In the previous two videos, we created a user-defined flow record that's
matching on these three elements to identify flows and collecting this
additional information about those flows.
We also created a flow exporter called our flow exporter that's going to ship
the cached information that it collects over to 23.1.2.100, sourcing it from
our loopback zero address and using UDP port 9996 as the destination port.
That's because the server is currently set up to listen and accept that flow
record information on that port and protocol, and it's expecting to receive WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
record information on that port and protocol, and it's expecting to receive
that from our two.
So to implement the flow monitor, which is going to include the record
information on the exporter, let's go ahead and first of all, let's verify with
the show flow monitor.
Let's verify we don't yet have one.
So we don't have any customized flow monitors, so we'll go into configuration
mode and type in flow monitor and let's go ahead and name this our the ash flow
dash monitor.
And that puts us into flow monitor configuration mode.
And here let's specify the record that we want to use. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here let's specify the record that we want to use.
So eventually in the next step, we're going to apply this flow monitor to an
interface.
So as part of the flow monitor, let's specify which record we want to use,
whole type in record space, question mark.
Now we could use some of the built in predefined records or we could use our
user defined record that we just made, which is what we want to do.
So we're going to say record use our flow record, which we scroll up.
It's going to be matching on these three elements regarding what it considers a
flow and it's going to collect this additional information based on this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
flow and it's going to collect this additional information based on this
specific flow record.
So in our monitor, we're going to indicate we want to use that specific flow
record.
And then next, let's go ahead and do a question mark and let's also include
which exporter to use.
So we created if we scroll up this user defined our flow exporter right here
with our server information and the port information and so forth.
So we're also going to include that as part of this flow monitor by typing in
exporter and a question mark and we'll specify our flow exporter.
I'll go ahead and copy paste that.
So no typos there.
And now let's do a do show flow monitor and press enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now let's do a do show flow monitor and press enter.
So here's our flow monitor.
And right now it has two entries in it.
It's specifying what record we want to use and it's going to use our flow
record.
And it also specifies which export we're going to use.
Now currently says inactive and that's because we haven't applied this flow
monitor anywhere.
So we need to next apply this flow monitor to one or more interfaces so it can
begin the work of collecting the traffic.
So in our two, we have these interfaces gig one zero gig two zero F a four
slash zero and our two has also gig zero zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
slash zero and our two has also gig zero zero.
So let's apply that flow monitor to all four interfaces.
And that way any traffic that's coming in on those interfaces will be collected
.
And then when the cache times out after what are the default time out is for
the cache, it'll be shipping that information over to the collector at server
23.1.2.100.
So let's exit out of monitor configuration mode and let's go to interface.
In fact, let's do a range of interfaces.
We'll make this faster.
So here in our two, let's go ahead and this F a four slash zero interface isn't
going to be used too much because OSPF is using the primary link from our two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to be used too much because OSPF is using the primary link from our two
down to our three over the gigabit.
So let's apply the net flow monitor to gig zero zero gig one zero and gig two
zero.
And then I'll collect all our meaningful traffic here in the network.
So on our two, we'll go to interface range and we'll go to gig zero slash zero
comma gig one slash zero comma and gig two slash zero before I press center.
Let me just confirm indeed those are the interfaces.
So gig zero zero one zero two zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That looks good.
So we'll press enter there and then to apply the flow monitor to those
interfaces.
We'll simply type in IP flow monitor and then a space question mark and we'll
use the name of our flow monitor, which is showing up right here.
Fantastic. So we'll copy paste that in space, the question mark.
And then do we want to have that look at the traffic as it's coming in or ing
ress on that interface or outgoing on that interface.
And because we have it on all of our three gigabit interfaces, we really can go
ahead and just focus on input.
Now, if we are looking at ingress traffic on all the relevant interfaces, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, if we are looking at ingress traffic on all the relevant interfaces, we
don't really need to do inbound and outbound because if the routers forwarding
traffic, they'll be coming in on one of those interfaces and we'll collect it.
But you could do in and or out and let's go ahead and do input and then we'll
also just for grins.
Let's also go ahead and specify output.
Although that may be a little bit of overkill.
That's okay.
So now we do a show flow monitor and press and I fell right show flow monitor.
Here's our flow monitor.
It's using this record.
She's net exporter.
And if you'll notice that we already have some cached information showing up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if you'll notice that we already have some cached information showing up.
So let's do a show flow monitor space question mark and let's go ahead and type
in hour.
I'll just tab it out to do a show flow monitor hour flow monitor space question
mark.
And let's go ahead and take a look at the statistics first press center.
So we have some flows it shows four flows added fantastic and if you do a show
flow monitor and the name of our flow monitor space cache, it'll show us the
cached information.
So here we have traffic from 10 23 0 3 going to 224 0 0 5. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here we have traffic from 10 23 0 3 going to 224 0 0 5.
That's the destination multi cast address for OSPF and there's the protocol
number for OSPF and it has a TTL of one.
And here's the application name that it's associated with.
Although it'd be much clearer if it said it's OSPF, which is what it is.
And also there's the TOS bits because we asked it to collect that information
as part of the flows.
Here's another one from our one based on the IP address going to the multi cast
address for OSPF.
