A Flow-based Network Monitoring System Used for CSCW in Design
|
|
- Tobias Walters
- 5 years ago
- Views:
Transcription
1 The 9th Intemational Conference on Computer Supported Cooperative Work in Design Proceedings A Flow-based Network Monitoring System Used for CSCW in Design Bo Yang'.*, Yi Li2, Yuehui Chen', Runzhang Yuan' 'State Key Lab. of Advanced Technology for Materials Synthesis and Processing, Wuhan Universi?y of Science and Technology, China 2School of Information Science and Technology, Jinan University, China {yungbo, csmaster, yhchen,@ujn. edu. cn Abbstrac t Technology trendr in todoy 's cooperative design environments are making it more and more important to monitor the network performance ond ensure the network securi9. This paper describes the design and implementation of U distributed nehvork trofic monitoring system based on embedded NetFlow hardware and software engines. The system architecture and design principles were introduced in the paper, some discussions were also presented about the NetFlow-based network monitoring technologies. The Jystem had been successfully used to monitor highspeed campus networks ut fill wire speed without pocket sampling in scenarios where commercial NetFlow collectors could not be used due to their limitations. Results show that this is an effective mechanism to identify, diagnose, and determine controls for network activities in CSCW environments and other network-based applications. Keywords: NetFlow, Network Monitoring, CSCW 1. Introduction With the ever-increasing reliance on network services for cooperative design applications, there is a growing interest in an effective way to monitor network activity in order to get the network performance or security situation. The traditional method to gather the network information is packet sampling via probes such as WON and capture TAPS. This worked very effectively in traditional shared-media networks where a single instrument can monitor all the traffic in a whole sub-network. However, with the trend towards switched, peer-to-peer networks, every port on a switch would have to be monitored to achieve the same visibility to network traffic. In addition, switches and routers make packet-forwarding decisions that affect the flow of traffic through a network. Understanding these traffic flows is critical to maintaining visibility to network utility. So, implementing traffic monitoring within a switch or router is an effective way to monitor traffic on all ports and all VLANs. In recent years NetFlow and sflow are becoming industry standard protocols used in this scenario. Among today's flow-based traffic monitoring technologies, Cisco NetFlow [I] efficiently provides the metering base for a key set of applications including network traffic accounting, usage-based network billing, network planning, as well as Denial of Services (DOS) monitoring capabilities, for both working groups and enterprise customers. NetFlow provides valuable information about who is using the network, what applications are used, when the network is utilized and where traffic is going on the network. The same mechanism includes sflow developed by HP, InMon, Foundry and Juniper, which gives much flexibility to gather multi-layer network flows. The latest innovation in NetFlow is NetFlow version 9, a flexible and extensible method to record network performance data. Cisco is currently working with a number of partners to provide customers with comprehensive solutions for NetFlow-based billing, planning and network monitoring in high-speed campus networks. Although most of today's high-end network routers and switches support NetFlow or sflow, there is still only few flows were gathered and analyzed due to the lack of real-time flow monitor systems. So, the development of a flexible, web-based net flow analyzing system is essential for the monitoring of today's cooperative environments. This paper is organized as follows. The background of network monitoring is introduced in this section, and some recent approaches or relative works are summarized in Section 2. Section 3 describes the structure of the embedded flow agent used to create the flow records, and section 4 gives the design of a webbased system for flow monitoring based on Cisco NetFlow version 5. Finally, a brief conclusion is given in Section Flow-based network monitoring and relative works Traditional probes such as WON and TAP in network devices gives only a partial view of traffic, where the basic frame and byte counters maintained by each network device can be polled via some traditional protocols such as SNMP. This gives an aggregate count 503
2 The 9th International Conference on Computer Supported Cooperative Work in Design Proceedings. of frames and bytes passing through an interface in network device, In this method, if a single host is attached to a switch port, the total volume of traffic to that host will be measured. If multiple services are hosted on that machine (e.g. , web, telnet services in same server), then it is not possible to distinguish between traffic destined for the different users or services. Simitarly, it is not possible to distinguish between Internet web traffic and local file-sharing traffic and therefore bill differently for local and nonlocal traffic in a cooperative environment. In practice errors may also occur with this methodology, for example counters may wrap or line cards may be reset. In such a situation flow data may be lost. Flow-based sampling as En embedded network traffic monitoring technique is now compelling. In a switched environment, the most effective place to monitor traffic is within the switchhouter, where all the traffic of each VLAN can be seen. There were some technologies to monitoring today s network activity using embedded packet or flow-based agents, and this type of traffic monitoring solution embedded within a switch or router must not impact forwarding performance. This solution provides detailed and quantitative traffic measurements, at gigabit speeds, gives insight into forwarding decisions, and does not impact forwarding or network performance. Among these technologies, Cisco NetFlow is a widespread standard for network traffic accounting [I]. Leading network manufacturers such as Cisco, Juniper Network and Extreme Networks provide NetFlow agents as part of their internetworking operating systems with Layer2-4 functions. The other competitive multi-vendor technology, sflow (FSC 3176) [2], is a packet-based sampling technology consists of a packet sampling algorithm, typically performed by the switching/routing ASICs, and a embeded sfiow engine that runs as part of the network management software within the device. The sflow engine combines flow samples (generated by the packet sampling fimction), interface counters, and the state of the forwarding/routing