Use NetFlow for visibility into network blind spots: Virtualization, 10Gb+ Ethernet, MPLS and Multipoint VPN
NetFlow provides visibility into areas of the network you can’t easily reach with traditional Ethernet sensors or inline devices.
By Brad Reese on Wed, 10/01/08 - 1:35am.
 This is the second edition of the Adam Powers' NetFlow benefits series for the Cisco Subnet.
Hopefully, you didn't miss the first one: NetFlow’s popularity has increased tremendously over the past 2 years. Why? The simple answer: |
NetFlow provides visibility into areas of the network you can’t easily reach with traditional Ethernet sensors or inline devices.
Three key emerging technologies are creating these "hard to reach" network locations:
1. MPLS and Multipoint VPN Technology
Visibility problem:
Fully meshed connectivity circumvents network monitoring deployed at the “hub” location.
Traditional hub and spoke WAN topologies are easy to monitor. Packet pass through a central location and are available for packet inspection of all types. In this model all inspection technology can be centralized...
Unfortunately, MPLS is changing the way WAN topologies work. Driven by VoIP (need for low latency) and lower costs, organizations are turning to MPLS to make their WAN management easier and more scalable. Given the below scenario, the two hosts can now communicate with one another directly, out of the line of sight of the IDS/IPS/packet inspector...
Deploying sensors to each site is an option but gets extremely expensive very quickly. Pile on ping/power/pipe costs and the “sensor at every site” model becomes very unattractive...
Instead of using distributed sensors at each remote site, consider enabling NetFlow. Most likely NetFlow is already available. Simply turn it on at the remote site and send the NetFlow messages across the WAN back to a centralized NetFlow collector(s)...
2. 10Gb+ Ethernet
Visibility problem:
10G Ethernet is so fast few probe technologies can keep up and those that can are too expensive.
High speed network cores are hard to monitor. In the diagram below here, where would we "plug in"? If we’re using a SPAN port, what do we do about duplicate Ethernet frames? Can we afford a sensor that’s fast enough to keep up with the packet rates found within this environment.
Instead of using a SPAN or Ethernet tap, enable NetFlow on the core devices themselves. The Cisco Catalyst 6500 has excellent hardware-based NetFlow support. A 5Gbps FTP session between two hosts will result in nothing more than two 46 byte NetFlow v5 records. In other words, NetFlow has very little to do with bandwidth. 10Gbps network speeds mean nothing to the NetFlow collector. In addition to the visibility NetFlow provides into intercommunications, we also get top talkers, interface utilization, and many other data points not available with traditional Ethernet sensor technology.
3. Virtualization
Visibility problem:
Virtualization hides whole network segments from the network manager’s view, making VM2VM communication problems difficult to troubleshoot and impossible to audit.
This is the most recent network environment to make its way into the "hard to reach" category. Virtualization presents a unique challenge for network operators and security admins. With communications occurring across the virtualized backplane the hypervisor never leaves the virtual environment. Traditional packet inspection technologies have no easy place to "connect" to this environment and do not see the VM2VM flows...
NetFlow again saves the day. Rather than installing a heavy-weight "shim" into the virtual environment we can leverage NetFlow exports natively from VMware ESX 3.5 or through open source and commercial NetFlow exporters such a nfsen or the even popular nProbe from Luca Deri (ntop creator). NetFlow records are sent out of the virtual environment, across the physical network and into a NetFlow collector. This approach works extremely well as NetFlow accounting is very light weight and has a low impact on disk I/O and CPU within the Virtual Server...
So as you can see NetFlow telemetry is a powerful tool for reclaiming control over troublesome network environments.
For more information on the use of NetFlow in such situations, feel free to contact me offline at: apowers@lancope.com
The Adam Powers Lancope NetFlow Blog Series:
Part One
Adam Powers CTO of Lancope: Top 5 uses of NetFlow
What are your network blind spots?
 http://www.BradReese.Com Search 31,427 Cisco Job Openings Post Cisco Network Engineer Jobs View 1,595 items of Refurbished Cisco Examine CCIE Resumes Consider 697 Cisco Certified |
- About Brad Reese on Cisco
Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable Cisco networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.
Don't be shy, contact Brad Reese online or call him at 646-827-1130.
Most Discussed Posts
- On The Web
-
Network World, Inc
The Connected Enterprise