Experiences in Analyzing Network Traffic Shou-Chuan Lai National Tsing Hua University Computer and Communication Center Nov. 20, 2003

Houston, we have a problem!

What happened?

What can we do?

5 Problem Diagnose Call for help Call our contracted support Ask an expert Do it yourself Cable tester Network analyzer Network Management System

6 Possible Solution Replace malfunction parts Adjust network configurations Expand network capacity

Network Traffic Analysis

8 Network Traffic Information Link Host Service port Application User behavior

9 Analyze Tools Device built-in functions LED status LCD messages MRTG SNMP + MIB-II NetFlow Cisco Routers w/ NetFlow export function Switch w/ mirror/SPAN + NetFlow generator

SNMP + MIB-II

11 SNMP + MIB-II Simple Network Management Protocol RFC 1157 Management Information Base RFC 1213

12 MANAGER AGENTS SNMP AGENTS SNMP MIB Simple Network Management Protocol Architecture

13 SNMP Manager SNMP Agent UDP port 161 GetRequest GetNextRequest SetRequest GetResponse TrapUDP port 162 SNMP Operations

14 MIB Object Names itu(2) root iso(1) org(3) dod(6) internet(1) directory(1)mgmt(2)experiment(3)private(4) enterprise(1)mib(1) system(1)interface(2)at(3)ip(4)icmp(5)tcp(6)udp(7)

15 MIB-II Common Operational Statistics (RFC 1857) ifInUcastPkts (unicast packets in) ifOutUcastPkts (unicast packets out) ifInNUcastPkts (non-unicast packets in) ifOutNUcastPkts (non-unicast packets out) ifInOctets (octets in) ifOutOctets (octets out)

MRTG

17 MRTG (Multi Router Traffic Grapher) A tool to monitor the traffic load on network-links. Generates HTML pages containing graphical images which provide a LIVE visual representation of this traffic. Based on Perl and C and works under UNIX and Windows NT.

18 MRTG (I) – An Example Packet per Second Byte per Second

19 MRTG (II) – A Suspicious Case Excess Outgoing Packets

20 MRTG (III) – Other Applications Mail Server Queue Length Router CPU Utilization

21 MRTG Track Back Deploy MRTG on each switch w/ SNMP support In case of abnormal traffic behavior, with each link information, we may be able to trace back to the switch port which nearest the problem node. With SNMP SET, we may disable that port as a temporal solution.

NetFlow

23 Why NetFlow ? NetFlow statistics empowers users with the ability to characterize their IP data flows The who, what, where, when, and how much IP traffic questions are answered Offers a rich data set to be mined for network management, traffic engineering, and value-added service offerings (i.e. marketing data, personal NMS data)

24 What is a Flow? Defined by 7 unique keys Source IP address Destination IP address Source port Destination port Layer 3 protocol type TOS byte (DSCP) Input logical interface (ifIndex)

25 Source IP Address Destination IP Address Input ifIndex Output ifIndex Type of Service TCP Flags Protocol Start sysUpTime End sysUpTime Source TCP/UDP Port Destination TCP/UDP Port Next Hop Address Source AS Number Dest. AS Number Source Prefix Mask Dest. Prefix Mask Source IP Address Destination IP Address From/To Application Routing and Peering Usage Time of Day Port Utilization Quality of Service Packet Count Byte Count NetFlow Version 5 Format

26 NetFlow Collection Campus Network Department Network Internet NetFlow Collector NetFlow

27 NetFlow Example I DateIn (GB)Out (GB) Mon Nov Sun Nov Sat Nov Fri Nov Thu Nov Wed Nov Tue Nov

28 NetFlow Example II Out-going Traffic (SRC IP) NoFQDNIP Address Octets (MB) %Note AB Dept Dept AB AB

29 NetFlow Example III Destination Hosts: 100 NoFQDNIP Address Octets (KB) % Packets (K) Packet Size Note

30 NetFlow Example IV SRC PORT: TCP#=1849 UDP#=1 NoProt.Port#Con# Octets (KB) %Packets Packet Size Note 1TCP TCP UDP TCP TCP

31 Internet Worm Problem Network Security Responding System NetFlow Analyzer Blocking System Notifying System Manual Control Web Pages Internet IP NetFlow

32 Open Mail Relay Problem NetFlow Analyzer Blocking System Notifying System IP:Port NetFlow IP Open Relay Analyzer

Feature Works

34 The Issues Octets vs. Contents Service port vs. Application Quantity vs. Quality Network Security Personal Privacy

35 Reference University of Twente, Netherlands, “SimpleWeb,” Tobias Oetiker, Dave Rand, “MRTG,” Tobi Oetiker, “RRDtool,” Cisco Systems, Inc., “Cisco IOS NetFlow,” Mark Fullmer, “flow-tools,” ntop.org, “ntop,” Slava Astashonok, “fprobe,”

Thank You! Q & A