Love at Second Sight. Written by Drew Robb

Transcription

1 Love at Second Sight Once limited to monitoring networking equipment at large organizations, a new generation of NetFlow and sflow monitoring tools are gaining ground with data centers large and small as an effective means of keeping tabs on network, as well as supplementing security. Written by Drew Robb Sometimes it is love at first sight: the ipod and iphone were both instant successes. Other times the affection slowly grows over time: Ray Tomlinson sent the first over ARPAnet in 1971, but it took another two decades or more before it became a common business tool. NetFlow and sflow network management technologies have taken the slow approach. Both have been around for years, but the early versions were somewhat cumbersome. As a result, data center managers are slow to take advantage of them. In 2008, network analysis software vendor Network Instruments, LLC, conducted a survey of 600 IT professionals. It found that 77% were unaware of NetFlow or were not using it to monitor their networks. Many who were earlier deterred by the cost and complexity of implementation are giving these networking tools a new look. When they do, they are often surprised at how much easier they are to use and the bang they can now get for their networking buck. Take the case of Timex Corporation, originally known as the Middlebury Clock Company. For 150 years, it has been helping people stay on schedule. While the train conductors in the 1850s would have been happy being able to track their stops to the minute, for Dave Edgecomb, Timex s Manager of Global Technical Operations, it is milliseconds that matter. He oversaw the move of the company s data center halfway around the world from the Middlebury, Conn. headquarters to a collocation facility in Singapore where it would be closer to Asian manufacturing sites. The main concern in moving the data center from Middlebury to Singapore was not allowing it to appear to end users as if we moved it, says Edgecomb. Corporate headquarters has much of the sensitive data, and we are used to having it readily available with quick access, so we would be the ones affected by the change.

2 He found that users noticed the difference when using a Virtual Private network (VPN) connection with a 274-millisecond latency. But using Multiprotocol Label Switching (MPLS), together with Riverbed network optimization appliances, dropped the latency to 250ms. We are talking about milliseconds here, but there was a noticeable difference in the user experience, he says. Management was very pleasantly surprised. But to keep the traffic moving smoothly, he needed to see both the optimized and unoptimized traffic that traveled over the WAN. Rather than continue to use the cumbersome sniffer technology he had grown accustomed to, Edgecomb decided to activate NetFlow reporting on his edge routers. I put it in place and it quickly became my number one tool within a matter of hours, he says. It gave me the valuable data I needed without having to know how to dissect an IP packet. It is the equivalent of a dashboard that gives me valuable information, very quickly, to resolve network problems. Although flow monitoring technologies are not new sflow has been around since 2001 and NetFlow is up to Version 9 the products and techniques for monitoring network flows have evolved into flexible and lower cost solutions that integrate better with broader aspects of IT management such as security and virtualization. Network Ping Pong For most companies, network monitoring means using a utility that pings critical devices. If there is no response, a notification is sent out. Since the early 90 s these utilities have become increasingly sophisticated whereby synthetic transactions are used to ensure the actual application is communicating. Response time and availability reports can also be generated from the polled data and most monitoring applications are even providing Simple Network Management Protocol (SNMP) trends. Hardware vendors are steadily improving the quality of their graphical interfaces for equipment configuration and network statistics, so network monitoring software (NMS) vendors have focused on how to make their applications more intuitive and flexible.

3 Until recently, however, few advances beyond SNMP have been made to allow NMS companies to come out with something truly innovative. That changed when Cisco Systems decided to make the NetFlow technology that is part of its Internet Operating System (IOS) available for free. NetFlow provides near real time data on every packet that traverses the network, including its port information, destination and origin, says Yankee Group senior analyst Phil Hochmuth. You are following the footprints of every packet that traverses your network. As such, NetFlow gives administrators data similar to what they would receive from a packet analyzer, but at a fraction of the cost. Many networking equipment vendors have followed Cisco s lead and incorporated NetFlow in their own equipment. Others, however, have taken a hardware approach to the problem called sflow (sflow.org), which uses a chip with embedded software to provide the packet information. Originally developed by InMon Corporation, it is now supported by firms such as Hitachi, Hewlett Packard, Foundry Networks and NEC. The latest development in flow technology came when Cisco released NetFlow v.9, which provided the basis for the IP Flow information Export (IPFIX) protocol. NetFlow v.9 introduced Flexible NetFlow. Flexible NetFlow is more scalable than traditional NetFlow and allows users to customize the data gathered. Traditional NetFlow uses seven key fields (source IP address, destination IP address, source port, destination port, Layer 3 protocol, Type of Service byte, and input interface) to identify a packet and determine if it belongs to a particular flow. Traditional SNMP monitoring solutions give you information about bandwidth utilization which is helpful, but doesn t have the information you need when you are trying to investigate what that traffic consists of, says Les Kent, president of Progent Corporation, a network consulting firm headquartered in San Jose, Cal. NetFlow is very powerful because you can easily see the details of what comprises that bandwidth. With Flexible NetFlow, the user doesn t need to track all seven of the key fields, if some are not needed, but can also track additional fields such as timestamps, next hop IP addresses and subnet masks. Since the user can define what type of data he wants to track and which parameters of that flow, it reduces the amount of data reported.

