Why Companies Turn to MSSPs

With 50% of Internet thefts occurring at companies with less than 2500 employees and the cost of hiring a security expert increasing, many organizations are turning to MSSPs in hopes of gaining access to a team of security experts. In turn, MSSPs provide their customers with  services in areas such as virus blocking, IDS, VPN and firewall maintenance. Monthly fees generally include a block of hours for system changes, modifications and upgrades.  When they aren’t working on specific customer issues, they collaborate with other experts to identify the latest threats and the best security countermeasures.  Because these experts can’t wait for the next software update to fight the latest cyber battle, security teams often turn to flow technologies to monitor for the latest malware.

“IPS (or deep packet inspection) is our #1 security defense; Netflow is a very close #2  – Gavin Reid, Manager of Cisco CSIRT.

Threat Detection with NetFlow

Traditionally, NetFlow and IPFIX have been used by MSSPs to perform Network Behavior Analysis by running dozens of algorithms against the flows collected. Examples include:

• Breach Attempts: Looks for many small flows from one source to one destination. This can indicate things such as a brute force password attack. A typical scenario would be a dictionary attack on an SSH server.
• DDoS: Identifies a Distributed Denial of Service attack such as those that can be launched by a BOTNET.
• DNS Violation: Alerts when a host initiates an excessive number of DNS queries. This can help to identify hosts that may be infected with a mailer worm or other issues that require an inordinate number DNS lookups.
• FIN Scan: The FIN scan’s “stealth” frames are unusual because they are sent to a device without first going through the normal TCP handshaking routine.
• ICMP Destination Unreachable: This is a message that comes back from the router to the requesting host stating that it doesn’t have a route to the destination network of the target host.

• ICMP Port Unreachable: This is a message that comes back from the destination server stating that it will not open communication on the specified port requested by the host.
• Nefarious Activity Violation: Looks for hosts communicating with many hosts with a low number of flows. An example would be a port 80 scan of an entire subnet.
• NULL Scan: The null scan turns off all TCP flags in an attempt to open a connection with the target host. Sometimes it consists of flows where the source port is 0 with various destination ports.
• RST/ACK: RST/ACK packets are connection denials that come back from destinations to the originating hosts. It can be caused by network scanning.
• SYN scan/flood: SYN packets are sent out in an attempt to make a network connection with a target host. It can be caused by network scanning.
• Unfinished Flows: Identifies hosts that have a high percentage of unfinished flows. This indicates scanning, Malware or poorly configured applications on a host.
• XMAS Tree scan: The Xmas tree scan sends a TCP frame to a remote device with the URG, PUSH, and FIN flags set. This is called a Xmas tree scan because of the alternating bits turned on and off in the flags byte (00101001), much like the lights of a Christmas tree.

The above algorithms are an excellent step toward the automation of detecting malware that could be trying to penetrate and compromise hosts on the network.  Notice that these algorithms focus on network behavior analysis as deep packet inspection to match packets to signatures isn’t generally possible with NetFlow.  Much like a flu virus, malware can use a polymorphic technique which means it can constantly vary its structure and content in order to avoid detection.  Solutions which perform deep packet inspection in an attempt to pattern match through the use of constantly updated signatures can easily be evaded by this dynamic technique. Even with all the above, more needs to be done to detect the latest forms of malware and this means thinking outside the proverbial threat detection box.



“I am convinced that every company in every conceivable industry with significant size and valuable intellectual property and trade secrets has been compromised (or will be shortly), with the great majority of the victims rarely discovering the intrusion or its impact. In fact, I divide the entire set of Fortune Global 2,000 firms into two categories: those that know they’ve been compromised and those that don’t yet know.”Dmitri Alperovitch, former VP of Threat Research, McAfee®

Read Part 2 on IP host reputation.

Follow me:

In most vendor implementations, flow technology is implemented in software. This results in only a small performance hit in well-written flow programs. In earlier versions of NetFlow (e.g. NetFlow v1), a busy router could be brought to its knees by enabling NetFlow.  Enabling NetFlow on the Cisco Catalyst 4500, 6500, 7600, 10000 and 12000 routers can result in the following CPU increase:

CAUTION: enabling conventional software implementations of NetFlow on very busy routers manufactured by most vendors can in some cases cause unacceptable performance issues.  In these cases, reducing the flow tuple or implementing flow sampling are options to consider. 

