM Ljubljana 2016 Lorenzo Busatti, 4
5 I'm a MikroTik enthusiast I'm a MikroTik evangelist MUM Ljubljana 2016 Lorenzo Busatti, 5
6 About me Founder (2016) of the Non Profit Organization for High Quality Training Partners MUM Ljubljana 2016 Lorenzo Busatti, 6
7 Advertising time! My friend Andrew Cox booked too late for this MUM, so the presentations slots was already full. I promised him to quick advertise his fantastic product (and for free J): MUM Ljubljana 2016 Lorenzo Busatti, 7
8 MUM Ljubljana 2016 Lorenzo Busatti, 8
9 MUM Ljubljana 2016 Lorenzo Busatti, 9
10 MUM Ljubljana 2016 Lorenzo Busatti, 10
11 MUM Ljubljana 2016 Lorenzo Busatti, 11
12 Dedicated to Max MUM Ljubljana 2016 Lorenzo Busatti, 12
13 The traffic of your network MUM Ljubljana 2016 Lorenzo Busatti, 13
14 The traffic of your network Is one of the most importants things. MUM Ljubljana 2016 Lorenzo Busatti, 14
15 The traffic of your network What do you know about it? MUM Ljubljana 2016 Lorenzo Busatti, 15
16 The traffic of your network What is the growth of your customer traffic to Netflix? MUM Ljubljana 2016 Lorenzo Busatti, 16
17 The traffic of your network What are the top AS you should peer with? MUM Ljubljana 2016 Lorenzo Busatti, 17
18 The traffic of your network Who is the top bandwidth drawer? MUM Ljubljana 2016 Lorenzo Busatti, 18
19 The traffic of your network With few tools you can know more than you can Imagine J MUM Ljubljana 2016 Lorenzo Busatti, 19
20 NetFlow in pills Is a common router s feature Collect IP traffic statistics Later will export them to a NetFlow Collector They re called: flow record The format is template based (since the Version 9): expandable for the future MUM Ljubljana 2016 Lorenzo Busatti, 20
21 NetFlow in RouterOS Yes, is supported! Is called: Traffic Flow (NetFlow it s a Cisco naming.) He s living there: /ip traffic-flow Exist since ROS v. 2.9 Today support the Versions 1, 5, 9 Check the wiki for the differences. J MUM Ljubljana 2016 Lorenzo Busatti, 21
22 Traffic Flow in action YOUR WAN YOUR LAN The Flows NetFlow Collector The Client (and Analyzer) MUM Ljubljana 2016 Lorenzo Busatti, 22
23 Two Ingredients The Flows A NetFlow Collector (andanalyzer) MUM Ljubljana 2016 Lorenzo Busatti, 23
24 Traffic Flow limitations Up to RouterOS v. 6.0 will export only RX traffic of an interface Currently RouterOS does not export BGP AS numbers L Hope to see implemented soon. J MUM Ljubljana 2016 Lorenzo Busatti, 24
25 The boring part (but very short.) MUM Ljubljana 2016 Lorenzo Busatti, 25
26 Packet transport protocol The records are exported using UDP The standard port is the 2055 (user defined) The router does not keep track of flow records already exported If a NetFlow packet is dropped all contained records are lost forever Doesn t export the payloads The content isn t encrypted MUM Ljubljana 2016 Lorenzo Busatti, 26
27 General structure (v9) NetFlow Packet header Template NetFlow Record 1 NetFlow Record 2 NetFlow Record n Template NetFlow Record n + 1 NetFlow Record n + 2 NetFlow Record n + n MUM Ljubljana 2016 Lorenzo Busatti, 27
28 The packet header Version number (v1 v5, v7 v8, v9) Sequence number Timestamp Number of records (v5 or v8) or list of templates and records (v9) MUM Ljubljana 2016 Lorenzo Busatti, 28
29 The Template format ID length Field Count Field 1 Type Field 1 Length Field 2 Type Field 2 Length Field N Type Field N Length MUM Ljubljana 2016 Lorenzo Busatti, 29
