Agenda: exercise1-flow-export.htm

File exercise1-flow-export.htm, 7.4 KB (added by admin, 5 years ago)
Line 
1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html xmlns="http://www.w3.org/1999/xhtml">
3<head>
4  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5  <meta http-equiv="Content-Style-Type" content="text/css" />
6  <meta name="generator" content="pandoc" />
7  <title>Monitoring Netflow with NfSen</title>
8  <style type="text/css">code{white-space: pre;}</style>
9  <link rel="stylesheet" href="../../style.css" type="text/css" />
10</head>
11<body>
12<div id="header">
13<h1 class="title">Monitoring Netflow with NfSen</h1>
14</div>
15<div id="TOC">
16<ul>
17<li><a href="#introduction"><span class="toc-section-number">1</span> Introduction</a><ul>
18<li><a href="#goals"><span class="toc-section-number">1.1</span> Goals</a></li>
19<li><a href="#notes"><span class="toc-section-number">1.2</span> Notes</a></li>
20</ul></li>
21<li><a href="#export-flows-from-a-cisco-router"><span class="toc-section-number">2</span> Export flows from a Cisco router</a><ul>
22<li><a href="#group-1-router-1"><span class="toc-section-number">2.1</span> Group 1, Router 1</a></li>
23<li><a href="#group-2-router-2"><span class="toc-section-number">2.2</span> Group 2, Router 2</a></li>
24</ul></li>
25<li><a href="#configuring-the-routers"><span class="toc-section-number">3</span> Configuring the routers</a></li>
26</ul>
27</div>
28<h1 id="introduction"><a href="#introduction"><span class="header-section-number">1</span> Introduction</a></h1>
29<h2 id="goals"><a href="#goals"><span class="header-section-number">1.1</span> Goals</a></h2>
30<ul>
31<li>Learn how to export flows from a Cisco router</li>
32</ul>
33<h2 id="notes"><a href="#notes"><span class="header-section-number">1.2</span> Notes</a></h2>
34<ul>
35<li>Commands preceded with &quot;$&quot; imply that you should execute the command as a general user - not as root.</li>
36<li>Commands preceded with &quot;#&quot; imply that you should be working as root.</li>
37<li>Commands with more specific command lines (e.g. &quot;rtrX&gt;&quot; or &quot;mysql&gt;&quot;) imply that you are executing commands on remote equipment, or within another program.</li>
38</ul>
39<h1 id="export-flows-from-a-cisco-router"><a href="#export-flows-from-a-cisco-router"><span class="header-section-number">2</span> Export flows from a Cisco router</a></h1>
40<p>You will configure your router to export the same flow data to all PCs in your group.</p>
41<h2 id="group-1-router-1"><a href="#group-1-router-1"><span class="header-section-number">2.1</span> Group 1, Router 1</a></h2>
42<pre><code>rtr1 ==&gt; pc1 on port 9001
43rtr1 ==&gt; pc2 on port 9001
44rtr1 ==&gt; pc3 on port 9001
45rtr1 ==&gt; pc4 on port 9001</code></pre>
46<h2 id="group-2-router-2"><a href="#group-2-router-2"><span class="header-section-number">2.2</span> Group 2, Router 2</a></h2>
47<pre><code>rtr2 ==&gt; pc5 on port 9001
48rtr2 ==&gt; pc6 on port 9001
49rtr2 ==&gt; pc7 on port 9001
50rtr2 ==&gt; pc8 on port 9001</code></pre>
51<p>etc.</p>
52<h1 id="configuring-the-routers"><a href="#configuring-the-routers"><span class="header-section-number">3</span> Configuring the routers</a></h1>
53<pre><code>$ ssh cisco@rtrX.ws.nsrc.org
54rtrX&gt; enable</code></pre>
55<p>or, if ssh is not configured yet:</p>
56<pre><code>$ telnet 10.10.1.254
57Username: cisco
58Password:
59Router1&gt;enable
60Password: </code></pre>
61<p>The following configures the FastEthernet 0/0 interface to export flows. Replace 10.10.X.A to .D with the IP addresses of the PCs in your group.</p>
62<pre><code>rtrX# configure terminal
63rtrX(config)# flow exporter EXPORTER-1
64rtrX(config-flow-exporter)# description Export to pcA
65rtrX(config-flow-exporter)# destination 10.10.X.A
66rtrX(config-flow-exporter)# transport udp 9001
67rtrX(config-flow-exporter)# template data timeout 300
68... repeat for EXPORTER-2 and pcB
69... repeat for EXPORTER-3 and pcC