Cisco Systems, Enterasys, Extreme Networks and Dell Sonicwall develop firewalls, routers and switches that support NetFlow and IPFIX in hardware with no impact to the CPU.  SonicWALL exports IPFIX with over a dozen different templates and claims less than a 1% impact on CPU utilization. Other vendors like Enterasys have implemented unsampled NetFlow capable ASICs that are capable of exporting line rate flow exports.  With flow volumes exceeding 500,000 flows per second, the performance problem often moves from the exporter to the collector as no single flow collection appliance on the market today can handle this flow rate and distributed NetFlow solutions can’t always help when all the flows are coming from one exporter.

Distributed NetFlow collectors allow administrators to break up the collection of flows into groups with each collector receiving from a set of routers.  Because the configuration of hundreds of routers is often involved, a NetFlow replicator (aka NetFlow duplicator) is often implemented.  The Flow Replicator allows administrators to configure the routers to send flows to a single appliance.  The Flow Replicator then splits up the flows to different collectors.  This configuration allows administrators to balance the collection loads. 

Collection vendors like to tout their collection rates in the multiple million flows per second however, the architecture to support this flow rate is solely dependent on a multitude of individual collectors each limited to 100K-200K flows per second.  To reduce the volume, flow sampling or PSAMP is considered.  Shortening the size of the flow tuple can also lead to less flows exported.  The problem with many hardware implementations of NetFlow and IPFIX is that modifications to the tuple are not possible. Cisco and Plixer are the only vendors I know off that support this practice. 

Follow me:

Amazon EC2 Monitoring: Network Performance - Jan 25, 2013

Nimsoft Service Desk Pricing: Distributed NetFlow Solutions - Sep 24, 2012

Ingress NetFlow or Egress NetFlow part 2 - Jun 22, 2012

How to roll out BYOD Security: Best Network Management - Apr 24, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Dropped NetFlow : Flow Sequence Numbers - Jan 29, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

Here’s a break down on some of features as well as the hardware required for AVC support on the wireless controllers:

• AVC works on traffic from Cisco APs in “Local Mode”, FlexConnect central switching and OEAP traffic.
• AVC is based on port, destination and heuristics which allows reliable packet classification with deep visibility.
• AVC looks into the initial setup of the client flow (first 10-20 packets) so loading on the controller system is minimal.
• Available for all current generation Cisco controllers supporting v7.4 - Cisco 2504, 5508, WiSM2, Flex 7500 and 8500

Application Visibility and Control

Cisco Application Visibility and Control (AVC) solution is a suite of services that provides application-level classification, monitoring, and traffic control to improve application performance.  It is available within the following hardware families:

• Cisco Integrated Services Routers Generation 2 (ISR G2)
• Cisco ASR 1000 Series Aggregation Service Routers (ASR 1000s)
• Cisco Wireless LAN Controllers

The Cisco AVC Solution helps you:

• Identify and classify over 1,000 applications by leveraging NBAR
• Monitor next generation flow statistics such as response time, latency, jitter, and other application performance metrics
• Export NetFlow version 9 or IP information export (IPFIX)
• Set different QoS priorities based on application
• Dynamically choose network paths based on performance

Cisco Wireless Controller NetFlow Configuration

The Cisco wireless controller NetFlow configuration is shown below.

A few minutes after our NetFlow analyzer started receiving the flows, I saved some reports and created a custom Cisco Wireless Controller NetFlow dashboard:

As one of my co-workers pointed out in his post on Cisco wireless NetFlow support these reports are a bit unique and won’t work with just any ol’ NetFlow collector.  We had to create special provisions in our NetFlow reporting interface. This hardware exports 2 templates.  One is the NBAR option template, the 2^nd is the actual flows which contain the following elements:

• Client Source MAC : Key Field
• Client Source IP : Key Field
• SSID Name : Key Field
• Application ID
• Direction
• Byte Count
• Packet Count
• In DSCP
• Out DSCP
• Last AP MAC

Notice anything missing? 

