NetFlow for Cybersecurity

NetFlow Versions

There are several versions of NetFlow. Table 4-3 lists all versions of NetFlow and provides a brief description of the features supported.

Table 4-3 NetFlow Versions

Table 4-4 lists the NetFlow v1 flow header format, and Table 4-5 lists the attributes of the NetFlow v1 flow record format.

Table 4-4 NetFlow v1 Flow Header Format

Table 4-5 NetFlow v1 Flow Record Format

Table 4-6 lists the NetFlow v5 flow header format, and Table 4-7 lists the attributes of the NetFlow v5 flow record format.

Table 4-6 NetFlow v5 Flow Header Format

Table 4-7 NetFlow v5 Flow Record Format

Table 4-8 lists the NetFlow v7 flow header format, and Table 4-9 lists the attributes of the NetFlow v7 flow record format.

Table 4-8 NetFlow v7 Flow Header Format

Table 4-9 NetFlow v7 Flow Record Format

The most popular version of NetFlow is Version 9. The NetFlow v9 format is template based. Templates provide a flexible design to the record format. This feature allows for future enhancements to NetFlow services without requiring fundamental changes to the underlying flow record format.

The following are the benefits of using NetFlow templates:

• They provide vendor-neutral support for companies that create applications that provide collector or analysis capabilities for NetFlow so that they are not required to reinvent their product each time a new NetFlow feature is added.

• New features can be added to NetFlow more quickly, without breaking current implementations and with backward compatibility.

The NetFlow v9 record format consists of a packet header followed by at least one or more template or data FlowSets. A template FlowSet provides a description of the fields that will be present in future data FlowSets. These data FlowSets may occur later within the same export packet or in subsequent export packets. Figure 4-2 shows a basic illustration of the NetFlow v9 export packet.

Figure 4-2 NetFlow v9 Export Packet

Figure 4-3 shows a more detailed illustration of the NetFlow v9 export packet and the relationship between each field and its attributes.

Figure 4-3 NetFlow v9 Export Packet Details

The format of the NetFlow v9 packet header is very similar to its predecessors and is illustrated in Figure 4-4.

Figure 4-4 NetFlow v9 Packet Header Format

Table 4-10 lists the NetFlow v9 packet header field descriptions.

Table 4-10 NetFlow v9 Packet Header Field Descriptions

As previously mentioned, templates are one of the main benefits of NetFlow v9 because they provide flexibility to allow a NetFlow collector or display application to process NetFlow data without necessarily knowing the format of the data in advance.

Figure 4-5 shows the format of the NetFlow v9 template FlowSet.

Figure 4-5 NetFlow v9 Template FlowSet Format

Table 4-11 lists the NetFlow v9 template FlowSet field descriptions.

Table 4-11 NetFlow v9 Template FlowSet Field Descriptions

Table 4-12 lists the NetFlow v9 field type definitions.

Table 4-12 NetFlow v9 Field Type Definitions

Figure 4-6 shows the NetFlow v9 template FlowSet format.

Figure 4-6 NetFlow v9 Template FlowSet Format

Table 4-13 lists the NetFlow v9 data FlowSet definitions.

Table 4-13 NetFlow v9 Data FlowSet Definitions

IPFIX is modeled after NetFlow v9. This is why many of these NetFlow v9 concepts and fields are very similar to IPFIX. Just like IPFIX, NetFlow v9 has the concept of options templates used to supply metadata about the NetFlow process itself. Figure 4-7 illustrates the format of the options template.

Figure 4-7 NetFlow v9 Options Template Format

Table 4-14 lists the NetFlow v9 data options template definitions.

Table 4-14 NetFlow v9 Data Options Template Definitions

Cisco Flexible NetFlow

Flexible NetFlow provides enhanced optimization of the network infrastructure, reduces costs, and improves capacity planning and security detection beyond other flow-based technologies available today. Flexible NetFlow supports IPv6 and Network-Based Application Recognition (NBAR) 2 for IPv6 starting in Cisco IOS Software Version 15.2(1)T. It also supports IPv6 transition techniques (IPv6 inside IPv4). Flexible NetFlow can detect the following tunneling technologies that give full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but that have no direct native connection to an IPv6 network:

• Teredo

• Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)

• 6to4

• 6rd

Flexible NetFlow classification inside Teredo, ISATAP, 6to4, and 6rd was introduced in Cisco IOS Software Version 15.2(2)T. Export over IPv6 was introduced in Cisco IOS Software Version 15.2(2)T, Cisco IOS XE 3.7.0S, and Cisco Nexus Software Version 4.2.1.

