| 1 | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
|---|
| 2 | <html xmlns="http://www.w3.org/1999/xhtml"> |
|---|
| 3 | <head> |
|---|
| 4 | <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> |
|---|
| 5 | <meta http-equiv="Content-Style-Type" content="text/css" /> |
|---|
| 6 | <meta name="generator" content="pandoc" /> |
|---|
| 7 | <title>Using NfSen to identify top talkers</title> |
|---|
| 8 | <style type="text/css">code{white-space: pre;}</style> |
|---|
| 9 | <link rel="stylesheet" href="handout.css" type="text/css" /> |
|---|
| 10 | </head> |
|---|
| 11 | <body> |
|---|
| 12 | <div id="header"> |
|---|
| 13 | <h1 class="title">Using NfSen to identify top talkers</h1> |
|---|
| 14 | <h3 class="date">Network Monitoring and Management</h3> |
|---|
| 15 | </div> |
|---|
| 16 | <div id="TOC"> |
|---|
| 17 | <ul> |
|---|
| 18 | <li><a href="#introduction"><span class="toc-section-number">1</span> Introduction</a><ul> |
|---|
| 19 | <li><a href="#goals"><span class="toc-section-number">1.1</span> Goals</a></li> |
|---|
| 20 | <li><a href="#assumptions"><span class="toc-section-number">1.2</span> Assumptions</a></li> |
|---|
| 21 | </ul></li> |
|---|
| 22 | <li><a href="#generate-some-traffic"><span class="toc-section-number">2</span> Generate some traffic</a></li> |
|---|
| 23 | <li><a href="#exploring-flow-records"><span class="toc-section-number">3</span> Exploring flow records</a><ul> |
|---|
| 24 | <li><a href="#navigate-to-detail-page"><span class="toc-section-number">3.1</span> Navigate to Detail page</a></li> |
|---|
| 25 | <li><a href="#select-time-window"><span class="toc-section-number">3.2</span> Select time window</a></li> |
|---|
| 26 | <li><a href="#list-individual-flows"><span class="toc-section-number">3.3</span> List individual flows</a></li> |
|---|
| 27 | <li><a href="#flows-tofrom-one-host"><span class="toc-section-number">3.4</span> Flows to/from one host</a></li> |
|---|
| 28 | </ul></li> |
|---|
| 29 | <li><a href="#largest-flows"><span class="toc-section-number">4</span> Largest flows</a></li> |
|---|
| 30 | <li><a href="#inbound-traffic-grouped-by-receiver-ip-address"><span class="toc-section-number">5</span> Inbound traffic grouped by receiver IP address</a><ul> |
|---|
| 31 | <li><a href="#outbound-traffic-grouped-by-sender-ip-address"><span class="toc-section-number">5.1</span> Outbound traffic grouped by sender IP address</a></li> |
|---|
| 32 | </ul></li> |
|---|
| 33 | <li><a href="#analysing-traffic-to-a-single-host"><span class="toc-section-number">6</span> Analysing traffic to a single host</a><ul> |
|---|
| 34 | <li><a href="#ip-address-information"><span class="toc-section-number">6.1</span> IP address information</a></li> |
|---|
| 35 | </ul></li> |
|---|
| 36 | <li><a href="#additional-exercise-aggregating-flows"><span class="toc-section-number">7</span> Additional exercise: aggregating flows</a></li> |
|---|
| 37 | </ul> |
|---|
| 38 | </div> |
|---|
| 39 | <h1 id="introduction"><a href="#introduction"><span class="header-section-number">1</span> Introduction</a></h1> |
|---|
| 40 | <h2 id="goals"><a href="#goals"><span class="header-section-number">1.1</span> Goals</a></h2> |
|---|
| 41 | <ul> |
|---|
| 42 | <li>Use NfSen to find out which hosts are generating the most inbound and outbound traffic on your network</li> |
|---|
| 43 | </ul> |
|---|
| 44 | <h2 id="assumptions"><a href="#assumptions"><span class="header-section-number">1.2</span> Assumptions</a></h2> |
|---|
| 45 | <p>Your router is sending netflow records to one of your PCs, and that PC is running nfsen to collect this data. If you are working in a pair, then you should both point your web browser to whichever PC is receiving the flows:</p> |
|---|
| 46 | <p><a href="http://pcX.ws.nsrc.org/nfsen/nfsen.php">http://pcX.ws.nsrc.org/nfsen/nfsen.php</a></p> |
|---|
| 47 | <h1 id="generate-some-traffic"><a href="#generate-some-traffic"><span class="header-section-number">2</span> Generate some traffic</a></h1> |
|---|