Register for the webcasts offered on:

• Thursday April 25, 10AM Eastern Time
• Thursday April 25, 4PM Eastern Time

Follow me:

Palo Alto Networks NetFlow Export includes Firewall Event Field in PAN-OS 5.0 - Nov 25, 2012

Nimsoft Service Desk Pricing: Distributed NetFlow Solutions - Sep 24, 2012

Flexible NetFlow Configuration example for Performance Monitoring for TCP, VoIP and Cisco NBAR - Jul 12, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

• All of the data available in NetFlow v5
• VoIP details on caller ID, Codec, Jitter and packet loss
• Cloud service details on round trip time, URLs and deep packet inspection details that identify tricky applications like Skype, Webex and BitTorrent.
• Interface names and speeds to avoid the reporting tools dependency on SNMP
• Syslog and trap message details

• A) Template: All of the data available in NetFlow v5/v9. This template is easy to define because all of the information necessary has been defined by IANA:

• 1 octetDeltaCount
• 2 packetDeltaCount
• 4 protocolIdentifier
• 5 ipClassOfService
• 6 tcpControlBits
• Sent as 0 for non TCP traffic
• 7 sourceTransportPort
• 8 sourceIPv4Address
• 9 sourceIPv4PrefixLength
• 10 ingressInterface
• 11 destinationTransportPort
• 12 destinationIPv4Address
• 13 destinationIPv4PrefixLength
• 14 egressInterface
• 15 ipNextHopIPv4Address
• 16 bgpSourceAsNumber
• 17 bgpDestinationAsNumber
• 21 flowEndSysUpTime
• 22 flowStartSysUpTime
• 95 Application ID
• This element causes another template below
• 148 Flow ID
• This element is used to link to other templates

• B) Template: VoIP details on caller ID, Codec, Jitter and packet loss.  These elements are exported using a new template that contains meta data related to the flows exported above for the UDP real-time protocol (RTP).  It contains the following IDs:

• 148 Flow ID
• Links to the flow in A)
• 400.32473 Caller ID
• 401.32473 Codec
• 402.32473 Jitter
• 403.32473 Packet Loss

• C) Template: Cloud service details on round trip time, URLs and deep packet inspection details that identify tricky applications like Skype and BitTorrent.  These elements are exported using a meta data template similar to the one created in b).  In this case however, the template is only used for TCP traffic and includes the following IDs:

• 148 Flow ID
• Links to the flow in a)
• 501.32473 Round Trip Time
• 503.32473 URL

• D) Template: Interface names and speeds to avoid the reporting tools dependency on SNMP:
  
  • 10 ingressInterface
  • 82 interfaceName
  • 83 interfaceDescription
  • 82.32473 ifSpeed

• E) Template: Syslog and trap message details:
  
  • 322 observationTimeSeconds
  • 700.32473 Facility
  • 701.32473 Severity
  • 8 sourceIPv4Address
  • 10 ingressInterface
  • 12 destinationIPv4Address
  • 704.32473 Message

• F) Template: Application Name - This template provides the correlation between the application ID and the actual name of the application.  There is an effort underway to standardize this export which would allow consistency across vendors.

• 95 Application ID
• Links to the flow in a)
• 96 Application Name

Follow me:

Router Overhead When Enabling NetFlow - May 01, 2013

Amazon EC2 Monitoring: Network Performance - Jan 25, 2013

Ingress NetFlow or Egress NetFlow part 2 - Jun 22, 2012

How to roll out BYOD Security: Best Network Management - Apr 24, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Dropped NetFlow : Flow Sequence Numbers - Jan 29, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

Amazon EC2 services allow companies to create a server hosted by Amazon and manipulate it pretty much as if it were your own.  Once configured, the server can either sit on the internet for remote access or a VPN can be setup to allow the Amazon hosted server to sit on your internal network.  It is a great concept.  To monitor network performance to and from the hosted server, we planned on installing the nProbe to monitor TCP connection times to all of our customers. This would allow us to trend metrics on round trip times (RTT) and gain metrics on the Cisco IP SLA monitors used to verify acceptable connection times. 

