There's Plenty of Room at the Bottom
Upcoming SlideShare
Loading in...5
×
 

There's Plenty of Room at the Bottom

on

  • 4,120 views

A an overview of network flow collection and an invitation to look at the fast_ip network flow platform.

A an overview of network flow collection and an invitation to look at the fast_ip network flow platform.

Statistics

Views

Total Views
4,120
Views on SlideShare
4,120
Embed Views
0

Actions

Likes
5
Downloads
31
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Apple Keynote

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />
  • <br />

There's Plenty of Room at the Bottom There's Plenty of Room at the Bottom Presentation Transcript

  • There’s Plenty of Room at the Bottom: An Invitation to Explore with Network Flows Benjamin Black b@fastip.com
  • What are Flows & Why Should You Care?
  • You Should Care Because Visibility Makes Your Life Easier.
  • Network Flow Data Means Great Visibility.
  • DDoS Detection Capacity Planning Traffic Management Troubleshooting Correlation ...
  • The Nature of Flows
  • [traffic]
  • [streams]
  • [packets] Header Payload
  • [headers] Protocol Source IP Address Destination IP Address Source Port Destination Port
  • [latency]
  • [jitter]
  • [packet loss]
  • The Structure of Flows
  • [flow keys] Protocol Protocol Source IP Address Source IP Address Destination IP Address Source Port = Destination IP Address Source Port Destination Port Destination Port
  • [templates] template_id 253 protocol src IPv4 address dest IPv4 address src port dst port total octets total packets start time end time
  • [flow records] template_id 253 TCP 172.16.101.3 192.169.7.200 9801 80 27342 octets 24 packets start 28349829023 end 28356729023
  • The Ecosystem of Flows
  • [metering process] template_id 253 template_id 253 template_id 253 template_id 253 TCP TCP TCP TCP 172.16.101.3 172.16.101.3 172.16.101.3 172.16.101.3 192.169.7.200 192.169.7.200 192.169.7.200 192.169.7.200 9801 9801 9801 9801 80 80 80 80 27342 octets 27342 octets 27342 octets 27342 octets 24 packets 24 packets 24 packets 24 packets start 28349829023 start 28349829023 start 28349829023 start 28349829023 end 28356729023 end 28356729023 end 28356729023 end 28356729023
  • [observation domain] eth0 eth1 eth2
  • [collecting process] template_id 253 template_id 253 template_id 253 template_id 253 TCP TCP TCP TCP 172.16.101.3 172.16.101.3 172.16.101.3 172.16.101.3 192.169.7.200 192.169.7.200 192.169.7.200 192.169.7.200 9801 9801 9801 9801 80 80 80 80 27342 octets 27342 octets 27342 octets 27342 octets 24 packets 24 packets 24 packets 24 packets start 28349829023 start 28349829023 start 28349829023 start 28349829023 end 28356729023 end 28356729023 end 28356729023 end 28356729023 template_id 253 template_id 253 template_id 253 template_id 253 TCP TCP TCP TCP 172.16.101.3 172.16.101.3 172.16.101.3 172.16.101.3 192.169.7.200 192.169.7.200 192.169.7.200 192.169.7.200 9801 9801 9801 9801 80 80 80 80 27342 octets 27342 octets 27342 octets 27342 octets 24 packets 24 packets 24 packets 24 packets start 28349829023 start 28349829023 start 28349829023 start 28349829023 end 28356729023 end 28356729023 end 28356729023 end 28356729023 template_id 253 template_id 253 template_id 253 template_id 253 TCP TCP TCP TCP 172.16.101.3 172.16.101.3 172.16.101.3 172.16.101.3 192.169.7.200 192.169.7.200 192.169.7.200 192.169.7.200 9801 9801 9801 9801 80 80 80 80 27342 octets 27342 octets 27342 octets 27342 octets 24 packets 24 packets 24 packets 24 packets start 28349829023 start 28349829023 start 28349829023 start 28349829023 end 28356729023 end 28356729023 end 28356729023 end 28356729023
  • Storage and Analysis are Left as an Exercise for the Reader
  • Where Do Meters Run?
  • On Network Switches/Routers [often sampled]
  • Dedicated Appliances [expensive/limited storage]
  • On Hosts [where does the data go?]
  • The Classical View
  • Where is this going?
  • Where is this going? Where is this coming from?
  • The Flow View
  • TANSTAAFL
  • Flow Data Takes Up LOTS of Space
  • [often >1% total traffic]
  • LOTS of Space Means Storage Expense or Loss of Resolution or Truncation
  • LOTS of (Multi-dimensional) Data is Hard to Analyze
  • Inflexible and Limited or Expensive and Complicated
  • [apologies]
  • [resources] IPFIX WG http://datatracker.ietf.org/wg/ipfix/charter/ nProbe http://www.ntop.org/nProbe.html Cisco NetFlow Collection Engine http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/index.html Arbor Networks http://www.arbornetworks.com/ Dartware http://www.intermapper.com/products/intermapper-flows
  • [finally...]
  • fast_ip is a platform for flow analytics
  • Sign up for our beta http://fastip.com