Flexible NetFlow tracks different applications simultaneously. For instance, security monitoring, traffic analysis, and billing can be tracked separately, and the information customized per application.

Flexible NetFlow allows the network administrator or security professional to create multiple flow caches or information databases to track. Conventionally, NetFlow has a single cache and all applications use the same cache information. Flexible NetFlow supports the collection of specific security information in one flow cache and traffic analysis in another. Subsequently, each NetFlow cache serves a different purpose. For instance, multicast and security information can be tracked separately and the results sent to two different collectors. Figure 4-8 shows the Flexible NetFlow model and how three different monitors are used. Monitor 1 exports Flexible NetFlow data to “Exporter 1.” Monitor 2 exports Flexible NetFlow data to “Exporter 2,” and Monitor 3 exports Flexible NetFlow data to “Exporter 1” and “Exporter 3.”

Figure 4-8 The Flexible NetFlow Model

The following are the Flexible NetFlow components:

• Records

• Flow monitors

• Flow exporters

• Flow samplers

In Flexible NetFlow, the administrator can specify what to track, resulting in fewer flows. This helps to scale in busy networks and use fewer resources that are already taxed by other features and services.

Flexible NetFlow Records

Flexible NetFlow records are a combination of key and non-key fields. In Flexible NetFlow, records are appointed to flow monitors to define the cache that is used for storing flow data. There are seven default attributes in the IP packet identity, or “key fields,” for a flow and for a device to determine whether the packet information is unique or similar to other packets sent over the network. Fields such as TCP flags, subnet masks, packets, and number of bytes are “non-key fields.” However, they are often collected and exported in NetFlow or in IPFIX.

Flexible NetFlow Key Fields

There are several Flexible NetFlow key fields in each packet that is forwarded within a NetFlow-enabled device. The device looks for a set of IP packet attributes for the flow and determines whether the packet information is unique or similar to other packets. In Flexible NetFlow, key fields are configurable, which enables the administrator to conduct a more granular traffic analysis.

Table 4-15 lists the key fields related to the actual flow, device interface, and Layer 2 services.

Table 4-15 Flexible NetFlow Key Fields Related to Flow, Interface, and Layer 2

Table 4-16 lists the IPv4- and IPv6-related key fields.

Table 4-16 Flexible NetFlow IPv4 and IPv6 Key Fields

Table 4-17 lists the Layer 3 routing protocol–related key fields.

Table 4-17 Flexible NetFlow Layer 3 Routing Protocol Key Fields

Table 4-18 lists the transport-related key fields.

Table 4-18 Flexible NetFlow Transport Key Fields

Only the Application ID is a Layer 3 routing protocol key field.

Table 4-19 lists the multicast-related key fields.

Table 4-19 Flexible NetFlow Multicast Key Fields

Flexible NetFlow Non-Key Fields

There are several non-key Flexible NetFlow fields. Table 4-20 lists the non-key fields that are related to counters, such as byte counts, number of packets, and more. A network administrator can use non-key fields for different purposes. For instance, the number of packets and amount of data (bytes) can be used for capacity planning and also to identify denial-of-service (DoS) attacks as well as other anomalies in the network.

Table 4-20 Flexible NetFlow Counters Non-Key Fields

Table 4-21 lists the timestamp-related non-key fields.

Table 4-21 Flexible NetFlow Timestamp Non-Key Fields

Table 4-22 lists the IPv4-only non-key fields.

Table 4-22 Flexible NetFlow IPv4-Only Non-Key Fields

Table 4-23 lists the IPv4 and IPv6 non-key fields.

Table 4-23 Flexible NetFlow IPv4 and IPv6 Non-Key Fields

NetFlow Predefined Records

Flexible NetFlow includes several predefined records that can help an administrator and security professional start deploying NetFlow within their organization. Alternatively, they can create their own customized records for more granular analysis. As Cisco evolves Flexible NetFlow, many popular user-defined flow records could be made available as predefined records to make them easier to implement.

The predefined records guarantee backward compatibility with legacy NetFlow collectors. Predefined records have a unique blend of key and non-key fields that allows the network administrator and security professional to monitor different types of traffic in their environment without any customization.