30 (some) v9 Fields IN_BYTES OUT_BYTES IN_PKTS OUT_PKTS PROTOCOL SRC_TOS TCP_FLAGS L4_SRC_PORT L4_DST_PORT IPV4_SRC_ADDR IPV4_DST_ADDR DIRECTION IPV4_NEXT_HOP IPV6_SRC_ADDR IPV6_DST_ADDR ICMP_TYPE IN_SRC_MAC IN_DST_MAC OUT_DST_MAC OUT_SRC_MAC SRC_VLAN DST_VLAN SRC_AS DST_AS BGP_IPV4_NEXT_HOP IP_PROTOCOL_VERSION MPLS_LABEL_(1-10) IF_NAME IF_DESC FORWARDING STATUS (lots of subcodes!!!) MUM Ljubljana 2016 Lorenzo Busatti, 30
31 Live view The packet Header MUM Ljubljana 2016 Lorenzo Busatti, 31
32 Live view The Template MUM Ljubljana 2016 Lorenzo Busatti, 32
33 Live view One Flow MUM Ljubljana 2016 Lorenzo Busatti, 33
34 Summary The Traffic Flow will export almost everything except the effective payload MUM Ljubljana 2016 Lorenzo Busatti, 34
35 Setting up (the router) MUM Ljubljana 2016 Lorenzo Busatti, 35
36 IP > Traffic Flow MUM Ljubljana 2016 Lorenzo Busatti, 36
37 IP > Traffic Flow - Targets MUM Ljubljana 2016 Lorenzo Busatti, 37
38 IP > Traffic Flow -> Status MUM Ljubljana 2016 Lorenzo Busatti, 38
39 How much resources will take (the flows)? MUM Ljubljana 2016 Lorenzo Busatti, 39
40 Traffic Flow traffic There is not an exact formula to calculate the exported flows, but I ll show you a live example. MUM Ljubljana 2016 Lorenzo Busatti, 40
41 Traffic Flow traffic The router traffic The sessions The Flows MUM Ljubljana 2016 Lorenzo Busatti, 41
42 The NetFlow Collectors (and Analyzer) MUM Ljubljana 2016 Lorenzo Busatti, 42
43 What I need now? A Collector will collect the flows exported by your router. An Analyzer will make these data readable and usable to you. Most of the Collectors are Analyzer also. MUM Ljubljana 2016 Lorenzo Busatti, 43
44 Which one? Open source; Closed source; For Windows; For Linux; On the Cloud; Paid Vs Free; MUM Ljubljana 2016 Lorenzo Busatti, 44
45 Examples MUM Ljubljana 2016 Lorenzo Busatti, 45
46 Which one? I m not a reseller or a sales representative of these brands. Search on the web and try before buy (when possible). MUM Ljubljana 2016 Lorenzo Busatti, 46
47 Which one? In this presentation I ll show you an example using the cloud services provided by: MUM Ljubljana 2016 Lorenzo Busatti, 47
48 The most interesting part: What can I see????? MUM Ljubljana 2016 Lorenzo Busatti, 48
49 Which traffic? Just few examples: Bandwidth monitoring Applications Used Identify visited domains Top talkers (customers and host) Geolocate traffic. Attacks detection. MUM Ljubljana 2016 Lorenzo Busatti, 49
50 Which traffic? And since RouterOS 6.33 the fastpath MUM Ljubljana 2016 Lorenzo Busatti, 50
51 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 51
52 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 52
53 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 53
54 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 54
55 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 55
56 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 56
57 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 57
58 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 58
59 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 59
60 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 60
61 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 61
62 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 62
63 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 63
64 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 64
65 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 65
66 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 66
67 Live demo You can also make reports, watch and export the store flows, and... MUM Ljubljana 2016 Lorenzo Busatti, 67
68 Live demo MUM Ljubljana 2016 Lorenzo Busatti, 68
69 Security The security is another application of the Traffic Flow. My contents will stop here, hope you ll enjoy a dedicated presentation this evening. MUM Ljubljana 2016 Lorenzo Busatti, 69
