NetFlow use cases ICmyNet / NetVizura Miloš Zeković, milos.zekovic@soneco.rs ICmyNet Chief Customer Officer Soneco d.o.o. Serbia
Agenda ICmyNet / NetVizura overview Use cases / case studies Statistics per exporter/interfaces Traffic Patterns – NREN case study DoS Attack – case study Statistics with no netflow capable device – case study Other use cases Questions Miloš Zeković 2 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
ICmyNet / NetVizura ICmyNet → NetVizura: Rebranding in progress NetFlow Analyzer (ICmyNet.Flow) Statistics per Traffic Patterns and subnets Statistics per exporter/interfaces (v4) Statistics for each node, IP hierarchy More at www.icmynet.com Free Academic Network Program Miloš Zeković 3 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
Exporter/interface statistic NetFlow enabled: All significant exporters and their interfaces All on ingress or egress Top exporters and interfaces Top talkers by interface, host, service, … Throughput and Volume Bit/s, packet/s, flow/s In/Out + dst/src (host, services, AS) Miloš Zeković 4 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
Exporter/interface statistic (2) Miloš Zeković 5 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS - challenge AMRES, Serbian NREN 150+ member organisations 150 000 active users Traffic Analysis per member Geographically dispersed Hierarchical network: regions, cities, institutions IP address/subnet != member Archive network logs for 1 year Miloš Zeković 6 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS - Solution Deployment Cisco NetFlow enabled on 2 central routers ICmyNet.Flow installed on 1 server Configuration of ICmyNet.Flow Members = subnets and Subnet Sets Specific traffic isolated with Traffic Patterns NetFlow records in Raw Data Miloš Zeković 7 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS - Solution (2) Traffic Pattern Specific traffic between two networks Miloš Zeković 8 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS - Solution (3) Miloš Zeković 9 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS – solution (4) Miloš Zeković 10 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS – Solution (3) Miloš Zeković 11 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NREN CS - Results Two NetFlow devices – full network statistic Statistic per member Statistic independent to network topology Bandwidth utilization understanding Increased security awareness Miloš Zeković 12 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
DoS Attack CS Miloš Zeković 13 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
DoS Attack CS (2) Miloš Zeković 14 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
DoS Attack CS (3) Miloš Zeković 15 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
DoS Attack CS (4) Miloš Zeković 16 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
DoS Attack CS (5) Charts: Bits and packets traffic looks normal Flows traffic shows an anomaly Anomaly related to UDP protocol and DNS service Host identified (top talker for DNS flows) Raw Data: Filtered by host, protocol and service port Grouped by destination IP addresses Miloš Zeković 17 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
DoS Attack CS – results (6) Isolated destinations with large number of DNS conversations In several clicks: Attacker discovered Type of attack determined Victims identified Miloš Zeković 18 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
No NetFlow devices CS - challenge DZ Palilula, primary healthcare center, Serbia One main clinic with local clinic network Centralized Healthcare software system Access through server in main clinic Leased network devices (L3VPN) No NetFlow enabled devices No device access Privacy issues - patient medical data Miloš Zeković 19 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
No NetFlow devices CS - solution NetFlow probe - SoftFlowd installed on two server interfaces: to clinics and to database Netflow data exported to ICmyNet Server Privacy - NetFlow only monitors statistic, not traffic content Local clinics identified by IP addresses Subnets for each clinic and their department Service/Application monitor Traffic Pattern for each service/application of interest Miloš Zeković 20 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
No NetFlow devices CS - Results NetFlow statistics without NetFlow devices No devices purchased Statistics per clinic and department Statistics per service of interest Better planning for future leased links and speed Most active personnel and departments identified Periods of most activity identified L3VPN link speed optimization per clinic Better service reliability Miloš Zeković 21 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
Other use cases Alarms Threshold based Faster reaction Reaction when needed Conversations Identify top End to end talkers Bandwidth management Monitor specific services or traffic (Viber, YouTube etc.) Implement QoS policies Miloš Zeković 22 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
Other use cases (2) Blocked traffic Interface out is 0 (traffic pattern) Firewall check Mitigated attacks check “Rare” protocols Monitor protocols other than TCP and UDP (99%) Specific ports Most attacks utilize open ports on several applications Miloš Zeković 23 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
Question time Questions? Miloš Zeković 24 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
Thank you Miloš Zeković 25 / 26 8 th September 2014 ICmyNet Chief Customer Officer Soneco, d.o.o. Serbia
NetFlow use cases ICmyNet / NetVizura Miloš Zeković, milos.zekovic@soneco.rs ICmyNet Chief Customer Officer Soneco d.o.o. Serbia
Recommend
More recommend