4 Separate caches can also be designated for different types of information. For example, network security can have its own data cache designed for network anomaly detection, while the network administrators could use a different cache optimized for detecting and troubleshooting VoIP Quality of Service issues. No Lost Packets Another key development has been that lower prices are bringing flow monitoring into the reach of organizations that previously could not afford it. Traditionally, only larger organizations could deploy NetFlow solutions because of the cost and complication of setting up the tools, says Kent. One thing that has changed is there are getting to be much better and less expensive software solutions to take that NetFlow information and make it presentable. AdventNet's ManageEngine NetFlow Analyzer, for instance, has a free version for monitoring a single device, and costs $795 and up for larger editions. Other free and/or low cost versions include Plixer International's Scrutinizer v6 and InMon's sflow toolkit. Scott Chapiewski, data communications consultant for the Denver Regional Transportation District (RTD), has a network consisting of four large Cisco routers, which use NetFlow, and about 50 Hewlett-Packard ProCurve 5400 and 8200 series high-end switches, which provide sflow data. The agency has a WAN and MAN connecting 70 locations in the metropolitan area, primarily over gigabit fiber. To gather the sflow data, he uses Scrutinizer to monitor about 2300 ports at main locations. He says he also has HP s ProCurve Manager Plus product which reports sflow data, but found Scrutinizer to be a lot more thorough as far as the features and functionality for drilling down into that data. Scrutinizer gives us visibility at six of the seven OSI layers, Chapiewski says. Instead of just having visibility into the network at Layer 2 and Layer 3, we can see who is using it, what applications they are using and where they are going. It answers the who, what, when and where questions. He uses this tool to collect and store information about historical data for use in trending, as well as for troubleshooting network slowdowns. Being able to track the users and applications has been particularly helpful in this regard. For example, backups are not

5 supposed to be running during business hours, but sometimes they would spill over and would monopolize the bandwidth over a particular link. Now when a user calls about a slow connection, he can easily see what is running over that link. Prior to having this level of visibility, users might claim that they weren t using the system that much, when it turns out that they were the heaviest users by a multiple in some cases, he says. Having this information allows me to allocate our resources better. Security Included NetFlow and sflow are also moving out of their traditional roles and being used to support newer time sensitive applications such as VoIP and videoconferencing. A lot of organizations that deploy VoIP solutions are disappointed with the quality, says Kent. NetFlow is an essential tool for characterizing traffic and solving problems with your infrastructure so you can successfully deploy VoIP. NetFlow is also increasingly being integrated into security toolkits. We are starting to see emergence of a lot more vendors in the security, risk analysis and compliance areas that are starting to use NetFlow, says Hochmuth. There is more recognition by mainstream enterprises of NetFlow s value in terms of finding out what is really going on in your network from a security point of view. He says that with budget constraints and security being in the forefront, enterprise operations and security operations teams being forced to collaborate more. As a result, NetFlow adopting is rising and vendors are offering NetFlow monitoring products that integrate with Network Access Control (NAC), firewall and Intrusion Protection System products. There are ways to turn NetFlow triggers into actionable security counter measures, says Hochmuth. If a certain type of activity is detected by the NetFlow monitoring product, it can send messages to the security product - firewall or NAC - to shut down

6 that port or block traffic. Instead of just generating a report, it is possible now to be a bit more proactive. One company using NetFlow for security is AirTran Airways. Headquartered in Orlando, Fla. AirTran uses Lancope s StealthWatch System appliances for network monitoring and behavioral analysis on a network connecting 55 locations and several campuses. The airline started using StealthWatch as a means of complying with the Payment Card Industry (PCI) Data Security Standard for credit card transactions. Previously we recognized the value of Network Behavior Analysis tools, and StealthWatch in particular, but we could not justify the cost of the technology, says Michelle Stewart, AirTrans's Manager of Data Security. Now StealthWatch s ability to help demonstrate PCI compliance enabled us to immediately purchase and deploy. During testing, StealthWatch detected unauthorized remote access, worm activity and root cause analysis of increases in WAN activity. The depth of network behavior information is far beyond what is available with SNMP tools, says Stewart. Before StealthWatch, we had to manually analyze log data. Now we can get targeted reporting of pertinent information through the StealthWatch Management Console. In addition to the networking professionals, StealthWatch is also used by IT security resources and the customer support team. With it, all support groups within IT have access common network behavior data and can more quickly identify and resolve issues related to network behavior or malicious events. While security may be the widest adopted new application of NetFlow, the monitoring tools are also being integrated with other types of systems. Hochmuth recommends that organizations look at tying their NetFlow data to identities, rather than just IP addresses. By tying it do Active Directory or an LDAP directory, you can tie network activity to an individual. People move around in networks a lot plugging in in one place and then the moving to another office so ports and IP addresses do not always tell the story of who is doing

7 what on the network, Hochmuth says. You can correlate that NetFlow data with an identity and further create rules where triggers are set when people do certain things on the network as opposed to just these IP addresses. Edgecomb says that with the newest version of Scrutinizer allows him to collect data from VMware, giving him enhanced visibility into utilization in the virtual environment. We are looking at collecting the data there so we can get it down, not just to the network, but to the system level, he says. NetFlow Future These new features, coupled with the lower software costs, make it more worthwhile than ever before for data center operators to look at making NetFlow or sflow part of their standard operations, especially for those who earlier thought it was out of their price range. The accessibility of NetFlow information and tools is coming down to the point where even smaller organizations can deploy it and get use out of it, says Kent.