| 48 | <p>Firstly, we need to generate some traffic passing through your router. On either of your PCs (it doesn't have to be the one running nfsen), login and type the following commands:</p> |
|---|
| 49 | <pre><code>$ cd /tmp |
|---|
| 50 | $ wget http://noc.ws.nsrc.org/downloads/BigFile |
|---|
| 51 | $ rm BigFile</code></pre> |
|---|
| 52 | <p>It will take around 5 minutes before this shows as a spike in nfsen.</p> |
|---|
| 53 | <h1 id="exploring-flow-records"><a href="#exploring-flow-records"><span class="header-section-number">3</span> Exploring flow records</a></h1> |
|---|
| 54 | <p>Now let's use Netflow to explore the traffic flows in the network, with the aim of finding out who was been downloading the most data. Look carefully at the output generated at each step - ask an instructor to explain if you don't understand what you see.</p> |
|---|
| 55 | <h2 id="navigate-to-detail-page"><a href="#navigate-to-detail-page"><span class="header-section-number">3.1</span> Navigate to Detail page</a></h2> |
|---|
| 56 | <p>The nfsen home page shows a matrix of graphs: flows per second on the left, packets per second in the middle, bits per second on the right. Click on the top-right graph (bits per second, one day view) to get to the Detail page.</p> |
|---|
| 57 | <h2 id="select-time-window"><a href="#select-time-window"><span class="header-section-number">3.2</span> Select time window</a></h2> |
|---|
| 58 | <p>Change from "Single Timeslot" to "Time Window":</p> |
|---|
| 59 | <p><img src="images/nf-time-window.png" alt="Selecting time window" /><br /> Once you have done this, the vertical line in the graph window can be split. Pull the left half to the left and the right half to the right, to select the time period of interest. Then you should see some summary statistics for the time period you have selected:</p> |
|---|
| 60 | <div class="figure"> |
|---|
| 61 | <img src="images/nf-statistics.png" alt="Summary statistics" /><p class="caption">Summary statistics</p> |
|---|
| 62 | </div> |
|---|
| 63 | <h2 id="list-individual-flows"><a href="#list-individual-flows"><span class="header-section-number">3.3</span> List individual flows</a></h2> |
|---|
| 64 | <p>Select "List Flows", make sure all the Aggregate boxes are not checked, and then click <code>process</code>. This will display some flows at the beginning of the time period.</p> |
|---|
| 65 | <div class="figure"> |
|---|
| 66 | <img src="images/nf-list-flows.png" alt="List flows" /><p class="caption">List flows</p> |
|---|
| 67 | </div> |
|---|
| 68 | <p>Increase the limit from 20 flows to 100 flows. Notice that much network traffic consists of large numbers of very small flows - for example a DNS query/response will be two flows, one from client to DNS server, and one back again.</p> |
|---|
| 69 | <p>By selecting "bi-directional" you can get nfsen to associate the inbound and outbound flows into a single line:</p> |
|---|
| 70 | <div class="figure"> |
|---|
| 71 | <img src="images/nf-bidirectional.png" alt="Bi-directional flows" /><p class="caption">Bi-directional flows</p> |
|---|
| 72 | </div> |
|---|
| 73 | <p>However it's still too much work to wade through this looking for interesting traffic. Uncheck the "Bi-directional" box before continuing.</p> |
|---|
| 74 | <h2 id="flows-tofrom-one-host"><a href="#flows-tofrom-one-host"><span class="header-section-number">3.4</span> Flows to/from one host</a></h2> |
|---|
| 75 | <p>If we know which host we want to examine, we can apply a filter to show only those flows to and from that host. Do this by entering "host 10.10.X.Y" in the filter box, and then pressing <code>process</code> again. (Replace 10.10.X.Y with the address of one of your PCs)</p> |
|---|
| 76 | <div class="figure"> |
|---|
| 77 | <img src="images/nf-flows-host.png" alt="Flows to and from one host" /><p class="caption">Flows to and from one host</p> |
|---|
| 78 | </div> |
|---|
