Skip Links

Network World

Brad Reese

Use NetFlow for visibility into network blind spots: Virtualization, 10Gb+ Ethernet, MPLS and Multipoint VPN

NetFlow provides visibility into areas of the network you can’t easily reach with traditional Ethernet sensors or inline devices.

By Brad Reese on Wed, 10/01/08 - 1:35am.

Lancope Optimizing Security and Network Operations

Adam PowersThis is the second edition of the Adam Powers' NetFlow benefits series for the Cisco Subnet.

Hopefully, you didn't miss the first one:

Top 5 uses of NetFlow

NetFlow’s popularity has increased tremendously over the past 2 years.

Why?

The simple answer:

NetFlow provides visibility into areas of the network you can’t easily reach with traditional Ethernet sensors or inline devices.

Three key emerging technologies are creating these "hard to reach" network locations:

1. MPLS and Multipoint VPN Technology

Visibility problem:

Fully meshed connectivity circumvents network monitoring 
deployed at the “hub” location.

Traditional hub and spoke WAN topologies are easy to monitor. Packet pass through a central location and are available for packet inspection of all types. In this model all inspection technology can be centralized...

Classic Hub And Spoke

Unfortunately, MPLS is changing the way WAN topologies work. Driven by VoIP (need for low latency) and lower costs, organizations are turning to MPLS to make their WAN management easier and more scalable. Given the below scenario, the two hosts can now communicate with one another directly, out of the line of sight of the IDS/IPS/packet inspector...

Fully-meshed MPLS Cloud

Deploying sensors to each site is an option but gets extremely expensive very quickly. Pile on ping/power/pipe costs and the “sensor at every site” model becomes very unattractive...

Deploying Sensors

Instead of using distributed sensors at each remote site, consider enabling NetFlow. Most likely NetFlow is already available. Simply turn it on at the remote site and send the NetFlow messages across the WAN back to a centralized NetFlow collector(s)...

Consider Enabling NetFlow

2. 10Gb+ Ethernet

Visibility problem:

10G Ethernet is so fast few probe technologies can keep up
and those that can are too expensive.

High speed network cores are hard to monitor. In the diagram below here, where would we "plug in"? If we’re using a SPAN port, what do we do about duplicate Ethernet frames? Can we afford a sensor that’s fast enough to keep up with the packet rates found within this environment.

High Speed Network Cores Are Hard To Monitor

Instead of using a SPAN or Ethernet tap, enable NetFlow on the core devices themselves. The Cisco Catalyst 6500 has excellent hardware-based NetFlow support. A 5Gbps FTP session between two hosts will result in nothing more than two 46 byte NetFlow v5 records. In other words, NetFlow has very little to do with bandwidth. 10Gbps network speeds mean nothing to the NetFlow collector. In addition to the visibility NetFlow provides into intercommunications, we also get top talkers, interface utilization, and many other data points not available with traditional Ethernet sensor technology.

Enable NetFlow On The Core Devices Themselves

3. Virtualization

Visibility problem:

Virtualization hides whole network segments from the
network manager’s view, making VM2VM communication
problems difficult to troubleshoot and impossible to
audit.

This is the most recent network environment to make its way into the "hard to reach" category. Virtualization presents a unique challenge for network operators and security admins. With communications occurring across the virtualized backplane the hypervisor never leaves the virtual environment. Traditional packet inspection technologies have no easy place to "connect" to this environment and do not see the VM2VM flows...

Virtualization Presents A Unique Challenge

NetFlow again saves the day. Rather than installing a heavy-weight "shim" into the virtual environment we can leverage NetFlow exports natively from VMware ESX 3.5 or through open source and commercial NetFlow exporters such a nfsen or the even popular nProbe from Luca Deri (ntop creator). NetFlow records are sent out of the virtual environment, across the physical network and into a NetFlow collector. This approach works extremely well as NetFlow accounting is very light weight and has a low impact on disk I/O and CPU within the Virtual Server...

NetFlow Again Saves The Day

So as you can see NetFlow telemetry is a powerful tool for reclaiming control over troublesome network environments.

For more information on the use of NetFlow in such situations, feel free to contact me offline at: apowers@lancope.com

The Adam Powers Lancope NetFlow Blog Series:

Part One

Adam Powers CTO of Lancope: Top 5 uses of NetFlow


What are your network blind spots?

Contact Brad Reese
http://www.BradReese.Com

Search 31,427 Cisco Job Openings

Post Cisco Network Engineer Jobs

View 1,595 items of Refurbished Cisco

Examine CCIE Resumes

Consider 697 Cisco Certified
Network Engineer Resumes

  
Brad's Favorite Top 5 Picks
# 1. Is Cisco the Madonna of networking?
# 2. Cisco CEO John Chambers personally suffers $208M paper loss
# 3. Credit crunch and the proposed shameless corporate welfare bailout: How is it affecting IT spending?
# 4. CCIE water cooler gossip: CCIE number is now up to 22070
# 5. Cisco and the Forbes 400 richest people in America
Brad Reese on Cisco Story Archives Brad Reese on Cisco Story Archives

Cisco Resumes

Cisco Network Engineer Contractors Available For Hire

2008 Cisco Salary Rates

Cisco Jobs

  
About Brad Reese on Cisco

Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable Cisco networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.

Don't be shy, contact Brad Reese online or call him at 646-827-1130.

 

Most Discussed Posts

On The Web
Twitter