NetFlow Deep Dive: NetFlow Tips and Tricks to get the Most Out of Your Network Bandwidth

NetFlow Deep Dive: Tips and Tricks to get the
Most Out of Your Network Bandwidth
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

A Few Notes about Today’s Session
» Today’s content will cover useful
NetFlow tips for Network Admins
 We’ll also show how to implement
many of the tips using NetFlow
monitoring software
» Ask questions!!!
 No attendee left behind
 Don’t wait until the end – ask
questions using the chat box and we
will do our best to cover them all
» Today’s Session is being recorded
 solarwinds.com
 slideshare.com
Don Thomas Jacob
Head Geek
SolarWinds
David Byrd
Sales Engineer
SolarWinds

What’s in Today’s Session
» SolarWinds® Overview
» Introduction to NetFlow and other Flow Technologies
» NetFlow Tips and Tricks
 Troubleshooting Network Issues
 Network Anomaly Detection
 Tracking Cloud Performance
 Monitoring BYOD Impact
 Validate Quality of Service (QoS) and Type of Service (ToS)
 Capacity Planning
» SolarWinds® Bandwidth Analyzer Pack
» Resources
» Questions?
3

SolarWinds Overview
4
Provide enterprise-class network, systems, virtualization, and
storage resource management software that is powerful,
easy-to-use, and affordable
 Rapidly Growing & Highly Profitable IT Management Company
» We sell to businesses of all sizes from SMB to Large Enterprise
» Over 100,000 customers in 170 countries
» More than 450 of the Fortune 500 are customers
» More than one million registered end-users have downloaded our free tools
» Founded in 1999 to deliver IT management software that works for you – and
that delivers on our promise of "unexpected simplicity."

5
Introduction to Flow Technologies

Introduction to NetFlow and other Flow
Technologies
» NetFlow – Developed by Cisco® as a switching path and now
the primary traffic accounting technology
» Answers questions of WHO, WHAT, WHEN and WHERE of
bandwidth monitoring and traffic analytics
» All major routing and switching vendors supports NetFlow or
similar Flow options
6

Technologies
7
NetFlow Enabled
Network Device
Traffic Traffic
NetFlow Collector

Technologies
8
Supported on most enterprise class
devices including Layer 2 switches

» Flexible NetFlow – Leverages NetFlow v9
» Customizable key and non-key fields : Allows users to decide
what is exported
» Configuration involves creating
Cisco® Flexible NetFlow
9
Flow RecordFlow Exporter Flow Monitor

10
Flow Exporter Flow Record Flow Monitor
destination 192.168.16.1
source loopback0
transport udp 2055
export-protocol netflow-v9
output-features
Pre-Defined Flow Records
netflow-original
netflow ipv4 original-input
Custom Flow Record
Customized using
match or collect statements
Flow Exporter
+
Flow Record
Apply Flow Monitor on Interface
interface serial 2/1
ip flow monitor monitor_name input

Other Flow Technologies
11
11
Flow Format About
IPFIX™
IETF standard for flow export. Customizable and template based like NetFlow.
Available on: Barracuda Networks®, Extreme® switches, Sonicwall®, etc.
sFlow®
Sampling based - 1 in N “packets” captured for traffic analytics.
Supported by most vendors: Alcatel®, Brocade® – Foundry®, Dell® - Force 10™,
Enterasys®, ExtremeXOS®, Fortinet®, HP® ProCurve®, Juniper®, Vyatta®, etc.
http://www.sflow.org/products
J-Flow
Proprietary protocol from Juniper®for flow export from Juniper® routers,
switches and firewalls
NetStream™ A variation of NetFlow supported on Huawei / 3COM devices

Tips and Tricks
12

» Network uptime is “critical” to revenue
» NetFlow identifies
 Source and Destination Interface
 Source and Destination IP Addresses
 Source and Destination Port Addresses
 Protocol
 Type of Service and DSCP
» Helps in quicker troubleshooting of issues such as application
slowness or performance degradation
Troubleshooting Network Issues
13

Troubleshooting Network Issues
14
Source IP Address
Destination IP Address
Input and Output Interface
Source and Destination Port
Protocol
Flow Start and End time
Packet and Octet count
ToS
TCP Flags
Protocol
Source AS Information
Destination AS Information
Identify source and destination hosts involved in a
traffic flow and its route in the network
What application is using the bandwidth
Using historical data for analysis? See when the
incident occurred and traffic volume
Priority of applications in the network; Status of a TCP
conversation; Protocol distribution
Route of the traffic flow; Using expensive AS during
peering?