| 79 | <p>This is a little better, but we would still have to wade through lots of small flows to find anything significant. We need to take a different approach.</p> |
|---|
| 80 | <h1 id="largest-flows"><a href="#largest-flows"><span class="header-section-number">4</span> Largest flows</a></h1> |
|---|
| 81 | <p>The next thing we can do is to get nfsen to sort the flows by number of bytes. Remove any filter from the Filter box; select "Stat TopN", stat "Flow Records", order by "Bytes". Ensure all the aggregate boxes are all unchecked, then press <code>process</code></p> |
|---|
| 82 | <div class="figure"> |
|---|
| 83 | <img src="images/nf-topn-bytes.png" alt="Find top flows by bytes" /><p class="caption">Find top flows by bytes</p> |
|---|
| 84 | </div> |
|---|
| 85 | <div class="figure"> |
|---|
| 86 | <img src="images/nf-topn-bytes-output.png" alt="Output: top flows by bytes" /><p class="caption">Output: top flows by bytes</p> |
|---|
| 87 | </div> |
|---|
| 88 | <p>This is a definite improvement, as the flows with the largest number of bytes are shown first. However there's a problem - we are still looking at individual flows. It's possible that many small flows to the same host would add up to a large amount of traffic, but we wouldn't see them at the top of this list.</p> |
|---|
| 89 | <h1 id="inbound-traffic-grouped-by-receiver-ip-address"><a href="#inbound-traffic-grouped-by-receiver-ip-address"><span class="header-section-number">5</span> Inbound traffic grouped by receiver IP address</a></h1> |
|---|
| 90 | <p>What we want to see is a single line for each host in our network, showing the total amount of traffic delivered to that host.</p> |
|---|
| 91 | <p>To do this, Stat "DST IP Address", order by "bytes".</p> |
|---|
| 92 | <div class="figure"> |
|---|
| 93 | <img src="images/nf-topn-dest.png" alt="Group flows by DST IP Address" /><p class="caption">Group flows by DST IP Address</p> |
|---|
| 94 | </div> |
|---|
| 95 | <p>This is now much closer to what we want: there is one line for each destination IP address, and they are ordered by total bytes, largest first.</p> |
|---|
| 96 | <p>But there is still one problem - can you see what it is? We are seeing a mixture of inbound flows (where the destination IP is inside our network) and outbound flows (where the destination IP is on the Internet). We are only interested in the inbound flows, so apply a filter which shows only traffic to your group's network: "dst net 10.10.X.0/24" (replacing X with your group number)</p> |
|---|
| 97 | <div class="figure"> |
|---|
| 98 | <img src="images/nf-topn-dst-local.png" alt="Flows to local network, grouped by DST IP Address" /><p class="caption">Flows to local network, grouped by DST IP Address</p> |
|---|
| 99 | </div> |
|---|
| 100 | <div class="figure"> |
|---|
| 101 | <img src="images/nf-topn-dst-local-output.png" alt="Output: Flows to local network, grouped by DST IP Address" /><p class="caption">Output: Flows to local network, grouped by DST IP Address</p> |
|---|
| 102 | </div> |
|---|
| 103 | <p>At last we have what we want. The first record you see should tell you the local machine which has downloaded the most traffic in the period selected.</p> |
|---|
| 104 | <h2 id="outbound-traffic-grouped-by-sender-ip-address"><a href="#outbound-traffic-grouped-by-sender-ip-address"><span class="header-section-number">5.1</span> Outbound traffic grouped by sender IP address</a></h2> |
|---|
| 105 | <p>Question: what changes would you have to make to this query to find out which machines in your network are <em>uploading</em> the most traffic to the Internet?</p> |
|---|
| 106 | <h1 id="analysing-traffic-to-a-single-host"><a href="#analysing-traffic-to-a-single-host"><span class="header-section-number">6</span> Analysing traffic to a single host</a></h1> |
|---|
| 107 | <p>Now that we know which host has downloaded the most traffic, we might want to see where it has been downloading from.</p> |
|---|
| 108 | <p>Let's start by looking at the top flows to that host. Change the filter to "dst host 10.10.X.Y" (the IP address you just found). Then select Stat "Flow Records", order by "bytes", and <code>process</code>.</p> |