The nProbe, similar to Cisco’s performance monitoring Flexible NetFlow technology for medianets, watches TCP handshakes to provide metrics on RTT.  Understandably this technology is not ideal for long lived TCP connections as a 2nd TCP hand shake doesn’t occur during a long lived connection.  In our implementation however, nearly all connections are short lived hence a technology leveraging TCP handshakes to calculate a RTT works fine if not ideal because the RTT measured is of the actual end user connection and not a synthetic transaction like when using IP SLA monitors.  There is a great white paper on calculating latency with NetFlow and TCP flags.

Imagine leveraging a cloud service like salesforce.com and being able to gain metrics on every TCP connection.  You would be able to gain insight on which remote offices, subnets and individuals within those groups are seeing the worse connection times.  Being a network traffic monitoring company, we have grown accustom to always having this type of insight at our finger tips.  The more we looked at the Amazon EC2 service offering the more attractive it became until we started crunching the numbers.

Because we maintain a network traffic baseline of current traffic patterns, we were able to calculate the Amazon EC2 costs times our expected bandwidth use for an entire year.  The final figures were in favor of us buying a bigger server and having it hosted at our local service provider.  We learned that although Amazon’s Elastic Computing Cloud is an attractive offering for many applications, it was not ideal  for our specific use.  The bandwidth our server would use made the switch to Amazon EC2 cost prohibitive. 

Follow me:

Router Overhead When Enabling NetFlow - May 01, 2013

NetFlow Training Schedule for 2012 - Aug 11, 2012

Ingress NetFlow or Egress NetFlow part 2 - Jun 22, 2012

How to roll out BYOD Security: Best Network Management - Apr 24, 2012

Monitoring BYOD traffic with NetFlow - Mar 24, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Monitoring Video Performance with NetFlow - Feb 19, 2012

End to End Visibility : Network Flow Path - Feb 06, 2012

Dropped NetFlow : Flow Sequence Numbers - Jan 29, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

• dragonEventDateTime
• sourceIPv4Address
• destinationIPv4Address 
• sourceTransportPort
• destinationTransportPort
• protocolIdentifier

• dragonSensorName
• dragonEventName
• dragonEventDirection
• dragonEventFlagsField
• dragonEventHeader
• dragonEventData

Follow me:

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

First is Security

With the constant introduction of new types of malware that is often capable of modifying its own communication behaviors, the firewall is without a doubt an organizations premier security layer against most types of threats.  What capabilities make up a next generation firewall and why is it the most important network security layer maintained by just about every company connected to the cloud?

Years ago we only needed passwords and anti-virus software to protect ourselves from malware. With the introduction of the Internet came great freedoms and insight but, it also forced us to heighten our awareness.  Network threats now come in many forms as well as motivations.  Key loggers want the passwords to the sites you visit on-line (E.g. banks accounts) and Advanced Persistent Threats (APT) want your company’s intellectual property (E.g. customer lists, engineering designs).  To provide deeper protection against these types of insidious threats, many Next-Generation Firewalls (NGF) include features previously only found in Intrusion Prevention Systems (IPS).  These next generation firewalls can include features such as:

• Deep Packet Inspection (DPI): were analysis on connections can even inspect SSL encrypted sessions for the deepest level of protection. DPI can also re-encrypt SSL traffic to allow security services to be applied to all traffic
• Intrusion Protection System (IPS): helps prevent a comprehensive array of network and application layer threats by scanning packet payloads for exploits targeting critical internal systems
• Content Filtering: blocks multiple categories of objectionable web content
• Signature Scanning: watches every packet and scans for bit patterns or flow behaviors that match constantly updated signatures.
• Application Intelligence: real-time insight and control of traffic which has been broken down by applications or even users or content.  The prioritization of traffic headed for the Internet is critical to most businesses leveraging important bottom-line cloud services

Second is Application Performance Monitoring

I have found that the last point above is where next-generation firewalls start to separate themselves from the other players in the market.  Features such as WAN acceleration and application prioritization are built-in features of the next generation firewalls that make it onto the short list of possible vendors. What then separates the men from the boys? Answer: The amount of support extended to Application Performance Monitoring (APM) seems like a natural feature that most of them would add yet, only one next generation firewall vendor actually delivers on application performance monitoring metrics and it is exported in the form of IPFIX.