70... repeat for EXPORTER-4 and pcD
71rtrX(config-flow-exporter)# flow monitor FLOW-MONITOR-V4
72rtrX(config-flow-monitor)# exporter EXPORTER-1
73rtrX(config-flow-monitor)# exporter EXPORTER-2
74rtrX(config-flow-monitor)# exporter EXPORTER-3
75rtrX(config-flow-monitor)# exporter EXPORTER-4
76rtrX(config-flow-monitor)# record netflow ipv4 original-input
77rtrX(config-flow-monitor)# cache timeout active 300
78rtrX(config)# interface FastEthernet 0/0
79rtrX(config-if)# ip flow monitor FLOW-MONITOR-V4 input
80rtrX(config-if)# ip flow monitor FLOW-MONITOR-V4 output
81rtrX(config-if)# exit</code></pre>
82<p>Since you have not specified a protocol version for the exported flow records, you get the default which is Netflow v9.</p>
83<p>The &quot;cache timeout active 300&quot; command breaks up long-lived flows into 5-minute fragments. If you leave it at the default of 30 minutes your traffic reports will have spikes.</p>
84<blockquote>
85<p>Aside: to monitor IPv6 flows you would have to create a new flow monitor for IPv6 and attach it to the interface and the existing exporters.</p>
86<pre><code>flow monitor FLOW-MONITOR-V6
87 exporter EXPORTER-1
88 exporter EXPORTER-2
89 exporter EXPORTER-3
90 exporter EXPORTER-4
91 record netflow ipv6 original-input
92 cache timeout active 300
93interface FastEthernet 0/0
94 ipv6 flow monitor FLOW-MONITOR-V6 input
95 ipv6 flow monitor FLOW-MONITOR-V6 output</code></pre>
96</blockquote>
97<p>Also enter the following command:</p>
98<pre><code>rtrX(config)# snmp-server ifindex persist</code></pre>
99<p>This enables ifIndex persistence globally. This ensures that the ifIndex values are retained during router reboots - also if you add or remove interface modules to your network devices.</p>
100<p>Now we'll verify what we've done.</p>
101<p>First exit from the configuration session:</p>
102<pre><code>rtrX(config)# exit</code></pre>
103<pre><code>rtrX# show flow exporter EXPORTER-1
104rtrX# show flow exporter EXPORTER-2
105etc...
106rtrX# show flow monitor FLOW-MONITOR-V4</code></pre>
107<p>It's possible to see the individual flows that are active in the router:</p>
108<pre><code>rtrX# show flow monitor FLOW-MONITOR-V4 cache</code></pre>
109<p>But there will be thousands of individual flows, so that's not useful. Press 'q' to escape from the screen output if necessary.</p>
110<p>Instead, group the flows so you can see your &quot;top talkers&quot; (traffic destinations and sources). This is one very long command line:</p>
111<pre><code>rtrX# show flow monitor FLOW-MONITOR-V4 cache aggregate ipv4 source address
112      ipv4 destination address sort counter bytes top 20</code></pre>
113<p>If it all looks good then write your running-config to non-volatile RAM (i.e. the startup-config):</p>
114<pre><code>rtrX#wr mem</code></pre>
115<p>You can exit from the router now:</p>
116<pre><code>rtrX#exit</code></pre>
117<p>Make sure we have the tcpdump tool installed:</p>
118<pre><code>$ sudo apt-get install tcpdump</code></pre>
119<p>Now verify that flows are arriving from your router to your PC:</p>
120<pre><code>$ sudo tcpdump -i eth0 -nn -Tcnfp port 9001</code></pre>
121<p>Wait a few seconds and you should see something that looks like:</p>
122<pre><code>06:12:00.953450 IP s2.ws.nsrc.org.54538 &gt; noc.ws.nsrc.org.9009: NetFlow v5, 9222.333 uptime, 1359871921.013782000, #906334, 30 recs
123  started 8867.952, last 8867.952
124    10.10.0.241/0:0:53 &gt; 10.10.0.250/0:0:49005 &gt;&gt; 0.0.0.0
125    udp tos 0, 1 (136 octets)
126  started 8867.952, last 3211591.733
127    10.10.0.241/10:0:0 &gt; 0.0.0.0/10:0:4352 &gt;&gt; 0.0.0.0
128    ip tos 0, 62 (8867952 octets)
129[...]</code></pre>
130<p>These are the UDP packets containing individual flow records.</p>
131<p>(Note that the actual output may not be correct, as tcpdump does not decode Netflow properly)</p>
132<p>You are done for this lab.</p>
133<p>Go to exercise2-install-nfdump-nfsen.</p>
134</body>
135</html>