So that's the only flows that we have at the moment.
So if we go back to our Windows client PC, I think I closed it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me go ahead and open up client nug again.
So here's client nug and if we go back to a command prompt here, let's do a
couple of things.
Let's actually go to a browser.
So here is a shortcut on the taskbar of the Windows 11 client for Chrome and I
have a bookmark for the server at 23.1.2.100.
And that's using HTTP.
So if we launch that and then click on refresh a few times, that should show
traffic coming from this PC 10 10 0 50 going up to the server at 23.1.2.100.
And the protocol should be protocol number six, which is TCP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the protocol should be protocol number six, which is TCP.
So let me click on refresh a couple more times there.
And then let's go back to server one.
So at the bottom here, I've got server one.
Let's go back to R2.
And let's hit the upper key into a show flow monitor, the name of our monitor
and the keyword cache and press enter.
So there's our OSPF again.
And as we continue to scroll down now, we have some additional traffic.
So here is from 10 10 0 50 going to the server.
That's protocol 17.
That's in decimal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is UDP.
There's the type of service bits.
There's the TTL and there's the application DNS.
And if we go down further further, we have more traffic that's going up to that
server and using protocol number one.
And that is ICMP.
And if we continue to scroll down, here's the traffic that we just generated.
And that is HTTP.
And that is TCP protocol six.
And below that, we have the return traffic coming back from the server from 23.
1.2.100 going back to the client using protocol six, which is TCP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
1.2.100 going back to the client using protocol six, which is TCP.
And there's the TOS bits and there's the TTL.
And based on the source port, the server's using his showing right here as HTTP
.
So if we generate some other traffic, let's go ahead and do a ping to some
other destination.
So in our topology here, if we did a ping from our Windows client computer over
to, let's say, 3 3 3 3 that traffic is going to go from R1 over to R2 down to R
3.
So that'd be captured as far as the traffic flow here in R2.
So let's do a ping.
So ping space, let's do a dash N for us to how about 50 of those over to 3 3 3 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So ping space, let's do a dash N for us to how about 50 of those over to 3 3 3
3 and we'll let that go.
Fantastic.
So that's running.
So if we go back to our server, which is right here, server one, and we go back
to the console and hit the upper key to show flow.
The name of our flow monitor and the keyword cache and press enter and we
scroll down, we should have that ICMP traffic as well.
And there it is.
So there's the traffic going to 3 3 3 3 with protocol one, which is ICMP.
And there's the return traffic from 3 3 3 3 coming back to our client at 10 10 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there's the return traffic from 3 3 3 3 coming back to our client at 10 10
0 50.
So I also installed a demo version of Manage Engine's NetFlow Analyzer here on
server one.
So if we go to dashboard here, here it's showing that we have one device using
NetFlow version nine that's flexible NetFlow.
Here's its IP address of 2 2 2 2.
We have flows 10 and if you scroll down here to top applications, let me go
ahead and click on refresh there.
So it's configured to receive data from 2 2 2 2.
Again, it's just an eval license.
It's here temporarily.
It shows here the IP address we're receiving from is 2 2 2 2 flows 10. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It shows here the IP address we're receiving from is 2 2 2 2 flows 10.
So let's go ahead and generate a little more data and also give it a minute or
two for the cache to timeout so that our two can actually send the data over
here to this NetFlow Analyzer, which is also referred to as a collector in the
concept of NetFlow.
The device that's receiving the exported information from our router.
So here's the tab for our to let's go over to the Windows client machine.
Let's generate some more traffic. Let's go to how about 4.4.4.4.4.4.4.4.4.4.4.4 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's generate some more traffic. Let's go to how about 4.4.4.4.4.4.4.4.4.4.4.4
.5 times.
Let's go back to the browser.
I'll refresh that a few times to make sure we're setting additional traffic and
that information should show up at the CLI here.
If we do the show flow monitor, the name of our flow monitor space cache.
So that's going to show up there and it also once the cache times out, it
should also be sending that data over to the NetFlow Analyzer.
So once network information is generated be a tool similar to this that we
would use to go ahead and see the information regarding the flows of traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
would use to go ahead and see the information regarding the flows of traffic
instead of looking at the command line and also for a tool like this like a Net
Flow collector, we could create reports and search for, for example, top talkers
and top destinations and top protocols in use and so forth.
So I'm going to go ahead and close the NetFlow Analyzer. So even without a tool
like a NetFlow Analyzer or a collector that can receive this information, we
can verify that flexible NetFlow is working just by using this command right
here once it's set up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, that command is show flow monitor space and the name of your flow
monitor space and cache.
Then hit the space bar to go one page down at a time.
So now that we had the opportunity to see the creation of a flow record as well
as see the creation of a flow exporter and also see the creation and
implementation of a flow monitor, which is then applied to an interface for
your show run and paste gig one slash zero.
Now that we've seen that done in the next video, I'd like to put you on a hands
on lab so you get practice at the router in configuring those same elements. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on lab so you get practice at the router in configuring those same elements.
A flow record, a flow exporter and a flow monitor and then apply it to the
interfaces where you want to track the traffic.
So I'll see you in the next video for the hands on lab.