IPFIX is the proposed standard for NetFlow and the technology that most firewall vendors are migrating to.  Although nearly all enterprise class firewalls today support either NetFlow or IPFIX, not all of them export details on layer 7 applications, usernames, URLs, jitter and packet loss.  Although some firewalls provide details such as “flow denied”, finding out exactly which ACL or specific policy blocked the flow can be cumbersome.  The SonicWALL has clear advantages.

The ability to perform DPI and recognize layer 7 applications such as Salesforce.com, Webex or BitTorrent is just the beginning.  How do we know if a cloud service such as VoIP is experiencing priority if the firewall doesn’t export details such as jitter or packet loss?

Above the SonicWALL Next-Generation Firewall not only provides details on packet loss and latency (I.e. jitter) it even provides caller ID.  When a user calls the help desk complaining about voice quality to a remote office, you can bet they won’t know the IP address they were trying to reach but, they will be ready to recite the telephone number they had called.  A firewall vendor claiming WAN optimization capabilities without Application Traffic Analytics isn’t ready to claim support for Application Performance Monitoring.  SonicWALL is a clear leader in this area. 

Follow me:

Palo Alto Networks NetFlow Export includes Firewall Event Field in PAN-OS 5.0 - Nov 25, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

• Application Awareness: They use Deep Packet Inspection (DPI) to identify and separate applications that share ports such as TCP 80.
• Username: If users have to authenticate with Active Director or LDAP, the firewall can tie the username to the flows.  This eases trouble shooting efforts during times of forensic analysis.
• Network Address Translation: This can be a big time saver when trying to find out what an IP address was internally before it was NAT'ed by the firewall.
• Firewall Event: The newest edition to their export provides the values outlined above.
• Syslog Correlation with NetFlow: The message log exported by the firewall can be formatted into IPFIX and correlated with the NetFlow data to ensure speedy identification of potential attacks

• Host reputation monitoring
• Enterprise application usage and performance monitoring
• Mitigation of evolving threats
• Audit trails of all internal and external traffic
• The very best in network performance reporting

Follow me:

Cisco Wireless Controller NetFlow Configuration - Apr 15, 2013

Next Generation Firewalls with Application Performance Monitoring In Mind - Dec 01, 2012

Nimsoft Service Desk Pricing: Distributed NetFlow Solutions - Sep 24, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

•  13745 = plixer
•  33071 = unique element ID

Notice that the value above shows up as a square.  This is because our IPFIX collector didn't know how to decode this data which resulted in our front end trying to display the binary information.  Without a RFC 5610 template, we have to tell another developer how to decode the value which allows the front end to display it like this:

I really don't want to see the efforts of Boschi, Trammell, Hitachi Europe, Mark, Fraunhofer IFAM, Zseby and Fraunhofer FOKUS go in vain. Please contact us if your company would like to consider implementing RFC 5610.  We have experience with the release of IPFIXify which is a gateway for translating syslogs, event logs and SNMP traps to IPFIX. 

Follow me:

Ingress NetFlow or Egress NetFlow part 2 - Jun 22, 2012

Ingress NetFlow or Egress NetFlow part 1 - May 31, 2012

Monitoring BYOD traffic with NetFlow - Mar 24, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

• IPFIXify - is a free utility that allows hardware vendors and end consumers to export anything they want via IPFIX.  For example, it can be installed on Microsoft servers to export event logs or it can be run as a service on any 64 bit OS and using a configuration file, it will export all machine logs as IPFIX.
• Flow Replicator – is an appliance which acts as a gateway for machine messages.  For example, it rips apart syslogs and event logs and sends them off in structured format inside IPFIX datagrams to a collector like Scrutinizer for further processing.