User-Defined Records

As the name indicates, Flexible NetFlow gives the network administrator and security professional the flexibility to create their own records (user-defined records) by specifying key and non-key fields to customize the data collection. The values in non-key fields are added to flows to provide additional information about the traffic in the flows. A change in the value of a non-key field does not create a new flow. In most cases, the values for non-key fields are taken from only the first packet in the flow. Flexible NetFlow enables you to capture counter values such as the number of bytes and packets in a flow as non-key fields.

Flexible NetFlow adds a new NetFlow v9 export format field type for the header and packet section types. A device configured for Flexible NetFlow communicates to the collector the configured section sizes in the corresponding NetFlow v9 export template fields.

Flow Monitors

In Flexible NetFlow, flow monitors are applied to the network device interfaces to perform network traffic monitoring. Flow data is collected from the network traffic and added to the flow monitor cache during the monitoring process based on the key and non-key fields in the flow record.

Flow Exporters

The entities that export the data in the flow monitor cache to a remote system are called flow exporters. Flow exporters are configured as separate entities and are assigned to flow monitors. An administrator can create several flow exporters and assign them to one or more flow monitors. A flow exporter includes the destination address of the reporting server, the type of transport (UDP or SCTP), and the export format corresponding of the NetFlow version or IPFIX.

Flow Samplers

Flow samplers are created as separate components in a router’s configuration. Flow samplers are used to reduce the load on the device that is running Flexible NetFlow by limiting the number of packets that are selected for analysis.

Flow sampling exchanges monitoring accuracy for router performance. When you apply a sampler to a flow monitor, the overhead load on the router due to running the flow monitor is reduced because the number of packets that the flow monitor must analyze is reduced. The reduction in the number of packets that are analyzed by the flow monitor causes a corresponding reduction in the accuracy of the information stored in the flow monitor’s cache.

Flexible NetFlow Configuration

The following sections provide step-by-step configuration guidance on how to enable and configure Flexible NetFlow in a Cisco IOS device. Figure 4-9 shows the configuration steps in a sequential graphical representation.

Figure 4-9 Flexible NetFlow Configuration Steps

The configuration steps, which are described in detail in the corresponding sections, are as follows:

• Step 1. Configure a flow record

• Step 2. Configure a flow monitor

• Step 3. Configure a flow exporter for the flow monitor

• Step 4. Apply the flow monitor to an interface

The topology shown in Figure 4-10 is used in the following examples.

Figure 4-10 Flexible NetFlow Configuration Example Topology

This figure shows a Cisco ASR 1004 at the New York headquarters that is configured for Flexible NetFlow. The outside network is 209.165.200.224/29, and the inside network is 209.165.200.232/29.

Configure a Flow Record

The following are the steps required to configure a customized flow record.

• Step 1. Log in to your router and enter into enable mode with the enable command:

  NY-ASR1004>enable

• Step 2. Enter into configuration mode with the configure terminal command:

  NY-ASR1004#configure terminal
  Enter configuration commands, one per line. End with CNTL/Z.

• Step 3. Create a flow record with the flow record command. In this example, the record name is NY-ASR-FLOW-RECORD-1. After you’ve entered the flow record command, the router enters flow record configuration mode. You can also use the flow record command to edit an existing flow record:

  NY-ASR1004(config)#flow record NY-ASR-FLOW-RECORD-1

• Step 4. (Optional.) Enter a description for the new flow record:

  NY-ASR1004(config-flow-record)#description FLOW RECORD 1 for basic traf
  fic analysis

• Step 5. Configure a key field for the flow record using the match command. In this example, the IPv4 destination address is configured as a key field for the record:

  NY-ASR1004(config-flow-record)#match ipv4 destination address

  The output of the match ? command shows all the primary options for the key field categories that you learned earlier in this chapter:

  NY-ASR1004(config-flow-record)#match ?
    application  Application fields
    flow         Flow identifying fields
    interface    Interface fields
    ipv4         IPv4 fields
    ipv6         IPv6 fields
    routing      Routing attributes
    transport    Transport layer fields

• Step 6. Configure a non-key field with the collect command. In this example, the input interface is configured as a non-key field for the record:

  NY-ASR1004(config-flow-record)#collect interface input

  The output of the collect ? command shows all the options for the non-key field categories that you learned earlier in this chapter:

  NY-ASR1004(config-flow-record)#collect ?
    application  Application fields
    counter      Counter fields
    flow         Flow identifying fields
    interface    Interface fields
    ipv4         IPv4 fields
    ipv6         IPv6 fields
    routing      Routing attributes
    timestamp    Timestamp fields
    transport    Transport layer fields

• Step 7. Exit configuration mode with the end command and return to privileged EXEC mode:

  NY-ASR1004(config-flow-record)#end

You can use the show flow record command to show the status and fields for the flow record. If multiple flow records are configured in the router, you can use the show flow record name command to show the output of a specific flow record, as shown in Example 4-1.