70 Wrap up üwith the Traffic Flow and a NetFlow Analyzer you can know what happen in your network and the kind of traffic exchanged by your customers üfrom this privileged point of view you can manage, plan and prevent the things of your network. MUM Ljubljana 2016 Lorenzo Busatti, 70
71 Wrap up üi hope you ll deploy soon your privileged point of observation J MUM Ljubljana 2016 Lorenzo Busatti, 71
72 Thank you! Q & A training@grifonline.it MUM Ljubljana 2016 Lorenzo Busatti, 72
Cisco IOS NetFlow Version 9 Flow-Record Format
White Paper Cisco IOS NetFlow Version 9 Flow-Record Format Last updated: May 0 Overview Cisco IOS NetFlow services provide network administrators with access to information concerning IP flows within their
Cisco IOS NetFlow Version 9 Flow-Record Format
Cisco IOS NetFlow Version 9 Flow-Record Format Last updated: February 007 Overview Cisco IOS NetFlow services provide network administrators with access to information concerning IP flows within their
LogLogic Cisco NetFlow Log Configuration Guide
LogLogic Cisco NetFlow Log Configuration Guide Document Release: March 2012 Part Number: LL600068-00ELS090000 This manual supports LogLogic Cisco NetFlow Version 2.0, and LogLogic Software Release 5.1
Building scalable IPSec infrastructure with MikroTik. IPSec, L2TP/IPSec, OSPF
Building scalable IPSec infrastructure with MikroTik IPSec, L2TP/IPSec, OSPF Presenter information Tomas Kirnak Network design Security, wireless Servers Virtualization MikroTik Certified Trainer Atris,
How to configure an Advanced Expert Probe as NetFlow Collector
created by: Rainer Bemsel Version 1.0 Dated: Jan/31/2012 There are two types of NetFlow collectors in Observer. In most cases, it will likely be the NetFlow Trending collector being configured. The Trending
NetFlow/IPFIX Various Thoughts
NetFlow/IPFIX Various Thoughts Paul Aitken & Benoit Claise 3 rd NMRG Workshop on NetFlow/IPFIX Usage in Network Management, July 2010 1 B #1 Application Visibility Business Case NetFlow (L3/L4) DPI Application
MikroTik Invisible Tools. By : Haydar Fadel 2014
MikroTik Invisible Tools By : Haydar Fadel 2014 E-mail Tool A tool that allows you to send e-mail from the router. It can be used, along with other tools, to send the network administrator regular configuration
Open Source VoIP Traffic Monitoring
Open Source VoIP Traffic Monitoring Luca Deri What is VoIP? VoIP is the routing of voice conversations over the Internet or through any other IP-based network (Wikipedia). Advantages: It allows
Open Source VoIP Traffic Monitoring
Open Source VoIP Traffic Monitoring Luca Deri Why VoIP is a Hot Topic? Thanks to open source projects (e.g. Asterisk, Gizmo), and custom Linux distributions (e.g. Asterisk@Home) setting up a VoIP
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
Cisco Catalyst 4948E NetFlow- lite
Cisco Catalyst 4948E NetFlow- lite Applica6on Visibility in Data Center Why Applica+on Visibility in Data Center Efficient Opera+on What applica6ons are consuming bandwidth Who is using them When they
Reducing the impact of DoS attacks with MikroTik RouterOS
Reducing the impact of DoS attacks with MikroTik RouterOS Alfredo Giordano Matthew Ciantar WWW.TIKTRAIN.COM 1 About Us Alfredo Giordano MikroTik Certified Trainer and Consultant Support deployment of WISP
Cisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
Traffic monitoring with sflow and ProCurve Manager Plus
An HP ProCurve Networking Application Note Traffic monitoring with sflow and ProCurve Manager Plus Contents 1. Introduction... 3 2. Prerequisites... 3 3. Network diagram... 3 4. About the sflow protocol...
