NTG异常流量监测系统原理讲解

Understanding

NetFlowTopicsNetflowOverviewNetflowDatagramDeployNetflowNetflowOverviewFlow1.SourceAddress2.DestinationAddress3.SourcePort4.DestinationPort5.Layer3Protocol6.TOSByte(DSCP)7.InputInterfaceSevenKeys

DefineaFlow:NetFlowDataExportedNetflowEmpowersuserswiththeabilitytocharacterizetheirIPdataflowsThewho,what,where,when,andhowmuchIPtrafficquestionsareansweredUsageInformationTrafficAnalysis

andMonitoringforNetworkPlanningRouterFeatureAccelerationNetFlowUsingUDPtosendmultipleflowrecordsinonepacketFormatsVersion1(V1)Version5(V5)Version7(V7)Version8(V8)Version9(V9)Versions2,3,4,and6werenotreleasedFlowRecordFlowRecordFlowRecordFlowRecordHeaderSequenceNumberRecordCountVersionNumberNetFlowSequence

RouterCreateandupdateflowsinNetFlowCacheInactivetimerexpired(15secisdefault)

Activetimerexpired(30min(1800sec)isdefault)NetFlowcacheisfull(oldestflowsareexpired)RSTorFINTCPFlagHeaderExportPacketPayload(flows)ExpirationAggregation?e.g.Protocol-PortAggregationSchemebecomesExportVersionYesNoAggregatedFlows–exportVersion8or9Non-AggregatedFlows–exportVersion5or9TransportProtocolNetflowDatagramNetflowVersionsNetflowV1theoriginalformatsupportedintheinitialNetFlowreleases.NetflowV5AddsBorderGatewayProtocol(BGP)autonomoussysteminformationandflowsequencenumbers.NetflowV7exclusivelysupportsCiscoCatalyst5000seriesswitcheswithaNetFlowfeaturecard(NFFC).NotcompatiblewithCiscorouters.NetflowV8Addsrouter-basedaggregationschemes.NetflowV9Flexible,extensiblefileexportformattoenableeasiersupportofadditionalfields&technologies;comingoutnowMPLS,Multicast,&BGPNextHopNetflowHeadersVersionCount(No.ofRecords)SysUptimeUnix_secsUnix_nsecsFlow_sequesceEngine_typeEngine_idAggregationAgg_version(=2)Version1Version5Version8Version:NetflowVersionNumberCount:ThenumberofrecordsinPDUFlow_sequence:Sequencenumber totalflowsseenAggregation:Aggregationmethod beingused Sampling_intervalSampling_interval:thesampling type(2bits)andintervalVersion7Count(No.ofFlowSet)SourceIDVersion9NetflowV1FlowRecordSourceIPAddressDestinationIPAddressInputInterfacePortOutputInterfacePortTypeofServiceTCPFlags(CumulativeOR)ProtocolPacketCountByteCountStartTimestampEndTimestampSourceTCP/UDPPortDestinationTCP/UDPPortUsageQoSTimeofDayApplicationRouting

andPeeringPortUtilizationFrom/ToNextHopAddressNetflowV5FlowRecordSourceIPAddressDestinationIPAddressInputInterfacePortOutputInterfacePortTypeofServiceTCPFlags(CumulativeOR)ProtocolPacketCountByteCountStartTimestampEndTimestampSourceTCP/UDPPortDestinationTCP/UDPPortUsageQoSTimeofDayApplicationRouting

andPeeringPortUtilizationFrom/ToNextHopAddressSourceASNumberDest.ASNumberSourcePrefixMaskDest.PrefixMaskNetflowV7FlowRecordSourceIPAddressDestinationIPAddressInputInterfacePort(0)OutputInterfacePortTypeofService(1stpkt)TCPFlags(0)ProtocolPacketCountByteCountStartTimestampEndTimestampSourceTCP/UDPPortDestinationTCP/UDPPortUsageQoSTimeofDayApplicationPortUtilizationFrom/ToRouter_scShort-cutRouterRouting

andPeeringNextHopAddress(0)SourceASNumber(0)Dest.ASNumber(0)SourcePrefixMask(0)Dest.PrefixMask(0)NetflowSamplingSampled–GSRonlyForspeedshigherthanOC-3stronglyrecommendedOnlyusedinV5andV9Rangefrom10to16382(packets)Defaultintervalis4billion(toprotecttherouterfrombeingchokedbyamisconfiguration)NetflowV9A

exportformatFlexibleandextensibleStillapushmodelSentthetemplateregularly(configurable)Independentoftheunderlyingprotocol,itisreadyforanyreliableprotocol(ie:TCP,SCTP)NetFlowv9