table entries associated with each sampled packet, into an sflow datagram which is immediately forwarded to a central sflow collector. This means that the sflow agent does very little processing of the data and minimizes the CPU and memory utilization. Meanwhile, a central sflow collector receives a continuous stream of sflow datagrams from across the entire network and analyzes them to form a rich, real-time view of Layer2-7 traffic flows across the entire network. There are several NeFlow or sflow collectors available in today s software world. They range from simple capture and store the flow into a database collectors to complex applications such as cfiowd [3] and FlowScan [4]. Unfortunately most of the collectors have been designed for network experts so that very few network administrators really use NetFlow. The consequence of all this, is that most of the people still monitor their networks using SNMP MIB-I1 interface counters [5] and MRTG [6]. In this paper, the author discusses a NetFlow & sflow collector and analyzing system using Web-based architecture as well as data mining approaches. The following sections give the design and the implementation of the system and show how this system can be effectively used to monitor network performance. 3. Flow agents in routers and switches NetFlow & sflow are effective sampling technologies embedded within core switches and routers. They provide the ability to continuously monitor multi-level traffrc flows at wire speed on all interfaces simultaneously. A Flow is a set of packets passing an observation point in the network during a certain time interval. A11 packets belonging to a particular flow have a set of common properties derived from the data contained in the packet and from the packet treatment at the observation point In today s TCP/IP networks, the flow record was formed using some of the common field properties in an IP packet, such as Sourcehlestination IP-address, Protocol IDS, Data Bytes, and Port Numbers Overview of SHOW agents Fig.1 Flow engine embedded in switchhouters Fig.1 gives the structure of flow engine embedded in switcwrouters. The flow engine is a software process that runs as part of the network management software within a device. It combines interface counters and flow samples into flow datagram that are sent across the network to a Flow Collector (or DB Server). Packet sampling is typically performed by the switchinghouting ASICs, providing wire-speed performance. The state of the fonvardingkouting table entries associated with each sampled packet is also recorded. The flow engine does very little processing in the switch. It simply packages data into flow datagrams that are immediately sent on the network via UDP datagrams. Immediate fonvarding of data minimizes 504
3 The 9th IntemationaI Conference on Computer Supported Cooperative Work in Design Proceedings memory and CPU requirements associated with the flow engines Aggregating traffic data on a switch NetFlow operates by accumulating traffic flow totals into an embeded onboard flow cache. For the most detailed data, totals are accumulated for unique flow of source IP address, source UDPflTP port, destination IP address, and destination UDPiTCP port. This method requires a variable, but significant amount of memory, especially under high load conditions. For example, during a denial of service attack when every packet is a separate short-lived flow there may be 30,000 flows per second and the switch must export data rapidly to avoid flow cache overflow. In such a situation flow data may be lost or dropped. To solve the problem, flow aggregation was introduced to merge the flow records generated from different VLANs according to some predefined rules. Because flow aggregation is performed on the switch before being sent to a central data collector, a single measurement can represent a significant fraction of the overall traffic. If a packet containing this data is 1ost;the accuracy of the overall measurement will be impacted. The impact of these situations is impossible to quantify, and therefore the final accuracy of the measurement cannot be characterized, 4. Design of a Web-based flow analyzing system The flow monitoring & analyzing system discussed here consists of three parts: The embeded Flow engines in router and switches, the DB server (collector), and several Web-based application servers for data processing and mining. NetFlow engines embeded in. switchhouters throughout the network continuously send a stream of flow datagrams to a central NetFlow Collector (DB Server) where they are analyzed by some application servers to produce rich, real-time, networkwide view of traffic flows. The web-based architecture gives more friendly interface to the operators, and also more suitable for data integration under different operation systems. This also makes it possible for the network administrators to monitor their networks from a remote site by using navigator software such as Netscape or Microsoft Internet Explorer. Fig.2 shows the main elements of the flow monitoring system. There may be several routerdswitches spread all over the campus network or a CSCW-based design team. Real-time flow records are sent by the switcldrouters, collected by a central DB server and stored in disk arrays. Because the flow data may be very large, some compress method such as CaRT [lo] was used. To ensure the real-time performance of the system, both the indexed file-based storage and the SQL-based database systems are adopted to store the flow data. SwitchlRouter EEEJ Switch/Router Web Server 4 Browser Data Mining ti App. Sewer Fig.2 Components of the flow monitoring system Recently there has been much interest in applying data mining to computer network monitoring and intrusion detection. To ensure the security of the network, a hybrid intrusion detectian scheme is also used based on distributed flow monitoring and data mining [9]. Classification algorithm is used to assign flow data into pre-defined categories. Machine learning software modules perform this task by extracting or learning discrimination rules from examples of correctly classified data. Classification modules can be built using a wide variety of algorithms [ll], and each of them gives different accuracy and real-time performance. Because data mining procedures are very CPU and memory intensive, several web and data mining servers were adopted to improve the system activity NetFlow formats and data structures The exported Neff low datagram consists of a header and a sequence of flow records. Every flow datagram was encapsulated into a UDP packet with up to nine data formats according to Cisco 10s specifications. The Version I format was the original format supported in the initial Cisco 10s software releases containing NetFlow functionality. The Version 5 format is a later enhancement that adds Border Gateway Protocol (BGP) autonomous system information and flow sequence numbers. The Version 7 format is an enhancement that adds NetFlow support for Cisco Catalyst series switches equipped with a NetFlow feature card (NFFC). Versions 2 through 4 and Version 6 were either not released or are not supported by some of ff ow collectors. Version 8 is the NetFlow export format used when the router-based NetFlow aggregation feature is enabled on Cisco 10s router platforms. Most of the NetFlow versions are also supported by the popular Catalyst 6500 enterprise switches equipped with 505