The Value of Flow Data for Peering Decisions
The Value of Flow Data for Peering Decisions Hurricane Electric IPv6 Native Backbone Massive Peering! Martin J. Levy Director, IPv6 Strategy Hurricane Electric 22 nd August 2012 Introduction Goal of this
NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes
NetFlow Aggregation This document describes the Cisco IOS NetFlow Aggregation feature, which allows Cisco NetFlow users to summarize NetFlow export data on an IOS router before the data is exported to
ICND2 NetFlow. Question 1. What are the benefit of using Netflow? (Choose three) A. Network, Application & User Monitoring. B.
ICND2 NetFlow Question 1 What are the benefit of using Netflow? (Choose three) A. Network, Application & User Monitoring B. Network Planning C. Security Analysis D. Accounting/Billing Answer: A C D NetFlow
920-803 - technology standards and protocol for ip telephony solutions
920-803 - technology standards and protocol for ip telephony solutions 1. Which CODEC delivers the greatest compression? A. B. 711 C. D. 723.1 E. F. 726 G. H. 729 I. J. 729A Answer: C 2. To achieve the
Network Performance Monitoring at Minimal Capex
Network Performance Monitoring at Minimal Capex Some Cisco IOS technologies you can use to create a high performance network Don Thomas Jacob Technical Marketing Engineer About ManageEngine Network Servers
Introduction to Network Discovery and Identity
The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, page 1 Uses for Host, Application, and User Discovery and Identity
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 1 内 容 流 量 分 析 简 介 IPv6 下 的 新 问 题 和 挑 战 协 议 格 式 变 更 用 户 行 为 特 征 变 更 安 全 问 题 演 化 流 量 导 出 手 段 变 化 设 备 参 考 配 置 流 量 工 具 总 结 2 流 量 分 析 简 介 流 量 分 析 目 标 who, what, where,
Monitoring commercial cloud service providers
Monitoring commercial cloud service providers July Author: Lassi Kojo Supervisor: Stefan Lüders CERN openlab Summer Student Report Abstract There is a growing tendency by individuals to sign-up for public
Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data
Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides
Networking Fundamentals Part of the SolarWinds IT Management Educational Series
Networking Fundamentals Part of the SolarWinds IT Management Educational Series V o l u m e 3 NetFlow Basics and Deployment Strategies This paper examines NetFlow technology and implementation considerations.
Netflow Application Upgrade
Netflow Application Upgrade 1 Agenda What is netflow? Existing Netflow Applications Searching for New Netflow Application(s) Recommended Netflow Applications Pricing 2 What is netflow? Observation point:
Agenda. sflow intro. sflow architecture. sflow config example. Summary
sflow Features Agenda sflow intro. sflow architecture sflow config example Summary 1 What is sflow? sflow is a technology for monitoring traffic in data networks containing switches and routers. S9700
Overview of Network Traffic Analysis
Overview of Network Traffic Analysis Network Traffic Analysis identifies which users or applications are generating traffic on your network and how much network bandwidth they are consuming. For example,
Internet Management and Measurements Measurements
Internet Management and Measurements Measurements Ramin Sadre, Aiko Pras Design and Analysis of Communication Systems Group University of Twente, 2010 Measurements What is being measured? Why do you measure?