|---|
| 109 | <div class="figure"> |
|---|
| 110 | <img src="images/nf-dst-host-flows.png" alt="Largest flows to one host" /><p class="caption">Largest flows to one host</p> |
|---|
| 111 | </div> |
|---|
| 112 | <p>You should now see the flows inbound to that host, largest first. But again, we're only seeing large individual flows; a collection of small flows may add together to a large amount of traffic.</p> |
|---|
| 113 | <p>Since we are only looking at flow records to one particular destination IP address, we can group these records by source IP address.</p> |
|---|
| 114 | <div class="figure"> |
|---|
| 115 | <img src="images/nf-dst-host-srcs.png" alt="Flows to one host, grouped by SRC IP address" /><p class="caption">Flows to one host, grouped by SRC IP address</p> |
|---|
| 116 | </div> |
|---|
| 117 | <div class="figure"> |
|---|
| 118 | <img src="images/nf-dst-host-srcs-output.png" alt="Output: Flows to one host, grouped by SRC IP address" /><p class="caption">Output: Flows to one host, grouped by SRC IP address</p> |
|---|
| 119 | </div> |
|---|
| 120 | <p>And now we have one row for each IP address this host has been downloading from, with the total number of bytes downloaded from each IP, largest total first.</p> |
|---|
| 121 | <h2 id="ip-address-information"><a href="#ip-address-information"><span class="header-section-number">6.1</span> IP address information</a></h2> |
|---|
| 122 | <p>By clicking on an IP address, you will get some information from reverse DNS and whois.</p> |
|---|
| 123 | <div class="figure"> |
|---|
| 124 | <img src="images/nf-whois.png" alt="Whois information" /><p class="caption">Whois information</p> |
|---|
| 125 | </div> |
|---|
| 126 | <h1 id="additional-exercise-aggregating-flows"><a href="#additional-exercise-aggregating-flows"><span class="header-section-number">7</span> Additional exercise: aggregating flows</a></h1> |
|---|
| 127 | <p>nfsen offers some other ways to summarise the flows, using the Aggregate checkboxes. In this example we'll look again at traffic inbound to your network.</p> |
|---|
| 128 | <p>When you click one or more of the Aggregate boxes, nfsen combines all flows that share the same values of the attribute(s) you have selected.</p> |
|---|
| 129 | <p>To start this exercise, set the filter to "dst net 10.10.X.0/24" (X = your group). Select "Stat TopN", Stat "Flow Records", order by "bytes". Then try the following aggregates, remembering to click <code>process</code> after each one.</p> |
|---|
| 130 | <ul> |
|---|
| 131 | <li><p>Check "proto". You should get just one row each for TCP, UDP and ICMP, showing the total amount of traffic using each protocol. Sometimes this may show other protocols are active on your network (e.g. protocol 50 = IPSEC ESP; in Linux the file <code>/etc/protocols</code> has a list of them)</p></li> |
|---|
| 132 | <li><p>Check both "proto" and "srcPort". This tells nfsen to combine together flows which have the same proto <em>and</em> the same srcPort. Depending on what activity has been going on, you may see one line giving the total for TCP port 80, one line for TCP port 443, one line for UDP port 53, and so on.</p></li> |
|---|
| 133 | <li><p>Check "srcIP" by itself. This gives one row for each distinct source IP address, and is the same as selecting Stat SRC IP.</p></li> |
|---|
| 134 | <li><p>Check both "srcIP" and "dstIP". You will get one row for each unique pair of srcIP and dstIP seen, with the total traffic between those two endpoints.</p></li> |
|---|
| 135 | </ul> |
|---|
| 136 | <p>How would you change the filter to look at outbound traffic, rather than inbound traffic?</p> |
|---|
| 137 | <p>If you have a router with a full BGP table, you can aggregate netflow records by AS number. This is a useful way to find out what networks you are exchanging the most traffic with.</p> |
|---|
| 138 | </body> |
|---|
| 139 | </html> |
|---|