4 The 9th Intemational Conference on Computer Supported Cooperative Work in Design Proceedings different types of supervisor engine such as Sup I, Sup 11, and Sup 720. The proposed NetFlow export version 7 header format and data format are shown below (using C language): struct Head-Record I 1; ushort version; /I Current version=7 ushort count; /I No. of records in PDU ulong SysUptime; I1 Current time in msecs dong unix-secs; // Current seconds since UTC 1970 dong mix-nsecs; //Residual nanoseconds since UTC 1970 ulong flow-sequence; /I Sequence number of total flows seen dong reserved; struct Data-Record:. r ipaddrtype srcaddr; ipaddriype dstaddr; ipaddrtype nexthop; ushort input; ushort output; ulong dpkts; ulong doctets; ulong First; ulong Last; ushort srcport; ushort dstport; uchar flags; uchar tcp-flags; uchar prot; uchar tos; dong src-as; ulong dst-as; uchar src-mask; uchar dst-mask; ush~rt pad; ipaddrtype router-sc; 1; 4.2. Software design /I Source IP Address I/ Destination IP Addr. Jl Next hop router // Input interface index // Output interface index //Packets sent in duration I1 Octets sent in duration I1 SysUptime at flow-start I/ SysUpTime at flow-end. // Source port or equivalent I/ Dest port or equivalent /I Shortcut mode flag // TCP flags /I Protocol, 6=TCP, I7=UDP. // IP Type-of-Service // Source AS number /I Destination AS number // Source subnet mask //Destination subnet mask //Padding When the network switch has been configured properly and the flow data has been exported from the embedded NetFlow engines using UDP datagram, a data processing and analyzing system is needed to give the network administrator some reasonable results under certain conditions. To do, a DB server is needed to collect and store the data, and one or more application server such as Web Server or Analyzing Server will also be needed. Both socket-api and SQL-engine are used for the communication between DB server and. application servers. Fig.3 shows the sofhvare structure of the flow monitoring system. The DB server is running Windows2003 and the application servers are running Windows or Linux systems. Apache and Tomcat was selected as the Web server. UDP Decoder Get Flow Records UDP Flow Datagram Analvzer Requests ScriptGerAets Data Compression Socket API cir DB System 08 Sewer Web Server Fig.3 Software structure of the system The flow-monitoring system is very usefui for the network administrators or designers to monitor and optimize their network performance. The other typical application of such a system is billing/accounting. In a typical billing'accounting application, the objective is to determine from all the packets crossing the network during the billing period (maybe 1 month), how many packets came from a particular source. For example, a common billing strategy is a flat monthly charge that includes an allowance (say 4 GB) with additional charges for each additional GB. In this scenario, the system must store enough records in the database system to meet these needs. To reduce the storage space needed, we merged some of the flow records according to some predefined conditions such as minimal flow size, certain source and destination IP addresses, specified VLANs, etc. Data compress technology was also used for this purpose. 5. Conclusion Because flow-based sampling is an inexpensive monitoring technology that easily keeps up with today's high-speed switched networks, flow-based technology efficiently provides the metering base for a key set of applications including accountinghilling, network planning, network monitoring and outbound marketing for both service provider and enterprise customers. Many manufacturers also provide a set of NetFlow & sflow management utilities to collect flow export data, perform data volume reduction, post-processing and storage and make flow detail records available to 506
5 The 9th International Conference on Computer Supported Cooperative Work in Design Proceedings consumer applications in a convenient format. As part of the development of OUT network management system in the university campus network, we adopted a webbased architecture and made a prototype of NetFlow network monitoring system to monitor our campus network and inspect network activity for some certain groups under CSCW environment, Results show that it is very suitable for network monitoring and billing, rating and provisioning. The flow-based network monitoring scheme had been used in Jinan University for the development of several application systems such as distribute cement.material simulation, grid-computing, and campusnetwork management. Some future works are still under development to get detailed characterization of packet flows that supports itemized audit for different purpose and intrusion detection on many levels. Acknowledgement This work was supported by the National Natural Science Foundation of China under contract No ; the National High Technology Development Program of China (863 Program) under contract No.2002AA423240; and the Science and Technology Development Project of Shandong under contract No.2001G09 and No.SDSP References [I] Cisco 10s NetFlow Technology Data Sheet, online at h~:// [Z] P. Phaal, S. Panchen, N. McKee, A Method for Monitoring Traffic in Switched and Routed Networks, IETF RFC 3176, September 200 I. [3] Cflowd. htta:/~.cwarie,ca/canet4/mo~t~e/c8awdhcml [4] FlowScan. caida.or~/tools/utilities/ffowscan/ [5] K. Mcaoghrie, M.T. Rose, Management Information Base for Network management of TCPIIP-based Intemets: MIB-11, RFC1213, March [SI T. Oetiker, Multi Router Traffic Grapher (MRTG), online uz [7] L. Deri, R. Carbone, and S. Suin, Monitoring Networks Using Ntop, Proc. of MZOO1, Seattle, May [XI Network Research Group, libpcap, Lawrence Berkeley National Labs, online at httn:// [9] Yang Bo, Li Han, et al. A hybrid intrusion detection saategy used for web security, Lecture Nofes in Arrificial Intelligence, [lo] L.Breiman,J.H. Friedman,R.A. et al. Classification and Regression Trees, Chapman & Hall, 1984 [ 113 Mnos Garofalakis,Rajeev Rastogi, Network Data Mining and Ana1ysis:Tbe NEMESIS Project, mite Paper, Bell Labs, Lucent Technologies. 507
This chapter describes how to configure NetFlow Data Export (NDE).
