1. Project Requirements (NetFlow Generator) 2003. 11. 05. 정승화 분산 처리 및 네트워크 관리 연구실 포항 공과 대학교 mannam@postech.ac.kr

2. POSTECH DP&NM Lab. 2/13 Contents Introduction & Goal Glossary Requirements –System Requirements –Function Requirements –Non-Function Requirements Testing

3. POSTECH DP&NM Lab. 3/13 Introduction Monitoring Network –Packets –Flows Flows –CISCO Router NetFlow –InMon sFlow Goal –Free (or Cheap) –NetFlow

4. POSTECH DP&NM Lab. 4/13 Glossary NetFlow V.5 Header Flow Record Flow Record Flow Record Flow Record Flow Record UDP message format transmitted from traffic meter NetFlow VersionFlow Record Count (1-30) SysUptime of the export device booted Current count of seconds since 0000 UTC 1970 Residual nanoseconds since 0000 UTC 1970 Sequence counter of total flows seen engine_typeengine_idUnused (zero) Format of NetFlow V.5 Header 0 8 16 24 31

5. POSTECH DP&NM Lab. 5/13 Glossary Source IP address Destination IP address IP address of next hop router Input InterfaceOutput Interface Packets in the flow Bytes in the packets of the flow SysUptime at start of flow SysUptime at the last packet of the flow was received Source PortDestination Port Unused (zero)TCP flagIP protocol typeToS Source ASDestination AS Src. MaskDst. MaskUnused (zero) 0 8 16 24 31

6. POSTECH DP&NM Lab. 6/13 Requirements System Requirements –Linux –Libpcap Package –Libxml2 Package –C Compiler Functional Requirements –NetFlow Generation –Sampling –Interface Monitoring –NetFlow Exporting –Configuration Reading Non-Functional Requirements –Portability –Easy to install & use

7. POSTECH DP&NM Lab. 7/13 Functional Requirements: NetFlow Generation Source IP Address Destination IP Address Source IP Address Destination IP Address Next Hop AddressNext Hop Address Source AS NumberSource AS Number Dest. AS NumberDest. AS Number Source Prefix MaskSource Prefix Mask Dest. Prefix MaskDest. Prefix Mask Next Hop AddressNext Hop Address Source AS NumberSource AS Number Dest. AS NumberDest. AS Number Source Prefix MaskSource Prefix Mask Dest. Prefix MaskDest. Prefix Mask Input Interface Output Interface Input Interface Output Interface Type of Service TCP Flags Protocol Type Type of Service TCP Flags Protocol Type Packet Count Byte Count Packet Count Byte Count Start Timestamp End Timestamp Start Timestamp End Timestamp Source TCP/UDP Port Destination TCP/UDP Port Source TCP/UDP Port Destination TCP/UDP Port Usage QoS Application These are not going to be Implemented To show which Interface captured flows From/To Time Stamp

8. POSTECH DP&NM Lab. 8/13 NetFlow V.5 Generator Functional Requirements: Sampling In case of high speed network Sampling can be the solution of the performance problem.

9. POSTECH DP&NM Lab. 9/13 Functional Requirements: Interface Monitoring Router Interfaces In/Out

10. POSTECH DP&NM Lab. 10/13 in Memory Functional Requirements: NetFlow Exporting (1/2) Exporting NetFlows Every T Second. T = Time interval ( 설정 가능 ) NetFlow V.5 Generator T

11. POSTECH DP&NM Lab. 11/13 Functional Requirements: NetFlow Exporting (2/2) Exporting NetFlows Every Second by searching all Flows T = Time interval ( 설정 가능 ) NetFlow V.5 Generator Inactive T Active T

12. POSTECH DP&NM Lab. 12/13 Functional Requirements: Configuration Reading Flow Generator gets below configure Info. when it starts. Capturing Interface Exporting Time Interval Analyzer IP Analyzer Port Sampling Rate Interface Name, MAC are required for each Interface. This exporting time interval unit is a second unit at least. Export Module will send NetFlow Info. to this IP address & Port

13. POSTECH DP&NM Lab. 13/13 Non-Functional Requirements Portability Easy to install & use

14. POSTECH DP&NM Lab. 14/13 Testing CISCO developed a tool named fdget for viewing the data exported from a NetFlow router. –We use fdget program to check NetFlow is correctly generated and exported. Traffic Meter fdget program Testing NetFlow Receiving Server Testing NetFlow Generator