Netflow Overview. PacNOG 6 Nadi, Fiji
Netflow Overview PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools
Certes Networks Layer 4 Encryption. Network Services Impact Test Results
Certes Networks Layer 4 Encryption Network Services Impact Test Results Executive Summary One of the largest service providers in the United States tested Certes Networks Layer 4 payload encryption over
Introduction to Cisco IOS Flexible NetFlow
Introduction to Cisco IOS Flexible NetFlow Last updated: September 2008 The next-generation in flow technology allowing optimization of the network infrastructure, reducing operation costs, improving capacity
Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
PRACTICAL EXPERIENCES BUILDING AN IPFIX BASED OPEN SOURCE BOTNET DETECTOR. ` Mark Graham
PRACTICAL EXPERIENCES OF BUILDING AN IPFIX BASED OPEN SOURCE BOTNET DETECTOR ` Mark Graham OUTLINE RESEARCH PROBLEM: Botnet detection in Cloud Providers FLOW: IPFIX and NetFlow CONCEPTUAL FRAMEWORK: Build
MPLS for ISPs PPPoE over VPLS. MPLS, VPLS, PPPoE
MPLS for ISPs PPPoE over VPLS MPLS, VPLS, PPPoE Presenter information Tomas Kirnak Network design Security, wireless Servers Virtualization MikroTik Certified Trainer Atris, Slovakia Established 1991 Complete
IP Security. IPSec, PPTP, OpenVPN. Pawel Cieplinski, AkademiaWIFI.pl. MUM Wroclaw
IP Security IPSec, PPTP, OpenVPN Pawel Cieplinski, AkademiaWIFI.pl MUM Wroclaw Introduction www.akademiawifi.pl WCNG - Wireless Network Consulting Group We are group of experienced professionals. Our company
UltraFlow -Cisco Netflow tools-
UltraFlow UltraFlow is an application for collecting and analysing Cisco Netflow data. It is written in Python, wxpython, Matplotlib, SQLite and the Python based Twisted network programming framework.
Load Balancing Using PCC & RouterOS
Load Balancing Using PCC & RouterOS About Me Steve Discher, from College Station, Texas, USA Class of 87 Texas A&M University Using MikroTik since early 2004 when I started my first WISP Author of the
Network Management & Monitoring
Network Management & Monitoring NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
8. 網路流量管理 Network Traffic Management
8. 網路流量管理 Network Traffic Management Measurement vs. Metrics end-to-end performance topology, configuration, routing, link properties state active measurements active routes active topology link bit error
CS 457 Lecture 19 Global Internet - BGP. Fall 2011
CS 457 Lecture 19 Global Internet - BGP Fall 2011 Decision Process Calculate degree of preference for each route in Adj-RIB-In as follows (apply following steps until one route is left): select route with
Network Security. Mobin Javed. October 5, 2011
Network Security Mobin Javed October 5, 2011 In this class, we mainly had discussion on threat models w.r.t the class reading, BGP security and defenses against TCP connection hijacking attacks. 1 Takeaways
NetFlow-Lite offers network administrators and engineers the following capabilities:
Solution Overview Cisco NetFlow-Lite Introduction As networks become more complex and organizations enable more applications, traffic patterns become more diverse and unpredictable. Organizations require
Common VoIP problems, How to detect, correct and avoid them. Penny Tone LLC 1
Common VoIP problems, How to detect, correct and avoid them. Penny Tone LLC 1 Who am I? David Attias Installing VoIP systems for over 7 years Mikrotik user for 5 years Mikrotik certifications MTCNA, MTCRE
SolarWinds Technical Reference
SolarWinds Technical Reference New to Networking Volume 3 NetFlow Basics and Deployment Strategies Section 1 The Need for Flow Analysis...1 Section 2 How does NetFlow Work?...1 The NetFlow Cache...2 The
NetFlow: What is it, why and how to use it? Miloš Zeković, milos.zekovic@soneco.rs. ICmyNet Chief Customer Officer Soneco d.o.o.
NetFlow: What is it, why and how to use it?, milos.zekovic@soneco.rs Soneco d.o.o. Serbia Agenda What is NetFlow? What are the benefits? How to deploy NetFlow? Questions 2 / 22 What is NetFlow? NetFlow
sflow Why You Should Use It And Like It NANOG 39 February 04-07, 2007
sflow Why You Should Use It And Like It NANOG 39 February 04-07, 2007 Richard A. Steenbergen nlayer Communications, Inc. What is sflow? sflow is a standards based protocol for exporting
Copyright 2008 Link Technologies,Inc. A Proud Vendor Member of the
THE WHAT AND WHY ABOUT A Proud Vendor Member of the 1 What Is this about? 2 What is Mikrotik? What DOES it DO for ME! What is it s Purpose! What is the BIG DEAL? Why should I care? Does it help my bottom
NetFlow use cases. ICmyNet / NetVizura. Miloš Zeković, milos.zekovic@soneco.rs. ICmyNet Chief Customer Officer Soneco d.o.o.