51 CHAPTER This chapter describes how to configure NetFlow Data Export (NDE). Note For complete syntax and usage information for the commands used in this chapter, refer to these publications: The Cisco
More informationThis chapter describes how to configure NetFlow Data Export (NDE).
56 CHAPTER This chapter describes how to configure NetFlow Data Export (NDE). Note For complete syntax and usage information for the commands used in this chapter, see these publications: The Cisco IOS
More informationConfiguring NetFlow and NetFlow Data Export
Configuring NetFlow and NetFlow Data Export This module contains information about and instructions for configuring NetFlow to capture and export network traffic data. NetFlow capture and export are performed
More informationCHAPTER 44 This chapter describes how to configure NetFlow Statistics on the Catalyst 4500 series switches. It also provides guidelines, procedures, and configuration examples. To use the NetFlow feature,
More information-sflow. MRTG(Multi Router Traffic Grapher) MRTG NetFlow SNMP PNG HTML MRTG. Netflow. Statistic PC Collector. PC ( Statistic PC ) Analyzer.
TANET -sflow 1. MRTG Netflow MRTG(Multi Router Traffic Grapher) SNMP PNG HTML MRTG : Unix Windows MRTGPERL MRTG C PNG GD PNG MRTG Web Cisco Netflow (traffic) Cisco Netflow : Cisco Router flow-export function
More informationNetFlow Configuration Guide
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More informationConfiguring NetFlow and NDE
CHAPTER 47 This chapter describes how to configure NetFlow statistics collection and NetFlow Data Export (NDE) on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands
More informationsflow (http://www.sflow.org) Agent Software Description
sflow (http://www.sflow.org) sflow Agent Software Description This slide set is intended as a guide to InMon s example sflow agent software. The concepts and design choices are illustrated. The intention
More informationMaster Course Computer Networks IN2097
Chair for Network Architectures and Services Prof. Carle Department for Computer Science TU München Master Course Computer Networks IN2097 Prof. Dr.-Ing. Georg Carle Christian Grothoff, Ph.D. Dr. Nils
More informationUsing NetFlow Filtering or Sampling to Select the Network Traffic to Track
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track First Published: June 19, 2006 Last Updated: December 17, 2010 This module contains information about and instructions for selecting
More informationUsing NetFlow Sampling to Select the Network Traffic to Track
Using NetFlow Sampling to Select the Network Traffic to Track This module contains information about and instructions for selecting the network traffic to track through the use of NetFlow sampling. The
More informationConfiguring NetFlow BGP Next Hop Support for Accounting and Analysis
Configuring NetFlow BGP Next Hop Support for Accounting and Analysis This document provides information about and instructions for configuring NetFlow Border Gateway Protocol (BGP) next hop support. This
More informationAdvanced Registry Operations Curriculum NetFlow
Advanced Registry Operations Curriculum NetFlow These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) as
More informationIntroduction to Netflow
Introduction to Netflow Campus Network Design & Operations Workshop These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
More informationConfiguring NetFlow and NetFlow Data Export
This module contains information about and instructions for configuring NetFlow to capture and export network traffic data. NetFlow capture and export are performed independently on each internetworking
More informationNet-fow Ne t wo r k S e c u r i t y J u n e Pa p e e t e, F r e n c h Po l y n e s i a
Net-fow Ne t wo r k S e c u r i t y J une 2009 Pa p e e t e, F r e n c h Po l y n e s i a Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and
More informationNetwork Management and Monitoring
Network Management and Monitoring Introduction to Netflow These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
More informationMaster Course Computer Networks IN2097
Chair for Network Architectures and Services Prof. Carle Department for Computer Science TU München Master Course Computer Networks IN2097 Chapter 7 - Network Measurements Introduction Architecture & Mechanisms
More informationIntroduction to sflow
More From Your Network Introduction to sflow Holger Hasenaug, Technical Consultant HP ProCurve Networking CCIE#6343 2004 Hewlett-Packard Development Company, L.P. The information contained herein is subject
More informationFlexible Netflow Configuration Guide, Cisco IOS Release 15S
Flexible Netflow Configuration Guide, Cisco IOS Release 15S Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS
More informationUsing NetFlow Sampling to Select the Network Traffic to Track
Using NetFlow Sampling to Select the Network Traffic to Track Last Updated: September 17, 2012 This module contains information about and instructions for selecting the network traffic to track through
More informationConfiguring IP Services
This module describes how to configure optional IP services. For a complete description of the IP services commands in this chapter, refer to the Cisco IOS IP Application Services Command Reference. To
More informationNetFlow and NetFlow Data Export.
Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export This module contains the minimum amount of information about and instructions necessary for configuring NetFlow to capture and
More informationUsing NetFlow Filtering or Sampling to Select the Network Traffic to Track
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track Last Updated: December 7, 2011 This module contains information about and instructions for selecting the network traffic to track
More informationConfiguring NetFlow Statistics Collection
38 CHAPTER This chapter describes how to configure NetFlow statistics on the Catalyst 4500 series switches. It also provides guidelines, procedures, and configuration examples. This feature is only available
More informationHow the Internet sees you
IBM Research Zurich How the Internet sees you Demonstrating what activities most ISPs see you doing on the Internet Jeroen Massar 2010 IBM Corporation Network of networks You 2 CCC
More informationConfiguring NetFlow BGP Next Hop Support for Accounting and Analysis
Configuring NetFlow BGP Next Hop Support for Accounting and Analysis Last Updated: November 27, 2012 This document provides information about and instructions for configuring NetFlow Border Gateway Protocol
More informationOverview of the NetFlow FlowAnalyzer
CHAPTER 1 Overview of the NetFlow FlowAnalyzer NetFlow FlowAnalyzer Version 2.0 is a network analysis tool that you can use to display and analyze network traffic information collected from Cisco NetFlow-enabled
More informationsflow Elisa Jasinska
sflow Elisa Jasinska elisa.jasinska@ams-ix.net Agenda What is sflow? What is AMS-IX? AMS-IX requirements Existing software solutions Performance issues Software used at AMS-IX Privacy Results What is sflow?
More informationNetFlow Configuration Guide, Cisco IOS Release 15S
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More informationsflow Agent Contents 14-1
14 sflow Agent Contents Overview..................................................... 14-2 Flow Sampling by the sflow Agent........................... 14-2 Counter Polling by the sflow Agent...........................
More informationNetFlow Multiple Export Destinations
Feature History Release 12.0(19)S 12.0(19)ST 12.2(2)T 12.2(14)S Modification This feature was introduced on the Cisco 12000 Internet router. This feature was integrated into Cisco IOS Release 12.0(19)ST.
More informationNetFlow Configuration Guide, Cisco IOS Release 15S
NetFlow Configuration Guide, Cisco IOS Release 15S Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)
More informationConfiguring SNMP and using the NetFlow MIB to Monitor NetFlow Data
Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data Last Updated: November 27, 2012 NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router.
More informationThis chapter provides information to configure Cflowd.
Cflowd In This Chapter This chapter provides information to configure Cflowd. Topics in this chapter include: Cflowd Overview on page 564 Operation on page 565 Cflowd Filter Matching on page 569 Cflowd
More informationFlow export an visualization (Flowviz)
Flow export an visualization (Flowviz) Maurizio Molina (DANTE) molina@dante.org.uk 1 st EMANICS summer school Bremen, 12 th July, 2007 General Outline Introduction to IP flows IP flow monitoring systems
More informationFlexible NetFlow - Top N Talkers Support
This document contains information about and instructions for using the Flexible NetFlow - Top N Talkers Support feature. The feature helps you analyze the large amount of data that Flexible NetFlow captures
More informationTraffic Flow Measurements within IP Networks: Requirements, Technologies and Standardization
Traffic Flow Measurements within IP Networks: Requirements, Technologies and Standardization Jürgen Quittek NEC Europe Ltd., Network Laboratories, Heidelberg, Germany Tanya Szeby, Georg Carle, Sebastian
More informationFrom NetFlow to IPFIX the evolution of IP flow information export
From NetFlow to IPFIX the evolution of IP flow information export Brian Trammell - CERT/NetSA - Pittsburgh, PA, US Elisa Boschi - Hitachi Europe - Zurich, CH NANOG 41 - Albuquerque, NM, US - October 15,
More informationUsing Flexible NetFlow Top N Talkers to Analyze Network Traffic
Using Flexible NetFlow Top N Talkers to Analyze Network Traffic Last Updated: September 4, 2012 This document contains information about and instructions for using the Flexible NetFlow--Top N Talkers Support
More informationCSCD 443/533 Advanced Networks
CSCD 443/533 Advanced Networks Lecture 10 Usage and Network Measurement Spring 2016 Reading: See References at end 1 Topics Internet Usage Measurement overview Why measure? What to measure? Where to measure?
