Let's begin with a scenario where our manager or supervisor walks in and says,
"You know what? Can you tell me what percentage of our network traffic that is
coming from,
for example, the 10 network down here? What percentage of that network traffic
is going out to the
internet and what are the quantities? Are we using HTTPS mostly, which is very
likely,
how much DNS traffic? And also, do we have situations where clients over here
that are making requests
out to the network using weird protocols? Like, maybe protocols that are being WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
out to the network using weird protocols? Like, maybe protocols that are being
used for tunneling
or other traffic patterns that may indicate some kind of a problem or security
risk on our network.
Now, by default, it would be almost impossible to get that right because we
wouldn't really know
how much traffic is going from, you know, for example, this computer or this
computer out to the internet
or between each other. And so we're going to need some type of a tool that can
give us a bird's-eye
view of what traffic is being used. For example, what protocols are being used,
what the source
and destination addresses are, and the quantity of traffic. And fortunately, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and destination addresses are, and the quantity of traffic. And fortunately,
there is a tool that
lets us do that. And that is a tool called NetFlow. So NetFlow has been
evolving over the years.
So we start off with the basic concepts of NetFlow at the beginning. In the
early days,
with NetFlow, what we would do is we'd tell a router like this one, you know,
on this interface
and this interface and this interface and this interface, please keep track of
the traffic that's
going through it. Not making full copies of the packets, but just like making a
documentation
of what type of traffic you see, for example, the source and destination IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of what type of traffic you see, for example, the source and destination IP
addresses,
the layer for protocols, and so forth. And with NetFlow, you can enable that
router to take a
look at traffic either going into those interfaces or out of those interfaces
that's called Ingress,
going in or egress, going out, or both. And then what the router will do, it'll
create a cache
of that information. Now a cache is just temporary in memory. So periodically,
that cache is going
to time out. Let's say, for example, that the cache is five minutes. So the
router collects all
the information regarding what's going through it for five minutes regarding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the information regarding what's going through it for five minutes regarding
the traffic flows,
source, the station IP address, layer for protocols, and so forth. And then
when the cache expires,
it can go ahead and send that to a server, meaning send that cached information
to the server.
So let's imagine the server is right here. So this is our NetFlow. And the
purpose of this
NetFlow server is to go ahead and collect the cached information that the
router or in the case
of multiple routers that are sending to it regarding NetFlow. So that server in
the world of NetFlow
is called a collector, because collecting the information being sent. So R2 is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is called a collector, because collecting the information being sent. So R2 is
keeping track of
the traffic flows that are going through, sends it a periodically over the
collector, and then what
we do is you and I log into the collector, and then we can create graphs and
charts and make pretty
pictures and have information regarding what traffic flows this router has seen
going in and
or out of its interfaces. So those are the three main parts of traditional Net
Flow. We enable it on
a router, we point to a collector, then you and I log into that collector, and
we extract that
information and make pretty graphs. So for example, maybe the collector is over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information and make pretty graphs. So for example, maybe the collector is over
here at the IP address
of 5.5.5.5.5. If that's its IP address, then as far as the protocol that it's
listening on,
perhaps it's UDP port number 6783. And on most collectors, you can go ahead and
specify the port
you want to listen on. And you should be telling the router to forward over to
that destination port.
And although NetFlow in its early days was great, and it provided a lot of
useful information,
it wasn't very quote unquote flexible, because what if we need to take, for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it wasn't very quote unquote flexible, because what if we need to take, for
example, some flows
that we wanted to track through the network and send them to one server, and we
had other flows
on different interfaces that we wanted to send to get a different server. So it
wasn't very modular,
we couldn't break it down into smaller components. And that's one of the
benefits of flexible NetFlow.
Let me break it down how flexible NetFlow gives the ability to match on
virtually anything we want
to regarding IP traffic, and also collect additional information regarding
those flows that we want
to have recorded. And then we can choose which parts of that information we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to have recorded. And then we can choose which parts of that information we
want to send to which
servers. So let me clean this up. Let's chat about how flexible NetFlow allows
us to do exactly
that. So the first part of flexible NetFlow that we want to chat about is the
ability to
identify what we want to specify is a flow of data. So we can control what is a
flow of data.