NetFlow use cases ICmyNet / NetVizura, milos.zekovic@soneco.rs Soneco d.o.o. Serbia Agenda ICmyNet / NetVizura overview Use cases / case studies Statistics per exporter/interfaces Traffic Patterns NREN
Network Visibility Guide
Network Visibility Guide Even Superman could only see through walls, not networks! We understand your lack of Network visibility. So we give you ManageEngine NetFlow Analyzer! Network visibility is the
CISCO INFORMATION TECHNOLOGY AT WORK CASE STUDY: CISCO IOS NETFLOW TECHNOLOGY
CISCO INFORMATION TECHNOLOGY AT WORK CASE STUDY: CISCO IOS NETFLOW TECHNOLOGY CISCO INFORMATION TECHNOLOGY SEPTEMBER 2004 1 Overview Challenge To troubleshoot capacity and quality problems and to understand
Scalable Extraction, Aggregation, and Response to Network Intelligence
Scalable Extraction, Aggregation, and Response to Network Intelligence Agenda Explain the two major limitations of using Netflow for Network Monitoring Scalability and Visibility How to resolve these issues
Introduction to Firewalls Open Source Security Tools for Information Technology Professionals
Introduction to Firewalls Open Source Security Tools for Information Technology Professionals School of Professional Studies (SPS) The City University of New York (CUNY) Aron Trauring Adjunct Professor
Who is Generating all This Traffic?
Who is Generating all This Traffic? Network Monitoring in Practice Luca Deri Who s ntop.org? Started in 1998 as open-source monitoring project for developing an easy to use passive monitoring
NfSen Plugin Supporting The Virtual Network Monitoring
NfSen Plugin Supporting The Virtual Network Monitoring Vojtěch Krmíček krmicek@liberouter.org Pavel Čeleda celeda@ics.muni.cz Jiří Novotný novotny@cesnet.cz Part I Monitoring of Virtual Network Environments
A Review of the Measuring Platform
Measuring Platform Architecture Based on the IPFIX Standard Alžbeta Kleinová, Anton Baláž, Jana Trelová, Norbert Ádám Department of Computers and Informatics, Technical University of Košice Letná 9, 042
Whitepaper. NetFlow vs. sflow: A Technical Review. plixer. International
Whitepaper NetFlow vs. sflow: A Technical Review 1 plixer Table of Contents Abstract Introduction NetFlow sflow Lab Configuration Hardware Collection and Analysis Utilization Measurements Top Hosts Don
Flow Based Traffic Analysis
Flow based Traffic Analysis Muraleedharan N C-DAC Bangalore Electronics City murali@ncb.ernet.in Challenges in Packet level traffic Analysis Network traffic grows in volume and complexity Capture and decode
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
Flow Analysis. Make A Right Policy for Your Network. GenieNRM
Flow Analysis Make A Right Policy for Your Network GenieNRM Why Flow Analysis? Resolve Network Managers Challenge as follow: How can I know the Detail and Real-Time situation of my network? How can I do
IPsec Details 1 / 43. IPsec Details
Header (AH) AH Layout Other AH Fields Mutable Parts of the IP Header What is an SPI? What s an SA? Encapsulating Security Payload (ESP) ESP Layout Padding Using ESP IPsec and Firewalls IPsec and the DNS
and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs
ICmyNet.Flow: NetFlow based traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF Faculty
Load Balancing Using PCC & RouterOS
Load Balancing Using PCC & RouterOS 1. What is load balancing and why would I want it? 2. Which method should I pick and how does it work? 3. Ok, I want it but how do I set it up? Typical Scenario Requiring
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Cheap and efficient anti-ddos solution
Cheap and efficient anti-ddos solution Who am I? Alexei Cioban Experience in IT 13 years CEO & Founder IT-LAB 7 years IT trainings 5 years 2 About company Year of foundation - 2007 12 employees www.it-lab.md
100-101: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1)
100-101: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1) Course Overview This course provides students with the knowledge and skills to implement and support a small switched and routed network.
