If someone gave us a gift and we just
put it in a closet somewhere and didn't ever look at it
or use it, that's not too effective of a gift.
Well, in the world of NetFlow, as we are collecting that flow
information from our network, think of it like a gift.
And it's sitting there on the collector.
We need to take a look at it and make
sure we can use it for provisioning our network,
or for looking for problems in the network, or for security.
So in this video I'd like to share
with you a glimpse at an option for looking at that data.
And that's through a network analyzer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's through a network analyzer
for NetFlow information from Cisco called Stealthwatch.
So here's the router that we left off in the previous video.
And currently in this exporter it has destination
172.20.30.201, which is in a VRF named Internal.
So it's shipping all this NetFlow information
to that device.
Now, that is a collector.
Let me show you what that looks like.
So this is the flow collector for NetFlow Virtual Edition.
It's a Cisco product.
And all the devices on the network,
including the router we just looked at,
have been configured in their X borders WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have been configured in their X borders
to target this specific device on the ports
we specified using the Export protocol of IPFIX,
and sending those messages over to this device
where it's collecting them.
Now, in the Cisco world, this device
here is mainly a collector, just taking all the data.
And then we need some kind of an analyzer to analyze that data.
And to do that, we could use a tool like Stealthwatch, which
is a NetFlow analyzer with an angle towards security to help
make sure there's nothing mischievous going on
on our networks.
So over here on the left on this dashboard, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So over here on the left on this dashboard,
I've got some Top Alarming Hosts, and then
Alarms by Type, and Today's Alarms,
lots of cool stuff going on.
But the key here is, with a NetFlow analyzer,
is that we have all this data.
We're getting flows in our network.
And NetFlow Analyzer gives us the ability
to make sense of that data.
So if we went to, for example, Analyze and to Flow Search,
if we were looking, if we had some device that
was compromised, we could do a flow search
and search just for the data about that flow--
its IP address or the type of protocol--
and drill down in to find more about what happened WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and drill down in to find more about what happened
and what went on regarding attack
or compromise that occurred.
So for this one, I'm just going to go ahead and just do
the last five minutes and click on Search.
So this is going to show us the search results of the NetFlow
information that was sent to the collector over the last five
minutes.
And so if we scroll down, we have GRE traffic,
a bunch of TCP traffic.
It's got ESP, which is IPsec, and a whole bunch
of other ports and protocols.
We could find out what's going on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could find out what's going on.
Or if we just want to get a summary,
we can click on Summary.
And then on the left hand side here, it has locations--
Belgium, United States, China, France, Russian Federation.
The reason I'm chuckling is because this is a live network.
So it would probably serve us to, based on this NetFlow
information, to say, whoa, why are we
going to all those locations?
Or is that real traffic that's happening?
And if it is, we would want to investigate that
further and make sure we're not being compromised. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
further and make sure we're not being compromised.
So, again, the key with NetFlow is
that we want to collect the data, export it to a collector,
and then analyze it with some type of a network analysis
software, also called a NetFlow analyzer,
so we can find out what's going on on our network
and use it for troubleshooting-- or use it
for planning for the future or use it for security.
So thanks for joining me in these videos
regarding NetFlow in a Cisco environment.
And I'll see you in the next set of videos.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.