» Signature based anomaly detection fails with zero-day
malware
» Firewalls work based on rules defined by user. Non-signature
IDS / IPS are very expensive
» Security issues with emerging trends like telecommuting and
BYOD. Malwares directly reach LAN via an infected BYOD
Network Anomaly Detection
15
Signature Anomaly Blocked
M A AL W R E
R E WA L A M
Non-Signature Anomaly
Passes Undetected
IDS

Network Anomaly Detection
» Your network could be hosting a bot. Firewalls and IDS / IPS track
only inbound traffic
» Analyze changes in traffic patterns and unexpected traffic behavior
to detect anomalous traffic including zero-day malware
» High SMTP traffic; Short burst of packets; One host to many on
same port; Traffic on unknown ports; Too many TCP SYN flags;
» NetFlow based traffic analytics helps with network behavior
anomaly detection
16

Tracking Cloud Performance
» The biggest impact of the cloud is on the bandwidth
» SaaS based approach means ensuring bandwidth is always
available for business apps
» It’s necessary to look out for bottlenecks, bandwidth hogs,
unauthorized protocol usage and application priority
» NetFlow data carries information on cause of traffic
bottlenecks, end points using bandwidth, applications being
used and conversation priority
17

Monitoring BYOD Impact
» BYOD is inevitable. Enterprises are either adopting BYOD or
employees are already using them
» BYOD adds more traffic to your network – What is the impact
on bandwidth?
» Are unauthorized applications being used or is BYOD
competing with business applications?
» NetFlow breaks down on application usage and source of
traffic along with DSCP information
18

Validate Quality of Service (QoS) and Type of
Service (ToS)
» Bandwidth is finite. Applications compete with one another for
bandwidth when traversing the WAN
» Ensure back ups and scavenger traffic do not have higher priority
over your critical applications
» NetFlow data reports on ToS and DSCP fields from traffic
conversations. Validate your QoS is working as expected
19
FTP
VoIP
Peer to Peer
Web
Internet Link
Web
AF31
FTP AF11

Capacity Planning
» Increasing organizational strength or new applications need
bandwidth. Throwing more bandwidth is not the first step
» Is bandwidth growth along expected lines or misused. How has
application usage changed over time?
» Top application and conversations based NetFlow data can be
stored for reference unlike pcap which requires extensive storage
» Use NetFlow for bandwidth and application growth reports
20

Bandwidth Analyzer Pack
21
» Detect, diagnose, and resolve
network performance issues
» Track response time,
availability, and uptime of
routers, switches, and other
SNMP-enabled devices
» Monitor and analyze network
bandwidth performance and
traffic patterns
» Identify bandwidth hogs and
see which applications are
using the most bandwidth
» Graphically display
performance metrics in real
time via dynamic interactive
maps

22
Bandwidth Analyzer Pack Demo

Resources
» Download a free fully functional 30-day trial at
http://www.solarwinds.com/lp/network-bandwidth-analyzer-
pack.aspx
» Videos
 Network Performance Monitor Overview
 NetFlow Traffic Analyzer Overview
 How to Configure NetFlow on Cisco Routers
» Blogs
 NETFLOW V9 DATAGRAM KNOWLEDGE SERIES - NETFLOW OVERVIEW
23

Summary and Q & A
» To learn more visit:
http://www.solarwinds.com/lp/network-bandwidth-analyzer-
pack.aspx
» Join our community of 150,000+ IT pros at www.thwack.com
» Follow us on Twitter®
 @headgeeks
Thank you for attending!
24

Thank You!
The SOLARWINDS and SOLARWINDS & Design marks are the exclusive property of SolarWinds
Worldwide, LLC, are registered with the U.S. Patent and Trademark Office, and may be
registered or pending registration in other countries. All other SolarWinds trademarks, service
marks, and logos may be common law marks, registered or pending registration in the United
States or in other countries. All other trademarks mentioned herein are used for identification
purposes only and may be or are trademarks or registered trademarks of their respective
companies.

NetFlow Deep Dive: NetFlow Tips and Tricks to get the Most Out of Your Network Bandwidth

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à NetFlow Deep Dive: NetFlow Tips and Tricks to get the Most Out of Your Network Bandwidth

Similaire à NetFlow Deep Dive: NetFlow Tips and Tricks to get the Most Out of Your Network Bandwidth (20)

Plus de SolarWinds

Plus de SolarWinds (20)

Dernier

Dernier (20)

NetFlow Deep Dive: NetFlow Tips and Tricks to get the Most Out of Your Network Bandwidth

Notes de l'éditeur