IPv6 network management. 6DEPLOY. IPv6 Deployment and Support
IPv6 network management 6DEPLOY. IPv6 Deployment and Support 1 Contributions Simon Muyal, RENATER Bernard Tuy, RENATER Jérôme Durand, RENATER Ralf Wolter, Cisco Patrick Grossetête, Cisco 10/28/2010 IPv6
NetFlow Tips and Tricks
NetFlow Tips and Tricks Introduction... 2 NetFlow and other Flow Technologies... 2 NetFlow Tips and Tricks... 4 Tech Tip 1: Troubleshooting Network Issues... 4 Tech Tip 2: Network Anomaly Detection...
Configuring Flexible NetFlow
CHAPTER 62 Note Flexible NetFlow is only supported on Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X. Flow is defined as a unique set of key fields attributes, which might include fields
Network Traffic Evolution. Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig
Network Traffic Evolution Prof. Anja Feldmann, Ph.D. Dr. Steve Uhlig 1 Example trace Name port % bytes % packets bytes per packet world-wide-web 80???????????? netnews 119???????????? pop-3 mail 110????????????...
Cisco NetFlow TM Briefing Paper. Release 2.2 Monday, 02 August 2004
Cisco NetFlow TM Briefing Paper Release 2.2 Monday, 02 August 2004 Contents EXECUTIVE SUMMARY...3 THE PROBLEM...3 THE TRADITIONAL SOLUTIONS...4 COMPARISON WITH OTHER TECHNIQUES...6 CISCO NETFLOW OVERVIEW...7
Network layer: Overview. Network layer functions IP Routing and forwarding
Network layer: Overview Network layer functions IP Routing and forwarding 1 Network layer functions Transport packet from sending to receiving hosts Network layer protocols in every host, router application
Protocols. Packets. What's in an IP packet
Protocols Precise rules that govern communication between two parties TCP/IP: the basic Internet protocols IP: Internet Protocol (bottom level) all packets shipped from network to network as IP packets
The VPNaaS Plugin for Fuel Documentation
The VPNaaS Plugin for Fuel Documentation Release 1.2-1.2.0-1 Mirantis Inc. January 14, 2016 CONTENTS 1 Document purpose 1 1.1 Key terms, acronyms and abbreviations................................. 1 1.2
Directory Enabled Distributed Packet Filtration System
Directory Enabled Distributed Packet Filtration System A Scalable and High Performance Security Architecture Siddhartha Gavirneni sgavirne@eecs.ku.edu Electrical Engineering and Computer Science Networking
NetFlow Configuration Guide, Cisco IOS Release 15M&T
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity
Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration
Cisco.Selftestengine.642-813.v2013-11-30.by.Amy.32q
Cisco.Selftestengine.642-813.v2013-11-30.by.Amy.32q Number: 642-813 Passing Score: 825 Time Limit: 120 min File Version: 14.5 http://www.gratisexam.com/ Exam Code: 642-813 Exam Name: Cisco implementing
MikroTik RouterOS Introduction to MPLS. Prague MUM Czech Republic 2009
MikroTik RouterOS Introduction to MPLS Prague MUM Czech Republic 2009 Q : W h y h a v e n 't y o u h e a r d a b o u t M P LS b e fo re? A: Probably because of the availability and/or price range Q : W
Exhibit n.2: The layers of a hierarchical network
3. Advanced Secure Network Design 3.1 Introduction You already know that routers are probably the most critical equipment piece in today s networking. Without routers, internetwork communication would
DDoS Attacks. An open-source recipe to improve fast detection and automate mitigation techniques
DDoS Attacks An open-source recipe to improve fast detection and automate mitigation techniques Vicente De Luca Sr. Network Engineer vdeluca@zendesk.com AS21880 / AS61186 Introduction Tentative to solve:
How To Set Up Foglight Nms For A Proof Of Concept
Page 1 of 5 Foglight NMS Overview Foglight Network Management System (NMS) is a robust and complete network monitoring solution that allows you to thoroughly and efficiently manage your network. It is
FortiDDos Size isn t everything
FortiDDos Size isn t everything Martijn Duijm Director Sales Engineering April - 2015 Copyright Fortinet Inc. All rights reserved. Agenda 1. DDoS In The News 2. Drawing the Demarcation Line - Does One
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA What is ReporterAnalyzer? ReporterAnalyzer gives network professionals insight into how application traffic is impacting network performance.