ExportPacketHeaderDataFlowSetTemplateFlowSetOptionTemplateFlowSetFlowSetID#1DataFlowSetFlowSetID#2TemplateID(specificFieldtypesandlengths)(version,#packets,sequence#,SourceID)MatchingID#sisthewaytoassociateTemplatetotheDataRecordsTheHeaderfollowsthesameformataspriorNetFlowversionssoCollectorswillbebackwardcompatibleEachDataRecordrepresentsoneflowIfexportedflowshavethesamefieldsthentheycanbecontainedinthesameTemplateRecorde.g.unicasttrafficcanbecombinedwithmulticastrecordsIfexportedflowshavedifferentfieldsthentheycan’tbecontainedinthesameTemplateRecorde.g.BGPnext-hopcan’tbecombinedwithMPLSAwareNetFlowrecordsFlowsfromInterfaceAFlowsfromInterfaceBTosupporttechnologiessuchasMPLSorMulticast,thisexportformatcanbeleveragedtoeasilyinsertnewfieldsOptionDataFlowSetFlowSetIDOptionDataRecord(Fieldvalues)OptionDataRecord(Fieldvalues)TemplateRecordTemplateID#2(specificFieldtypesandlengths)TemplateRecordTemplateID#1(specificFieldtypesandlengths)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)NetFlowv9

FlexibleFormatHeaderTemplateFlowSetDataFlowSetFlowSetIDDataFlowSetFlowSetIDExampleofExportPacketrightafterrouterbootorNetFlowconfigurationExampleofExportPacketscontainingmostlyflowinformationOptionDataFlowSetFlowSetIDHeaderOptionDataRecord(Fieldvalues)OptionDataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)DataRecord(Fieldvalues)(version,#packets,sequence#,SourceID)(version,#packets,sequence#,SourceID)TemplateRecordTemplateID(specificFieldtypesandlengths)TemplateRecordTemplateID(specificFieldtypesandlengths)TemplateRecordTemplateID(specificFieldtypesandlengths)TemplateRecordTemplateID(specificFieldtypesandlengths)OptionTemplateFlowSetTemplateID(specificFieldtypesandlengths)NetFlowv9

ExportPacketIETFSpecificationOptionFlowsetssenddataassociatedwith:SystemInterfaceLineCardCacheTemplateExample:ThesamplingrateassociatedwithaparticularinterfaceNetFlowv9

SolutionsbyTechnologyMPLSIPV6MulticastBGPNext-hopNetFlowv9

MPLSAwareNetFlow

IPFieldsSourceanddestinationIPaddressInputandoutputsub-interfacesTransportlayerprotocolSourceanddestinationapplicationportnumbers8bitIPTypeofService(ToS)TCPFlags(accumulationfromallpacketsintheflow)MPLSFieldsUptothreeincomingMPLSlabelswithexperimental(EXP)bitsandend-of-stack(S)bitPositionofeachofthethreelabelsTypeofthetoplabelIPaddressassociatedwiththetoplabelTraditionalNetFlowFieldsNumberofpacketsNumberofbytes(counteitherIPorMPLSheader/payload)Time-stampsoffirstandlastpacketsintheflowMPLSTraditionalNetFlow

forIPtoMPLStrafficPEPPEEgressMPLSNetFlowAccountingIPinformationonlyIdealforbillingCurrentavailability:CiscoIOSSoftwareReleases12.0(10)STand12.1(5)T

MPLSAwareNetFlow(version9)ExportsuptothreeMPLSlabels,andIPpacketinformationIdealforTrafficEngineeringWillbeavailableinCiscoIOSSoftwareReleases12.0(24)S,12.2S,and12.3TrafficFlowIPIPEgressMPLSNetFlowAccountingforMPLStoIPtrafficMPLSAwareNetFlow

(version9)NetFlowv9

MPLSAwareNetFlowNetFlowv9

Multicast

TraditionalNetFlowMulticastNetFlowIngressMulticastNetFlowEgressNetFlowv9

Multicast-TraditionalNetFlowEth0Eth3Eth1Eth2InterfaceEthernet0 iproute-cacheflowipflow-exportversion9ipflow-exportdestination9995NetFlowCollectorserverTraditionalNetFlowconfiguration(S,G)-(,00)FlowRecordCreatedinNetFlowCacheThereisonlyoneflowperNetFlowconfiguredinputinterfaceThe7KeyfieldsthatdefineauniqueflowaremarkedinredDestinationinterfaceismarkedas“Null”BytesandPacketsaretheincomingvaluesNetFlowv9