Follow me:

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

In the past, the Nimsoft support team in sales relied on Scrutinizer to provide the NetFlow reporting capability in NimBus.

Scrutinizer NetFlow Analyzer helped address one of the Nimsoft problems when it came to NetFlow analysis.  Apparently the NetQoS solution which is also owned by Computer Associates was too expensive at the time for some customers.  Zenoss, Spiceworks and Uptime Devices also leverage Scrutinizer for NetFlow collection.

One of the many keys to large scale NetFlow Deployments today is in distributed NetFlow solutions.  Plixer aims to aid partners and OEM vendors once again by releasing an enhanced distributed NetFlow, sFlow and IPFIX architecture. With each Scrutinizer collector receiving over 100K flows per second, Plixer aims to exceed 3 million flows per second.

Nimsoft customers can contact Plixer with technical questions on the integration between the two products.

Follow me:

Router Overhead When Enabling NetFlow - May 01, 2013

Cisco Wireless Controller NetFlow Configuration - Apr 15, 2013

Palo Alto Networks NetFlow Export includes Firewall Event Field in PAN-OS 5.0 - Nov 25, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

The first course is an Advanced NetFlow Training course offered by Plixer.  The Agenda is as follows:

• Troubleshooting the network with NetFlow
  • Optimizing BYOD & cloud services
  • NetFlow Sizing (NetFlow Calculator)
  • Finding specific traffic by leveraging filters
  • Leveraging identity aware flow data
  • Network Access Translation
  • Cisco ASA, Catalyst Switches, ISRs and other hardware vendors
• Internal network threat detection with NetFlow   
  • Tuning behavior algorithms (e.g. DDos, Excessive SYNs, etc.)
  • Creating custom monitors
  • Hunting through the data, finding a breach, where did it come from?
  • Tracking all lateral movements of a threat
  • IP host reputation monitoring
  • Event correlation and setting notifications
• NetFlow replication
  • Scaling NetFlow collection
  • Distributed collection
  • Flow deduplication and stitching
• Configure Flexible NetFlow
• Generate traffic within the lab
• View resulting NetFlow reports and alerts
• Leveraging new NetFlow and IPFIX technologies
  • NBAR2
  • Performance Monitoring (Medianet)
  • Performance Routing
  • Performance Agent
  • Smart Logging Telemetry
  • Cisco TrustSec
• Q&A

The second course “University of NetFlow” is offered by Lancope and is an introductory course on how to configure NetFlow.  It covers the basics:

• Gain end-to-end visibility into all application and network traffic across physical and virtual networks
• Gain real-time overview of network usage, network performance and host integrity
• Identify what is actually happening on your network (when and by whom)
• Pinpoint zero-day and unknown threats that bypass perimeter security
• Demonstrate Faster Incident Resolution & detailed Forensic data
• Demonstrate Compliance
• Regain network visibility lost through MPLS migrations
• Pro-actively monitor for threats impacting network performance and application availability
• Profile hosts to specify allowed service usage and alarm on disallowed usage or out of profile conditions
• Gain a better understanding of the impact of new application and service deployments

Source: Lancope.com 

Both are hands on courses from successful companies.   If you have any questions, reach to our instructors, as they have experience with both courses. Learn more about Lancope Competitors.

Follow me:

NetFlow Behavior Analysis Systems : Limited Impact - Jan 13, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

This course is not limited to Cisco and includes VMware NetFlow training as well as flows exported from Palo Alto, SonicWALL and other firewalls.

The agenda covers:

8:30 - 9:00 am Registration and Breakfast 9:00 - 10:15 am Welcome and Introductions

• Introduction to Cisco NetFlow, IPFIX & sFlow
• What devices support NetFlow and IPFIX
• Methods of collection and distribution

10:15 - 10:30 am Break / Networking 10:30 - 11:45 am NetFlow Impact on the Network/Devices