More informationRIPE75 - Network monitoring at scale. Louis Poinsignon
RIPE75 - Network monitoring at scale Louis Poinsignon Why monitoring and what to monitor? Why do we monitor? Billing Reducing costs Traffic engineering Where should we peer? Where should we set-up a new
More informationIP Accounting C H A P T E R
C H A P T E R 6 IP Accounting This chapter describes the IP Accounting features in Cisco IOS and enables you to distinguish the different IP Accounting functions and understand SNMP MIB details. This chapter
More informationFlowMonitor for WhatsUp Gold v16.3 User Guide
FlowMonitor for WhatsUp Gold v16.3 User Guide Contents Flow Monitor Overview Welcome to WhatsUp Gold Flow Monitor... 1 What is Flow Monitor?... 2 How does Flow Monitor work?... 2 Flow Monitor System requirements...
More informationConfiguring sflow. Information About sflow. sflow Agent. This chapter contains the following sections:
This chapter contains the following sections: Information About sflow, page 1 Licensing Requirements, page 2 Prerequisites, page 2 Guidelines and Limitations for sflow, page 2 Default Settings for sflow,
More informationChapter 1: Enterprise Campus Architecture. Course v6 Chapter # , Cisco Systems, Inc. All rights reserved. Cisco Public
Chapter 1: Analyzing The Cisco Enterprise Campus Architecture CCNP SWITCH: Implementing IP Switching Course v6 1 Chapter 1 Objectives Describe common campus design options and how design choices affect
More informationNetFlow Configuration Guide, Cisco IOS Release 12.2SX
NetFlow Configuration Guide, Cisco IOS Release 12.2SX Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)
More informationNetFlow Reliable Export With SCTP
NetFlow is a Cisco IOS application that provides statistics on packets flowing through the router. It is emerging as a primary network accounting and security technology. This document describes the NetFlow
More informationConfiguring NetFlow. About NetFlow. This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices.
This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices. About NetFlow, page 1 Licensing Requirements for NetFlow, page 4 Prerequisites for NetFlow, page 4 Guidelines and Limitations
More informationNetflow v9 for IPv6. Finding Feature Information. Prerequisites for Netflow v9 for IPv6. Information About Netflow v9 for IPv6
Netflow v9 for IPv6 Last Updated: July 31, 2012 This module contains information about and instructions for configuring NetFlow and NetFlow Data Export (NDE) for capturing and exporting data from IP version
More informationIP Source Tracker. Finding Feature Information. Restrictions for IP Source Tracker. Last Updated: January 18, 2012
IP Source Tracker Last Updated: January 18, 2012 The IP Source Tracker feature tracks information in the following ways: Gathers information about the traffic that is flowing to a host that is suspected
More informationUnderstanding How Routing Updates and Layer 2 Control Packets Are Queued on an Interface with a QoS Service Policy
Understanding How Routing Updates and Layer 2 Control Packets Are Queued on an Interface with a QoS Service Policy Document ID: 18664 Contents Introduction Prerequisites Requirements Components Used Conventions
More informationMonitoring network bandwidth on routers and interfaces; Monitoring custom traffic on IP subnets and IP subnets groups; Monitoring end user traffic;
NetVizura NetFlow Analyzer enables you to collect, store and analyze network traffic data by utilizing Cisco NetFlow, IPFIX, NSEL, sflow and compatible netflow-like protocols. It allows you to visualize
More informationConfiguring NetFlow. Information About NetFlow. Send document comments to CHAPTER
CHAPTER 11 Use this chapter to configure NetFlow to characterize IP traffic based on its source, traffic destination, timing, and application information, giving visibility into traffic transiting the
More informationIPv6 in Campus Networks
IPv6 in Campus Networks Dave Twinam Manager, Technical Marketing Engineering Internet Systems Business Unit dtwinam@cisco.com Cisco Twinam IPv6 Summit 2003 Cisco Systems, Inc. All rights reserved. 1 IPv6
More informationConfiguring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands
Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands This module contains information about and instructions for configuring NetFlow Top Talkers feature. The NetFlow Top Talkers
More informationTraffic and Performance Visibility for Cisco Live 2010, Barcelona
Traffic and Performance Visibility for Cisco Live 2010, Barcelona Background Cisco Live is Cisco's annual premier education and training event for IT, networking, and communications professionals. Cisco
More informationHPE Security ArcSight Connectors
HPE Security ArcSight Connectors SmartConnector for IP Flow (NetFlow/J-Flow) Configuration Guide October 17, 2017 SmartConnector for IP Flow (NetFlow/J-Flow) October 17, 2017 Copyright 2004 2017 Hewlett
More informationTrisul Network Analytics - Traffic Analyzer
Trisul Network Analytics - Traffic Analyzer Using this information the Trisul Network Analytics Netfllow for ISP solution provides information to assist the following operation groups: Network Operations