Example 4-1 Output of the show flow record Command

NY-ASR1004#/>show flow record NY-ASR-FLOW-RECORD-1/>
flow record NY-ASR-FLOW-RECORD-1:
  Description:        Used for basic traffic analysis
  No. of users:       0
  Total field space:  8 bytes
  Fields:
    match ipv4 destination address
    collect interface input

Use the show running-config flow record command to show the flow record configuration in the running configuration, as shown in Example 4-2.

Example 4-2 Output of the show running-config flow record Command

NY-ASR1004#show running-config flow record
Current configuration:
!
flow record NY-ASR-FLOW-RECORD-1
 description Used for basic traffic analysis
 match ipv4 destination address
 collect interface input
!

Configuring a Flow Monitor for IPv4 or IPv6

The following are the steps required to configure a flow monitor for IPv4 or IPv6 implementations. In the following examples, a flow monitor is configured for the previously configured flow record.

• Step 1. Log in to your router and enter into enable mode with the enable command:

  NY-ASR1004>enable

• Step 2. Enter into configuration mode with the configure terminal command:

  NY-ASR1004#configure terminal
  Enter configuration commands, one per line.  End with CNTL/Z.

• Step 3. Create a flow monitor with the flow monitor command. In this example, the flow monitor is called NY-ASR-FLOW-MON-1:

  NY-ASR1004(config)#flow monitor NY-ASR-FLOW-MON-1

• Step 4. (Optional.) Enter a description for the new flow monitor:

  NY-ASR1004(config-flow-monitor)#description monitor for IPv4 traffic in
  NY

• Step 5. Identify the record for the flow monitor:

  NY-ASR1004(config-flow-monitor)#record netflow NY-ASR-FLOW-RECORD-1

• In the following example, the record ? command is used to see all the flow monitor record options:

  NY-ASR1004(config-flow-monitor)#record ?
    NY-ASR-FLOW-RECORD-1  Used for basic traffic analysis
    netflow               Traditional NetFlow collection schemes
    netflow-original      Traditional IPv4 input NetFlow with origin ASs

• Step 6. Exit configuration mode with the end command and return to privileged EXEC mode:

  NY-ASR1004(config-flow-record)#end

You can use the show flow monitor command to show the status and configured parameters for the flow monitor, as shown in Example 4-3.

Example 4-3 Output of the show flow monitor Command

NY-ASR1004#/>show flow monitor/>
Flow Monitor NY-ASR-FLOW-MON-1:
  Description:       monitor for IPv4 traffic in NY
  Flow Record:       NY-ASR-FLOW-RECORD-1
  Cache:
    Type:              normal (Platform cache)
    Status:            not allocated
    Size:              200000 entries
    Inactive Timeout:  15 secs
    Active Timeout:    1800 secs
    Update Timeout:    1800 secs

Use the show running-config flow monitor command to display the flow monitor configuration in the running configuration, as shown in Example 4-4.

Example 4-4 Output of the show running-config flow monitor Command

NY-ASR1004#/>show running-config flow monitor/>
Current configuration:
!
flow monitor NY-ASR-FLOW-MON-1
 description monitor for IPv4 traffic in NY
 record NY-ASR-FLOW-RECORD-1
 cache entries 200000

Configuring a Flow Exporter for the Flow Monitor

Complete the following steps to configure a flow exporter for the flow monitor in order to export the data that is collected by NetFlow to a remote system for further analysis and storage. This is an optional step. IPv4 and IPv6 are supported for flow exporters.

• Step 1. Log in to the router and enter into enable and configuration modes, as you learned in previous steps.

• Step 2. Create a flow exporter with the flow exporter command. In this example, the exporter name is NY-EXPORTER-1:

  NY-ASR1004(config)#flow exporter NY-EXPORTER-1

• Step 3. (Optional.) Enter a description for the exporter:

  NY-ASR1004(config-flow-exporter)#description exports to New York Collector

• Step 4. Configure the export protocol using the export-protocol command. In this example, NetFlow v9 is used. You can also configure legacy NetFlow v5 with the netflow-v5 keyword or IPFIX with the ipfix keyword. IPFIX support was added in Cisco IOS Software Release 15.2(4)M and Cisco IOS XE Release 3.7S:

  NY-ASR1004(config-flow-exporter)#export-protocol netflow-v9

• Step 5. Enter the IP address of the destination host with the destination command. In this example, the destination host is 10.10.10.123:

  NY-ASR1004(config-flow-exporter)#destination 10.10.10.123

• Step 6. You can configure the UDP port used by the flow exporter with the transport udp command. The default is UDP port 9995.

