NetFlow to Monitor Network Traffic

NetFlow is a network protocol developed by Cisco Systems for collecting IP traffic information. NetFlow has become an industry standard for traffic monitoring and is supported on various platforms. Routers or switches that support NetFlow  can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records, towards at least one NetFlow collector.


Network Flows
 
A network flow can be defined in many ways. Cisco standard NetFlow defines a flow as a unidirectional sequence of packets that all share the following 7 values.

  1. Ingress interface (SNMP ifIndex)
  2. Source IP address
  3. Destination IP address
  4. IP protocol
  5. Source port for UDP or TCP, 0 for other protocols
  6. Destination port for UDP or TCP, type and code for ICMP, or 0 for other protocols
  7. IP Type of Service
Additional information added to a flow includes
  • Flow timestamps to understand the life of a flow; timestamps are useful for calculating packets and bytes per second
  • Next hop IP addresses including BGP routing Autonomous Systems (AS)
  • Subnet mask for the source and destination addresses to calculate prefixes
  • TCP flags to examine TCP handshakes


Configuration

Netflow configuration on Cisco routers is very simple, just enable the NetFlow on interfaces, define the version to be used and the destination i.e. IP address of the NetFlow collector. In the below image, we will configure the router to send the flows to the workstation 192.168.100.20, where NetFlow Analyzer is installed.

Router#
interface FastEthernet 0/1
 description ### INSIDE ###
 ip address 192.168.100.1 255.255.255.0
 ip flow ingress
!
ip flow-export version 9
ip flow-export destination 192.168.100.20 9996


Just this much configuration will start sending the Flows towards Netflow Analyzer. Here is the sample output for the LAN segment from the above scenario.

Apart from using the NetFlow collector, you can also use CLI to view the Flows using the command


show ip cache flow




NetFlow Top-Talkers

NetFlow top-talkers feature is also very handy to use from Command Line Interface when you want to identify users who are utilizing more WAN bandwidth. To configu-re flow-top-talkers, just add the following configuration to the above configuration on the Router.


ip flow-top-talkers
 top 20
 sort-by bytes



To verify the top-talkers on the network, use the command,

Router#sh ip flow top-talkers

SrcIf  SrcIPaddress    DstIf  DstIPaddress    Pr SrcP DstP  Bytes
Fa0/1  192.168.100.12  Fa0/0  188.4.200.109   11 9215 7CB9   267K
Fa0/1  192.168.100.12  Fa0/0  122.150.182.223 11 9215 AF16   265K
Fa0/1  192.168.100.58  Fa0/0  50.140.2.134    06 D4FD C196   225K
Fa0/1  192.168.100.49  Fa0/0  74.125.236.133  06 C766 01BB   118K
Fa0/1  192.168.100.58  Fa0/0  41.158.32.28    11 81B7 82D7   107K
Fa0/1  192.168.100.58  Fa0/0  186.216.123.119 11 81B7 C8D3    97K
Fa0/1  192.168.100.12  Fa0/0  142.161.64.110  11 9215 B0BB    67K
Fa0/1  192.168.100.58  Fa0/0  105.236.42.243  11 81B7 C350    63K
Fa0/1  192.168.100.58  Fa0/0  68.41.128.72    11 81B7 D785    52K
Fa0/1  192.168.100.12  Fa0/0  124.179.75.73   11 9215 AC98    48K
Fa0/1  192.168.100.58  Fa0/0  83.39.147.222   11 81B7 0FA0    36K
Fa0/1  192.168.100.58  Fa0/0  77.126.153.4    11 81B7 DC90    34K
Fa0/1  192.168.100.58  Local  203.122.32.30   11 81B7 81B7    34K
Fa0/1  192.168.100.62  Fa0/0  205.209.161.108 06 CC11 4E21    18K
Fa0/1  192.168.100.58  Fa0/0  50.105.92.91    06 DDAA 836F    16K
Fa0/1  192.168.100.58  Fa0/0  115.64.185.87   11 81B7 B2B3    12K
Fa0/1  192.168.100.58  Fa0/0  62.57.156.182   11 81B7 434C  8851
Fa0/1  192.168.100.57  Fa0/0  74.125.236.150  06 C5F3 01BB  6174
Fa0/1  192.168.100.48  Fa0/0  137.135.131.132 06 F5DE 0050  5567
Fa0/1  192.168.100.58  Fa0/0  46.193.164.36   11 81B7 866D  5123
20 of 20 top talkers shown. 380 flows processed.









Comments

Popular posts from this blog

Filtering Routes in BGP using Route-maps and Prefix-list

Ansible-playbook for backing up running config of Cisco IOS

Ansible-Playbook to display output of multiple show commands (using stdout_lines with Loop)

Export or Backup Azure Virtual Networks or Subnet information into CSV using PowerShell

Ansible Playbook for Network OS Upgrade with pre and post checks

Export or Backup Azure Route Table into CSV using PowerShell

Cisco ASA Active/Active Failover Configuration

VMware NSX Traffic Flow — East-West & North-South

Get Model Number and Serial number of Cisco devices using ios_facts module

Download Visio Stencils for Network Topology