More informationCONTENTS IN DETAIL ACKNOWLEDGMENTS INTRODUCTION 1 1 FLOW FUNDAMENTALS 9 2 COLLECTORS AND SENSORS 21
CONTENTS IN DETAIL ACKNOWLEDGMENTS xv INTRODUCTION 1 Network Administration and Network Management... 3 Network Management Tools... 3 MRTG, Cricket, and Cacti... 3 RTG... 4 Nagios and Big Brother... 4
More informationProgrammable Network Node: Applications
Programmable Network Node: Applications Tal Lavian 1 tlavian@ieee.org Rob Jaeger 1,2 rojaeger@nortelnetworks.com rfj@cs.umd.edu 1 Technology Center, Enterprise Solutions, Nortel Networks 2 Department of
More informationECPE / COMP 177 Fall Some slides from Kurose and Ross, Computer Networking, 5 th Edition
ECPE / COMP 177 Fall 2016 Some slides from Kurose and Ross, Computer Networking, 5 th Edition Course Organization Top-Down! Starting with Applications / App programming Then Transport Layer (TCP/UDP) Then
More informationCisco Catalyst 6500 Supervisor Engine 2T: NetFlow Enhancements
Cisco Catalyst 6500 Supervisor Engine 2T: NetFlow Enhancements White Paper March 5, 2011 Contents Overview... 3 NetFlow Introduction... 3 Sup2T Increased NetFlow Scalability... 6 Egress NetFlow... 7 Sampled
More informationpmacct and Streaming Telemetry
pmacct and Streaming Telemetry Paolo Lucente pmacct ITNOG 2, Bologna Nov 2016 whoami Paolo Lucente Github: paololucente Twitter: @Paolo_Lucente Digging data out of networks worldwide for fun and profit
More informationCisco SAN Analytics and SAN Telemetry Streaming
Cisco SAN Analytics and SAN Telemetry Streaming A deeper look at enterprise storage infrastructure The enterprise storage industry is going through a historic transformation. On one end, deep adoption
More informationEXAM TCP/IP NETWORKING Duration: 3 hours
SCIPER: First name: Family name: EXAM TCP/IP NETWORKING Duration: 3 hours Jean-Yves Le Boudec January 2017 INSTRUCTIONS 1. Write your solution into this document and return it to us (you do not need to
More informationThis chapter describes how to configure the NetFlow feature on Cisco NX-OS devices.
This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices. Finding Feature Information, page 1 NetFlow, page 2 Licensing Requirements for NetFlow, page 6 Prerequisites for NetFlow,
More informationCIS 551 / TCOM 401 Computer and Network Security. Spring 2006 Lecture 16
CIS 551 / TCOM 401 Computer and Network Security Spring 2006 Lecture 16 Announcements Midterm II March 21st (One week from today) In class Same format as last time Will cover all material since Midterm
More informationConfiguring NetFlow. Understanding NetFlow CHAPTER
50 CHAPTER This chapter describes how to configure NetFlow statistics collection on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands used in this chapter,
More informationHardware Flow Offload. What is it? Why you should matter?
Hardware Offload What is it? Why you should matter? Good News: Network Speed The market is moving from 10 Gbit to 40/100 Gbit At 40 Gbit frame inter-arrival time is ~16 nsec At 100 Gbit frame inter-arrival
More informationCS 640: Introduction to Computer Networks. Today s Lecture. Page 1
CS 640: Introduction to Computer Networks Aditya Akella Lecture 2 Layering, Protocol Stacks, and Standards 1 Today s Lecture Layers and Protocols A bit about s 2 Network Communication: Lots of Functions
More informationDDoS Protection in Backbone Networks
DDoS Protection in Backbone Networks The Czech Way Pavel Minarik, Chief Technology Officer Holland Strikes Back, 3 rd Oct 2017 Backbone DDoS protection Backbone protection is specific High number of up-links,
More informationThe Internet. Overview. Network building blocks
The Internet Lecture 24 Based in part on material from Computer Networks: A Systems Approach by Larry Peterson & Bruce Davie CS 638 Web Programming Overview Network building blocks Nodes: PC, special-purpose
More informationCisco Virtual Networking Solution for OpenStack
Data Sheet Cisco Virtual Networking Solution for OpenStack Product Overview Extend enterprise-class networking features to OpenStack cloud environments. A reliable virtual network infrastructure that provides
More informationSOLUTION BRIEF: TROUBLESHOOTING WITH GEARBIT AND PROFISHARK WIRESHARK HEROES SERIES VISIT
SOLUTION BRIEF: TROUBLESHOOTING WITH GEARBIT AND PROFISHARK WIRESHARK HEROES SERIES VISIT WWW.PROFITAP.COM ISSUE HUNTING I m ashamed to admit it but this one caused issues for several weeks. OK, months.
More informationSingle Network: applications, client and server hosts, switches, access links, trunk links, frames, path. Review of TCP/IP Internetworking
1 Review of TCP/IP working Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path Frame Path Chapter 3 Client Host Trunk Link Server Host Panko, Corporate
More informationConfiguring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands
Configuring NetFlow Top Talkers using Cisco IOS CLI Commands or SNMP Commands Last Updated: April 12, 2012 This module contains information about and instructions for configuring NetFlow Top Talkers feature.