Multicast-NetFlowIngressInterfaceEthernet0 ipmulticastnetflowingressipflow-exportversion9ipflow-exportdestination9995MulticastNetFlowIngressconfigurationFlowRecordCreatedinNetFlowCacheThereisonlyoneflowperNetFlowconfiguredinputinterfaceThe7KeyfieldsthatdefineauniqueflowaremarkedinredDestinationinterfaceismarkedas“Null”BytesandPacketsaretheoutgoingvaluesEth0Eth3Eth1Eth2NetFlowCollectorserver(S,G)-(,00)NetFlowv9

Multicast-NetFlowEgressInterfaceEthernet1 ipmulticastnetflowegressInterfaceEthernet2 ipmulticastnetflowegressInterfaceEthernet3 ipmulticastnetflowegressipflow-exportversion9ipflow-exportdestination9995MulticastNetFlowEgressconfigurationFlowRecordsCreatedinNetFlowCacheThereisoneflowperMulticastNetFlowEgressconfiguredoutputinterfaceOneofthe7KeyfieldsthatdefineauniqueflowhaschangedfromSourceInterfacetoDestinationInterfaceBytesandPacketsaretheoutgoingvaluesEth0Eth3Eth1Eth2NetFlowCollectorserver(S,G)-(,00)NetFlowv9

BGPNextHopSupportedonlyinversion9exportFortrafficengineering/analysisandpossiblebillingapplicationsFieldsthatareexportedincludeallthosefoundinversion5exportWillbesupportedinCiscoIOSSoftwareReleases12.0(26)S,12.2S,and12.3NetFlowv9

IPv6IPv6SourceAddressIPv6SourceMaskIPv6DestinationAddressIPv6DestinationMaskIPv6NextHopIPv6OptionHeadersBit15Bit14Bit13Bit12Bit11Bit10Bit9Bit8ReservedReservedReservedReservedreservedEncryptedSecurityPayload(50)Authenticationheader(51)PayloadcompressionHeader(108)Bit7Bit6Bit5Bit4Bit3Bit2Bit1Bit0DestinationoptionHeader(60)Hop-by-hopoptionHeade(0)reservedCannotreachlayer4header(compressed,encrypted,Notsupported)Fragmentationheader(44)–firstfragmentRoutingheaderFragmentationheader(44)–notFirstfragmentreservedDeployNetflow

ConfiguringNetflowV1,V5

(partialcommandlist)SetupNetflowV1,V5ExportonCiscoRouterConfigureNetflowExportRouter(config)#ipflow-exportversion{1|5}{origin-as|peer-as}Router(config)#ipflow-exportdestination[NTGIPaddr][portnumber]Router(config)#ipflow-cachetimeoutactive[timeoutseconds]Router(config)#ipflow-exportsource<interface>Router(config)#ipflow-cachefeature-accelerateEnableaninterfaceforNetflowRouter(config)#interface<interfacename>Router(config-if)#iproute-cacheflowSetupNetflowV5ExportonFoundryBigIronwithVM1CardorJetCoreConfigureNetflowBigIron(config)#ipflow-exportenableBigIron(config)#ipflow-exportversion5BigIron(config)#ipflow-exportdestination[NTGIPaddr][portnumber]BigIron(config)#ipflow-exportoriginal-asEnableaninterfaceforNetflowRouter(config)#interface<interfacename>Router(config-if)#iproute-cacheflowCheckNetflowSettingRouter#showipflowexport

OPTIONALNetflowPlatformSupport

(Cisco)

*SupportforNetFlowExportv1,v5,andv8on1600and2500platformsistargetedforCiscoIOSsoftwarerelease12.0(5)T.NetFlowsupportfortheseplatformswillnotbeavailableintheCiscoIOS12.0mainlinerelease.CiscoIOS™SoftwareReleaseVersionSupportedNetFlowExportVersion(s)SupportedCiscoHardwarePlatforms11.1CA,11.1CC11.2,11.2P11.2P11.3,11.3T12.0

12.0T

12.0S12.0(3)Tandlater

12.0(3)Sandlater

12.04XEN/A

12.0(6)Sv1,v5v1v1v1v1,v5

v1,v5

v1,v5,v8

v1