CONTENTS IN DETAIL ACKNOWLEDGMENTS INTRODUCTION 1 1 FLOW FUNDAMENTALS 9 2 COLLECTORS AND SENSORS 21

Size: px

Start display at page:

Download "CONTENTS IN DETAIL ACKNOWLEDGMENTS INTRODUCTION 1 1 FLOW FUNDAMENTALS 9 2 COLLECTORS AND SENSORS 21"

Nicholas Lindsey
5 years ago
Views:

1 CONTENTS IN DETAIL ACKNOWLEDGMENTS xv INTRODUCTION 1 Network Administration and Network Management... 3 Network Management Tools... 3 MRTG, Cricket, and Cacti... 3 RTG... 4 Nagios and Big Brother... 4 CiscoWorks, OpenView, and More... 4 Enough Griping: What s the Solution?... 5 Flow-Tools and Its Prerequisites... 6 Flows and This Book FLOW FUNDAMENTALS 9 What Is a Flow? Flow System Architecture The History of Network Flow NetFlow Versions NetFlow Competition The Latest Standards Flows in the Real World ICMP Flows UDP Flows TCP Flows Other Protocols Flow Export and Timeouts Packet-Sampled Flows COLLECTORS AND SENSORS 21 Collector Considerations Operating System System Resources Sensor Considerations Location From Remote Facilities From Private Network Segments/DMZs Implementing the Collector... 24

2 Installing Flow-tools Installing from Packages Installing from Source Running flow-capture Starting flow-capture at Boot How Many Collectors? Collector Log Files Collector Troubleshooting Configuring Hardware Flow Sensors Cisco Routers Cisco Switches Juniper Routers Configuring Software Flow Sensors Setting Up Sensor Server Hardware Network Setup Sensor Server Setup Running the Sensor on the Collector The Sensor: softflowd Running softflowd Watching softflowd VIEWING FLOWS 41 Using flow-print Printing Protocol and Port Names Common Protocol and Port Number Assignments Viewing Flow Record Header Information with -p Printing to a Wide Terminal Setting flow-print Formats with -f Showing Interfaces and Ports in Hex with Format -f Two Lines with Times, Flags, and Hex Ports Using -f Printing BGP Information Wide-Screen Display IP Accounting Format TCP Control Bits and Flow Records ICMP Types and Codes and Flow Records Types and Codes in ICMP Flows and ICMP Details FILTERING FLOWS 57 Filter Fundamentals Common Primitives Creating a Simple Filter with Conditions and Primitives Using Your Filter x

3 Useful Primitives Protocol, Port, and Control Bit Primitives IP Address and Subnet Primitives Time, Counter, and Double Primitives Interface and BGP Primitives Filter Match Statements Protocols, Ports, and Control Bits Addresses and Subnets Filtering by Sensor or Exporter Time Filters Clipping Levels BGP and Routing Filters Using Multiple Filters Logical Operators in Filter Definitions Logical or Filter Inversion Filters and Variables Using Variable-Driven Filters Defining Your Own Variable-Driven Filters Creating Your Own Variables REPORTING AND FOLLOW-UP ANALYSIS 81 Default Report Timing and Totals Packet Size Distribution Packets per Flow Octets in Each Flow Flow Time Distribution Modifying the Default Report Using Variables: Report Type Using Variables: SORT Analyzing Individual Flows from Reports Other Report Customizations Choosing Fields Displaying Headers, Hostnames, and Percentages Presenting Reports in HTML Useful Report Types IP Address Reports Network Protocol and Port Reports Traffic Size Reports Traffic Speed Reports Routing, Interfaces, and Next Hops Reporting Sensor Output BGP Reports Customizing Reports Custom Report: Reset-Only Flows More Report Customizations Customizing Report Appearance xi

4 6 PERL, FLOWSCAN, AND CFLOW.PM 117 Installing Cflow.pm Testing Cflow.pm Install from Operating System Package Install from Source Installing from Source with a Big Hammer flowdumper and Full Flow Information FlowScan and CUFlow FlowScan Prerequisites Installing FlowScan and CUFlow FlowScan User, Group, and Data Directories FlowScan Startup Script Configuring FlowScan Configuring CUFlow: CUFlow.cf Rotation Programs and flow-capture Running FlowScan FlowScan File Handling Displaying CUFlow Graphs Flow Record Splitting and CUFlow Splitting Flows Scripting Flow Record Splitting Filtered CUFlow and Directory Setup Using Cflow.pm A Sample Cflow.pm Script Cflow.pm Variables Other Cflow.pm Exports Acting on Every File Return Value Verbose Mode FLOWVIEWER 139 FlowTracker and FlowGrapher vs. CUFlow FlowViewer Security Installing FlowViewer Prerequisites FlowViewer Installation Process Configuring FlowViewer Directories and Site Paths Website Setup Devices and Exporters Troubleshooting the FlowViewer Suite Using FlowViewer Filtering Flows with FlowViewer Reporting Parameters Printed Reports Statistics Reports xii

5 FlowGrapher FlowGrapher Settings FlowGrapher Output FlowTracker FlowTracker Processes FlowTracker Settings Viewing Trackers Group Trackers Interface Names and FlowViewer AD HOC FLOW VISUALIZATION 157 gnuplot Starting gnuplot gnuplot Configuration Files Time-Series Example: Bandwidth Total Bandwidth Report Unidirectional Bandwidth Reports Combined Inbound/Outbound Traffic Automating Graph Production Comparison Graphs Data Normalizing Time Scale EDGES AND ANALYSIS 177 NetFlow v Installing flowd Configuring flowd Converting flowd Data to Flow-tools sflow Configuring sflow Export with sflowenable Convert sflow to NetFlow Problem Solving with Flow Data Finding Busted Software Identifying Worms Traffic to Illegal Addresses Traffic to Nonexistent Hosts Afterword INDEX 191 xiii

NETWORK FLOW ANALYSIS

NETWORK FLOW ANALYSIS by Michael W. Lucas no starch press San Francisco CONTENTS IN DETAIL ACKNOWLEDGMENTS xv INTRODUCTION 1 Network Administration and Network Management 3 Network Management Tools 3 MRTG,