NetFlow use cases ICmyNet / NetVizura Milo Zekovi, - - PowerPoint PPT Presentation

▶

Oct 02, 2023 353 likes •634 views

NetFlow use cases ICmyNet / NetVizura Milo Zekovi, milos.zekovic@soneco.rs ICmyNet Chief Customer Officer Soneco d.o.o. Serbia Agenda ICmyNet / NetVizura overview Use cases / case studies Statistics per exporter/interfaces Traffic

SLIDE 1

NetFlow use cases

ICmyNet / NetVizura

Miloš Zeković,

milos.zekovic@soneco.rs ICmyNet Chief Customer Officer Soneco d.o.o. Serbia

SLIDE 2

2 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Agenda

ICmyNet / NetVizura overview Use cases / case studies

Statistics per exporter/interfaces Traffic Patterns – NREN case study DoS Attack – case study Statistics with no netflow capable device – case study Other use cases

Questions

SLIDE 3

3 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

ICmyNet / NetVizura

ICmyNet → NetVizura: Rebranding in progress NetFlow Analyzer (ICmyNet.Flow)

Statistics per Traffic Patterns and subnets Statistics per exporter/interfaces (v4) Statistics for each node, IP hierarchy More at www.icmynet.com

Free Academic Network Program

SLIDE 4

4 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Exporter/interface statistic

NetFlow enabled:

All significant exporters and their interfaces All on ingress or egress

Top exporters and interfaces Top talkers by interface, host, service, …

Throughput and Volume Bit/s, packet/s, flow/s In/Out + dst/src (host, services, AS)

SLIDE 5

5 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Exporter/interface statistic (2)

SLIDE 6

6 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS - challenge

AMRES, Serbian NREN

150+ member organisations 150 000 active users

Traffic Analysis per member

Geographically dispersed Hierarchical network: regions, cities, institutions IP address/subnet != member

Archive network logs for 1 year

SLIDE 7

7 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS - Solution

Deployment

Cisco NetFlow enabled on 2 central routers ICmyNet.Flow installed on 1 server

Configuration of ICmyNet.Flow

Members = subnets and Subnet Sets Specific traffic isolated with Traffic Patterns

NetFlow records in Raw Data

SLIDE 8

8 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS - Solution (2)

Traffic Pattern Specific traffic between two networks

SLIDE 9

9 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS - Solution (3)

SLIDE 10

10 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS – solution (4)

SLIDE 11

11 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS – Solution (3)

SLIDE 12

12 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

NREN CS - Results

Two NetFlow devices – full network statistic Statistic per member

Statistic independent to network topology Bandwidth utilization understanding

Increased security awareness

SLIDE 13

13 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

DoS Attack CS

SLIDE 14

14 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

DoS Attack CS (2)

SLIDE 15

15 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

DoS Attack CS (3)

SLIDE 16

16 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

DoS Attack CS (4)

SLIDE 17

17 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

DoS Attack CS (5)

Charts:

Bits and packets traffic looks normal Flows traffic shows an anomaly Anomaly related to UDP protocol and DNS service Host identified (top talker for DNS flows)

Raw Data:

Filtered by host, protocol and service port Grouped by destination IP addresses

SLIDE 18

18 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

DoS Attack CS – results (6)

Isolated destinations with large number of DNS conversations In several clicks:

Attacker discovered Type of attack determined Victims identified

SLIDE 19

19 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

No NetFlow devices CS - challenge

DZ Palilula, primary healthcare center, Serbia

One main clinic with local clinic network Centralized Healthcare software system Access through server in main clinic

Leased network devices (L3VPN)

No NetFlow enabled devices No device access

Privacy issues - patient medical data

SLIDE 20

20 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

No NetFlow devices CS - solution

NetFlow probe - SoftFlowd

installed on two server interfaces: to clinics and to database Netflow data exported to ICmyNet Server Privacy - NetFlow only monitors statistic, not traffic content

Local clinics identified by IP addresses

Subnets for each clinic and their department

Service/Application monitor

Traffic Pattern for each service/application of interest

SLIDE 21

21 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

No NetFlow devices CS - Results

NetFlow statistics without NetFlow devices

No devices purchased Statistics per clinic and department Statistics per service of interest

Better planning for future leased links and speed

Most active personnel and departments identified Periods of most activity identified L3VPN link speed optimization per clinic

Better service reliability

SLIDE 22

22 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Other use cases

Alarms

Threshold based Faster reaction Reaction when needed

Conversations

Identify top End to end talkers

Bandwidth management

Monitor specific services or traffic (Viber, YouTube etc.) Implement QoS policies

SLIDE 23

23 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Other use cases (2)

Blocked traffic

Interface out is 0 (traffic pattern) Firewall check Mitigated attacks check

“Rare” protocols

Monitor protocols other than TCP and UDP (99%)

Specific ports

Most attacks utilize open ports on several applications

SLIDE 24

24 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Question time

Questions?

SLIDE 25

25 / 26 Miloš Zeković

ICmyNet Chief Customer Officer

Soneco, d.o.o. Serbia 8th September 2014

Thank you

SLIDE 26

NetFlow use cases

ICmyNet / NetVizura

Miloš Zeković,

milos.zekovic@soneco.rs ICmyNet Chief Customer Officer Soneco d.o.o. Serbia