SEC-370. 2001, Cisco Systems, Inc. All rights reserved.
SEC-370 2001, Cisco Systems, Inc. All rights reserved. 1 Understanding MPLS/VPN Security Issues SEC-370 Michael Behringer SEC-370 2003, Cisco Systems, Inc. All rights reserved. 3
Webinar - MikroTik RouterOS Statefull Firewall Howto
Webinar - MikroTik RouterOS Statefull Firewall Howto About Me Steve Discher MikroTik Certified Trainer and Consultant, teach MikroTik Certification classes, LearnMikroTik.com Author of RouterOS by Example,
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
NetFlow Configuration Guide, Cisco IOS Release 12.2SR
NetFlow Configuration Guide, Cisco IOS Release 12.2SR Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
Network Monitoring Comparison
Network Monitoring Comparison vs Network Monitoring is essential for every network administrator. It determines how effective your IT team is at solving problems or even completely eliminating them. Even
VPN. Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu
VPN Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu What is VPN? A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet), maintaining
How-To Configure NetFlow v5 & v9 on Cisco Routers
How-To Configure NetFlow v5 & v9 on Cisco Routers Share: Visibility into the network is an indispensable tool for network administrators. Network visibility can be achieved through daily troubleshooting,
Case Study: Instrumenting a Network for NetFlow Security Visualization Tools
Case Study: Instrumenting a Network for NetFlow Security Visualization Tools William Yurcik* Yifan Li SIFT Research Group National Center for Supercomputing Applications (NCSA) University of Illinois at
Enabling NetFlow and NetFlow Data Export (NDE) on Cisco Catalyst Switches
Enabling NetFlow and NetFlow Data Export (NDE) on Cisco Catalyst Switches Revised 2/1/2007 Introduction...2 Requirements...2 Catalyst 4500 Series...2 Enabling NetFlow...2 Configuring a NetFlow Destination...3
ethernet services for multi-site connectivity security, performance, ip transparency
ethernet services for multi-site connectivity security, performance, ip transparency INTRODUCTION Interconnecting three or more sites across a metro or wide area network has traditionally been accomplished
FIREWALL AND NAT Lecture 7a
FIREWALL AND NAT Lecture 7a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 3, 2015 Source of most of slides: University of Twente FIREWALL An integrated collection of security
IPv6 network management. Where and when?
IPv6 network management 1 Contributions Simon Muyal, RENATER Bernard Tuy, RENATER Jérôme Durand, RENATER Ralf Wolter, Cisco Patrick Grossetête, Cisco Munechika Sumikawa, Hitachi Patrick Paul, 6WIND 2 Agenda
An Introduction to Syslog. Rainer Gerhards Adiscon
An Introduction to Syslog Rainer Gerhards Adiscon What is Syslog? The heterogeneous network logging workhorse a system to emit/store/process meaningful log messages both a communications protocol as well
SolarWinds Technical Reference
SolarWinds Technical Reference Best Practices for Troubleshooting NetFlow Introduction... 1 NetFlow Overview... 1 Troubleshooting NetFlow Service Status Issues... 3 Troubleshooting NetFlow Source Issues...
IPTV Traffic Monitoring System with IPFIX/PSAMP
IPTV Traffic Monitoring System with IPFIX/PSAMP Shingo Kashima NTT Information Sharing Platform Laboratories 3rd NMRG Workshop 2010 NTT Information Sharing Platform Laboratories Outline Introduction Motivation