More informationOverview of IPM. What is IPM? CHAPTER
CHAPTER 1 This chapter provides an overview of Cisco Internetwork Performance Monitor (IPM) application. It contains the following sections: What is IPM?, page 1-1 Key Terms and Concepts, page 1-3 How
More informationFlow-based Accounting: Applications and Standardisation
Flow-based Accounting: Applications and Standardisation SCAMPI Workshop May 3, 2004 Simon Leinen, SWITCH Flow-based Accounting - Basic Idea Classify packets into flows (equivalence classes)
More informationA Study on Intrusion Detection Techniques in a TCP/IP Environment
A Study on Intrusion Detection Techniques in a TCP/IP Environment C. A. Voglis and S. A. Paschos Department of Computer Science University of Ioannina GREECE Abstract: The TCP/IP protocol suite is the
More informationHP 6125G & 6125G/XG Blade Switches
HP 6125G & 6125G/XG Blade Switches Network Management and Monitoring Configuration Guide Part number: 5998-3162b Software version: Release 2103 and later Document version: 6W103-20151020 Legal and notice
More informationMonitoring and Analysis
CHAPTER 3 Cisco Prime Network Analysis Module 5.1 has two types of dashboards: One type is the summary views found under the Monitor menu, and the other type is the over time views found under the Analyze
More informationHP 6125 Blade Switch Series
HP 6125 Blade Switch Series Network Management and Monitoring Configuration Guide Part number: 5998-3162 Software version: Release 2103 Document version: 6W100-20120907 Legal and notice information Copyright
More informationCisco ISR G2 Management Overview
Cisco ISR G2 Management Overview Introduction The new Cisco Integrated Services Routers Generation 2 (ISR G2) Family of routers delivers the borderless network that can transform the branch office and
More informationIntelligent WAN NetFlow Monitoring Deployment Guide
Cisco Validated design Intelligent WAN NetFlow Monitoring Deployment Guide September 2017 Table of Contents Table of Contents Deploying the Cisco Intelligent WAN... 1 Deployment Details...1 Deploying NetFlow
More informationFlexible Netflow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
Flexible Netflow Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com
More informationAddressing and Routing
Addressing and Routing Andrew Scott a.scott@lancaster.ac.uk Physical/ Hardware Addresses Aka MAC* or link(-layer) address Can only talk to things on same link Unique ID given to every network interface
More informationInformation about Network Security with ACLs
This chapter describes how to configure network security on the switch by using access control lists (ACLs), which in commands and tables are also referred to as access lists. Finding Feature Information,
More informationChapter 2 - Part 1. The TCP/IP Protocol: The Language of the Internet
Chapter 2 - Part 1 The TCP/IP Protocol: The Language of the Internet Protocols A protocol is a language or set of rules that two or more computers use to communicate 2 Protocol Analogy: Phone Call Parties
More informationCSC 4900 Computer Networks: Routing Protocols
CSC 4900 Computer Networks: Routing Protocols Professor Henry Carter Fall 2017 Last Time Link State (LS) versus Distance Vector (DV) algorithms: What are some of the differences? What is an AS? Why do
More informationLecture 8. Network Layer (cont d) Network Layer 1-1
Lecture 8 Network Layer (cont d) Network Layer 1-1 Agenda The Network Layer (cont d) What is inside a router Internet Protocol (IP) IPv4 fragmentation and addressing IP Address Classes and Subnets Network
More informationINTERNET TRAFFIC MEASUREMENT (PART II) Gaia Maselli
INTERNET TRAFFIC MEASUREMENT (PART II) Gaia Maselli maselli@di.uniroma1.it Prestazioni dei sistemi di rete 2 Overview Basic concepts Characterization of traffic properties that are important to measure
More informationTroubleshooting High CPU Utilization Due to the IP Input Process
Troubleshooting High CPU Utilization Due to the IP Input Process Document ID: 41160 Contents Introduction Prerequisites Requirements Components Used Conventions IP Input Sample IP Packet Debugging Session
More informationSybex ICND2/CCNA R/S Chapter 17: IP Services. Instructor & Todd Lammle
Sybex ICND2/CCNA R/S Chapter 17: IP Services Instructor & Todd Lammle Chapter 17 Objectives The ICND2 Topics Covered in this chapter include: IP Services Recognize high availability (FHRP) VRRP HSRP GLBP
More informationHP 5920 & 5900 Switch Series
HP 5920 & 5900 Switch Series Network Management and Monitoring Configuration Guide Part number: 5998-2900 Software version: Release 2210 Document version: 6W100-20131105 Legal and notice information Copyright
More informationConfiguring MPLS Egress NetFlow Accounting and Analysis
Configuring MPLS Egress NetFlow Accounting and Analysis This module contains information about and instructions for configuring the MPLS Egress NetFlow Accounting feature. The MPLS Egress NetFlow Accounting
More informationDetecting and Analyzing Network Threats With NetFlow
Detecting and Analyzing Network Threats With NetFlow First Published: June 19, 2006 Last Updated: October 02, 2009 This document contains information about and instructions for detecting and analyzing
More informationConfiguring Application Visibility and Control for Cisco Flexible Netflow
Configuring Application Visibility and Control for Cisco Flexible Netflow First published: July 22, 2011 This guide contains information about the Cisco Application Visibility and Control feature. It also
More informationChapter 4: network layer. Network service model. Two key network-layer functions. Network layer. Input port functions. Router architecture overview
Chapter 4: chapter goals: understand principles behind services service models forwarding versus routing how a router works generalized forwarding instantiation, implementation in the Internet 4- Network
More informationCisco IOS Flexible NetFlow Command Reference
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More information