For example, we can match on source IP address and destination IP address. And
let's say also,
for example, the layer for protocol is involved, whether it's TCP or UDP or GRE
or ICMP or something WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or ICMP or something
else. And so any traffic that matches the same parameters, for example, this PC
going out to a
server where the source IP address and the SH IP address and the layer for
protocol is the same,
that would be considered one flow. So if this is the only criteria that we're
looking for regarding a
flow of data, even if this computer sends hundreds or thousands of packets from
this client to the
server, that would be considered a flow. Now, in addition to identifying that
that flow is happening,
we can also collect information regarding that flow. So for example, we could
say we also want
details regarding number of packets, or we could say we want to include timest WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
details regarding number of packets, or we could say we want to include timest
amps that could then
be included without flow information. So up here, this would be what we're
matching on. And this
additional information would be information that we're collecting. In addition
to what we're
matching on information we're collecting about those flows. So I'll put here
also collect. And the
cool thing about flexible netflow is that we can create this object here that
specifies what
constitutes a flow of data and also what information we want to collect. And in
flexible netflow,
what they call this regarding what we're going to match on what information we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what they call this regarding what we're going to match on what information we
're collecting in
addition to that, they call that a record. And there are some predefined
records that we can use
with flexible netflow, or we can just create our own. So I'm going to put the
record in this blue
box here. So I'm going to put this information here in blue. And that is a
record, a flexible
netflow record. Again, just identifying what we want to match on and what
information we want
to collect. Now, a next part of the flexible netflow infrastructure is a module
that allow us to go
ahead and send that data that's being collected and cached by the router over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and send that data that's being collected and cached by the router over
to a server, a net
flow collector. So perhaps we're using netflow right here flexible netflow. And
we want to send,
for example, some of the information we collect over to, let's say, server one,
which is one of
our netflow collectors. And for a different flow of data based on a different
record,
we want to send that data over to server two, because we can have a lot of
different groups and
organizations in our company that want different information for different
reasons. For example,
maybe we want one for network monitoring for security purposes, or we want one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
maybe we want one for network monitoring for security purposes, or we want one
network monitor
for network planning, or maybe we want to do user profiling based on
identifying, you know,
which users are sending which types of traffic to which destinations, or
perhaps we're doing
billing and accounting, we're doing chargebacks to our departments for their
traffic usage.
And with flexible netflow, we can carve it out so we can get the information
that we need for
whatever purpose we need it. So the modular part of this is we can go ahead and
specify where to
send the data. So the router would cache that information for a period of time.
And then once WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then once
the cache expires, it would export that data to the collector. So we can
specify where to send
the cache data. And I'll call it cache flow information. And as part of that,
we'd include the address
information, IPA for where that server is, and also the port and protocol that
we're using to go
ahead and send it over. Because that way, if we have a server, for example,
expecting to listen on
port 673 or port 992, whatever it is, we can be very specific. And if this
server here is listening
on port 9996, and over here we're listening on port 6783, we can create WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on port 9996, and over here we're listening on port 6783, we can create
separate modules that
identify each of these servers, and then use the appropriate protocol and port
when we communicate
with those servers. Now this part here that specifies where the servers are,
the collectors are,
and what are the IP addresses and ports to reach them, those are created in an
object called an
exporter. So I'll put that right here in the same color pink. So we can modular
ly create our own
record, so identify what we want to collect. And we're also going to create our
own custom
exporters to specify exactly which servers to send that information to, and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
exporters to specify exactly which servers to send that information to, and
which ports and
protocols to use to reach them. And there's one last piece here that's going to
tie us all together,
and that is yet one more object here that's going to identify for a router
where we want to collect
that information. For example, do you want to collect it on gig 1 0 coming in
bound or traffic
that's going egress or outbound on gig 1 0? And the object that allows us to go
ahead and do that
here on a Cisco router interface is called inflexible net flow, that's called a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here on a Cisco router interface is called inflexible net flow, that's called a
monitor. So think of a
monitor as being an object we're going to apply to an interface that specifies
we don't where we
want to collect that data. For example, gig 1 0 ingress coming in or outbound
going out. So I'll
put here in black that not only the monitor is going to specify where we're
going to collect
that data from, for example, which interface and which direction, but it's also
going to include
which record that we should be paying attention to, for example, what the
matches should be and
what information to collect. So I'll go ahead down here. I'll say it includes
the record that
identifies what to collect. The monitor is also going to include the exporter, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
identifies what to collect. The monitor is also going to include the exporter,
which also tells
it where to ship that data once the cache expires on the local router. So the
monitor is also going
to include the exporter. So I color coded them here just to remind you how they
fit into the big
picture with flexible net flow. Also, please be aware that as Cisco develops
and works with new
technologies, industry standards often catch up to that after a period of time.
So now that Cisco
has flexible net flow, industry standard has thing called IPFIX, which is an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has flexible net flow, industry standard has thing called IPFIX, which is an
acronym for
Internet Protocol Flow Information Export. There's also something called Net
Flow version 10,
which takes a lot of the concepts behind Internet Protocol Flow Information
Export and also integrates
many of the features of flexible net flow from Cisco. So officially, when
flexible net flow came
out, it's called version nine. So when you see things like IPFIX and Net Flow
10, think of them
like similar implementations to flexible net flow, especially with Net Flow
version 10,
which is incorporating many of the features of flexible net flow from Cisco. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is incorporating many of the features of flexible net flow from Cisco. So
I just wanted
to be aware that those other terms exist. And when you see them, just think
that they fit under the
umbrella of the flexible net flow family.
[BLANK_AUDIO]