• Troubleshooting the network with NetFlow
  • Optimizing BYOD & cloud services
  • Finding specific traffic by leveraging filters
  • Leveraging identity aware flow data
  • Network Access Translation
  • Cisco ASA, Catalyst Switches, ISRs and other hardware vendors
• Internal network threat detection with NetFlow
  • Tuning behavior algorithms (e.g. DDos, Excessive SYNs, etc.)
  • Creating custom monitors
  • Hunting through the data, finding a breach, where did it come from?
  • Tracking all lateral movements of a threat
  • IP host reputation monitoring
  • Event correlation and setting notifications
• NetFlow replication
  • Scaling NetFlow collection
  • Distributed collection
  • Flow deduplication and stitching

11:45 - 1:00 pm Lunch

• Lunch provided by Plixer International

1:00 - 4:30 pm Hands-on NetFlow Lab

• Configure Flexible NetFlow
• Generate traffic within the lab
• View resulting NetFlow reports and alerts
• Leveraging new NetFlow and IPFIX technologies
  • NBAR2
  • Performance Monitoring (Medianet)
  • Performance Routing
  • Performance Agent
  • Smart Logging Telemetry
  • Cisco TrustSec
• Q&A

2:00 - 2:15 pm Break / Networking 4:30 pm Dismissal

This NetFlow class is offered in the following Cities:

• Washington DC
• Houston, TX
• Los Angeles, CA
• Pittsburgh, PA
• Seattle, WA
• Tampa, FL
• San Jose, CA
• Salt Lake, UT
• Cincinnati, OH
• Dallas, TX
• Edison, NJ
• Detroit, MI
• Raleigh, NC

Come learn from the experts in NetFlow as this cause is taught by Tom Pore, Adam Powers (formerly of Lancope) and Michael Patterson.

This class covers some of the basics of NetFlow right up to the latest and greatest in Flexible NetFlow and IPFIX.

Follow me:

Amazon EC2 Monitoring: Network Performance - Jan 25, 2013

Monitoring BYOD traffic with NetFlow - Mar 24, 2012

Monitoring Video Performance with NetFlow - Feb 19, 2012

End to End Visibility : Network Flow Path - Feb 06, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

Follow me:

Cisco Wireless Controller NetFlow Configuration - Apr 15, 2013

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community

Don't forget to read Ingress or Egress NetFlow part 1 first. What if you wake up one morning and announce to your network traffic monitoring team that for several reasons, you want to export both ingress and egress NetFlow on a few of the Cisco Routers. What will the network monitoring gurus say?  Hmmmm......  Probably nothing. 

The IT staff may not really care about your early morning epiphany however the NetFlow analyzer may have decided to display the data differently.  Think about this: for months you have been reporting on outbound data using ingress metered NetFlow or IPFIX and now you want to display outbound utilization using egress metered NetFlow. What about the saved history in the database? All of the history is saved as ingress.  Now the direction bit is flipped and you want to display outbound utilization using egress flows. 

Fast forward: after a two weeks of collecting egress flows you've decided to run a NetFlow trend on outbound traffic for the last 30 days. This would cross the date line of switching from ingress to egress.  What would happened in the front end of the network monitoring and reporting tool? Contact your NetFlow Vendor to find out.

Finally, there are a few different reasons to export egress NetFlow and I've heard ideas from several NetFlow experts that their hardware may end up exporting bidirectional flows in the future as this helps avoid the ingress Vs. egress discussion. Some flows like SonicWALL IPFIX exports already include bidirectional flows where a single flow contains both ingress and egress monitored traffic. Finally, I don't want to leave anyone out so I should mention that other vendors support egress as well (e.g. Adtran).

Follow me:

Router Overhead When Enabling NetFlow - May 01, 2013

Amazon EC2 Monitoring: Network Performance - Jan 25, 2013

IPFIX Vendors should implement RFC 5610 - Nov 07, 2012

Ingress NetFlow or Egress NetFlow part 1 - May 31, 2012

How to roll out BYOD Security: Best Network Management - Apr 24, 2012

Monitoring BYOD traffic with NetFlow - Mar 24, 2012

Migrating to Flexible NetFlow : BEST PRACTICES - Mar 08, 2012

Dropped NetFlow : Flow Sequence Numbers - Jan 29, 2012

Sponsored by the Call Center Outsourcing Community & the Virtual Contact Center Outsourcing Community