untitled

Size: px

Start display at page:

Download "untitled"

みさえわにべ
6 years ago
Views:

2 SNMP IfInUcastPkts, IfOutUcastPkts IfInOctets, IfOutOctets INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 3 SNMP End to End INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 4 2

3 End to End AS INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 5 NetFlow Cisco Cisco, Juniper, AlaxalA, etc. sflow InMon Foundry, Extreme, AlaxalA, Force10, HP, etc. IPFIX IETF NetFlow V9 INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 6 3

4 QoS INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 7 NetFlow NetFlow Src / Dst IP Src /Dst ToS NetFlow Src IF Src IP Dst IF Dst IP Proto Bytes Active Idle 10 a.a.a.a 24 x.x.x.x b.b.b.b 24 y.y.y.y c.c.c.c 3 z.z.z.z INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 8 4

5 Inactive Timer default = 15 Active Timer default = 30 TCP FIN or RST INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 9 NetFlow BGP AS Catalyst Switch IPFIX INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 10 5

6 NetFlow V5 PDU Version SysUptime unix-_secs unix-_nsecs ID <1> <n> INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 11 NetFlow V IP IP nexthop sysuptime sysuptime first TCP AS ToS AS INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 12 6

7 NetFlow V9 RFC 3954 Informational IPFIX IPFIX INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 13 NetFlow Cisco V5, V8, V9 Cisco :1 7 15% CPU INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 14 7

8 sflow NetFlow Cisco?? RFC 3176 [sflow V4] Informational INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 15 sflow NetFlow / 1 sflow PDU sflow I/F NextHop AS I/F Etc. INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 16 8

9 sflowvs NetFlow V5 IPv6 IP IPX AppleTalk BGP BGP Next Hop Community AS PATH Local Preference Agent INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 17 Flow BGP community RFC 3176 CPU/BGP nexthop MPLS NAT Vendor-specific INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 18 9

10 IPFIX IP Flow Information export draft-ietf-ipfix-architecture-12.txt draft-ietf-ipfix-protocol-23.txt draft-ietf-ipfix-info-14.txt 49 th IETF Dec. 2000, (rtfm2 realtime traffic flow measurement 2 BOF) 51 st IETF August 2001 (ipfx BOF) sflow, NetFlow, LFAP, etc. WG PSAMP Packet Sampling WG 54 th IETF July 2002 INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 19 IPFIX Metering Process 1 Observation Point 1 Metering Process 1 Metering Process n Observation Point m Metering Process n Observation Domain 1 Exporting Process IP Collector Collector Observation Point 1 Observation Point m Observation Domain K IPFIX INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

11 TLV INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 21 Template Flowset & Data Flowset Data Flowset Template Flowset FlowSet ID = 256 Length = 60 FlowSet ID = 0 Length = 28 bytes Template ID = 256 Field Count = 5 IPv4_SRCADDR Length = 4 IPv4_DSTADDR Length = 4 IPv4_NEXT_HOP Length = 4 IN_PKTS Length = 8 IN_BYTES Length = Rec#1 Rec#2 16bits 32bits INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

12 IPFIX NetFlow V SCTP/PR-SCTP UDP TCP IE Template Withdraw Message IPsec or TLS INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 23 CPU INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

13 Systematic Sampling Count-based N N N Time-based Random Sampling n-out-of-n N N N Uniform or Non-Uniform Probabilistic INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved ,000 INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

14 AdventNet NetFlow Analyzer (N) ARBOR Networks peakflow (N, S) Foundry Networks IronView (S) GenieNRM GenieATM (N, S) InMon InMon Traffic Sentinel (S, N) INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 27 CAIDA cflowd (N) flow-tools & FlowScan(N) InMon sflowtools (S), sflowtrend (S) NFDUMP & NfSen (N) ntop ntop(n, S, I) Many More!!! INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

flow-tools flow-{capture, cat, dscan, expire, export, fanout, filter, gen, header, import, log2rrd, mask, merge, nfilter, print, receive, report, rpt2rrd, rptfmt, send, split, stat, tag, xlate}

15 flow-tools flow-{capture, cat, dscan, expire, export, fanout, filter, gen, header, import, log2rrd, mask, merge, nfilter, print, receive, report, rpt2rrd, rptfmt, send, split, stat, tag, xlate} NetFlow V1, V5, (V6), V7, V8 INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 29 FlowScan cflowd / flow-tools / argus / lfapd (collector) + RRD (D/B) + RDDTools (visualization) Platform : UNIX INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

GenieATM 6000 NetFlow V1, V5, V7, V9 sflow V4, V5 NetStream

html INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront

31 ARBOR peakflow NetFlow V5, V7, V9 sflow V2, V4, V5 http://www.

16 GenieATM 6000 NetFlow V1, V5, V7, V9 sflow V4, V5 NetStream INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 31 ARBOR peakflow NetFlow V5, V7, V9 sflow V2, V4, V5 INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

InMon Traffic Sentinel sflow NetFlow V1, V5, V7, V9 http://www.msol.co.jp/it/inmon/i-tokucho.html INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved.

17 InMon Traffic Sentinel sflow NetFlow V1, V5, V7, V9 INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved. 33 NetFlow s_ios_protocol_group_home.html NetFlow V9 RFC jp.html Flow IPFIX INTERNET WEEK 2006/12/08 Copyright 2006 Fivefront Corporation, All Rights Reserved

untitled

untitled Section 1 5 6 MRTG 7 Prefix RMON NetFlow NetFlow NetFlow Data Collector DB Subnet B B Router = Exporter Subnet A AS IP Prefix 1 8 Subnet B Router = Exporter AS AS Prefix 2 NetFlow Version 5 AS AS Peer