• Step 7. Exit the Flexible NetFlow flow monitor configuration mode with the exit command and specify the name of the exporter in the flow monitor:

  NY-ASR1004(config)#flow monitor NY-ASR-FLOW-MON-1
  NY-ASR1004(config-flow-monitor)#exporter NY-EXPORTER-1

You can use the show flow exporter command to view the configured options for the Flexible NetFlow exporter, as demonstrated in Example 4-5.

Example 4-5 Output of the show flow exporter Command

NY-ASR1004#/>show flow exporter/>
Flow Exporter NY-EXPORTER-1:
  Description:              exports to New York Collector
  Export protocol:          NetFlow Version 9
  Transport Configuration:
    Destination IP address: 10.10.10.123
    Source IP address:      209.165.200.225
    Transport Protocol:     UDP
    Destination Port:       9995
    Source Port:            55939
    DSCP:                   0x0
    TTL:                    255
    Output Features:        Used

You can use the show running-config flow exporter command to view the flow exporter configuration in the command line interface (CLI), as demonstrated in Example 4-6.

Example 4-6 Output of the show running-config flow exporter Command

NY-ASR1004# />show running-config flow exporter/>
Current configuration:
!
flow exporter NY-EXPORTER-1
 description exports to New York Collector
 destination 10.10.10.123

You can use the show flow monitor name NY-ASR-FLOW-MON-1 cache format record command to display the status and flow data in the NetFlow cache for the flow monitor, as demonstrated in Example 4-7.

Example 4-7 Output of the show flow monitor name NY-ASR-FLOW-MON-1 cache format record Command

NY-ASR1004#/>show flow monitor name NY-ASR-FLOW-MON-1 cache format record/>
  Cache type:                                 Normal (Platform cache)
  Cache size:                               200000
  Current entries:                            4
  High Watermark:                             4
  Flows added:                              132
  Flows aged:                                42
    - Active timeout   (  3600 secs)          3
    - Inactive timeout (    15 secs)         94
    - Event aged                              0
    - Watermark aged                          0
    - Emergency aged                          0
IPV4 DESTINATION ADDRESS:  10.10.20.5
ipv4 source address:       10.10.10.42
trns source port:          25
trns destination port:     25
counter bytes:             34320
counter packets:           1112
IPV4 DESTINATION ADDRESS:  10.10.1.2
ipv4 source address:       10.10.10.2
trns source port:          20
trns destination port:     20
counter bytes:             3914221
counter packets:           5124
IPV4 DESTINATION ADDRESS:  10.10.10.200
ipv4 source address:       10.20.10.6
trns source port:          32
trns destination port:     3073
counter bytes:             82723
counter packets:           8232

Applying a Flow Monitor to an Interface

A flow monitor must be applied to at least one interface. To apply the flow monitor to an interface, use the ip flow monitor name input command in interface configuration mode, as demonstrated in Example 4-8.

Example 4-8 Applying the Flow Monitor to an Interface

NY-ASR1004(config)#/>interface FastEthernet0/1/1/>
NY-ASR1004(config-if)#/>ip flow monitor NY-ASR-FLOW-MON-1 input/>

In Example 4-8, the flow monitor NY-ASR-FLOW-MON-1 is applied to interface FastEthernet0/1/1. Example 4-9 shows the complete configuration.

Example 4-9 Flexible NetFlow Configuration

flow record NY-ASR-FLOW-RECORD-1
 description used for basic traffic analysis
 match ipv4 destination address
 collect interface input
!
!
flow exporter NY-EXPORTER-1
 description exports to New York Collector
 destination 10.10.10.123
!
!
flow monitor NY-ASR-FLOW-MON-1
 description monitor for IPv4 traffic in NY
 record NY-ASR-FLOW-RECORD-1
 exporter NY-EXPORTER-1
 cache entries 200000
!
interface FastEthernet0/1/1
 ip address 209.165.200.233 255.255.255.248
 ip flow monitor NY-ASR-FLOW-MON-1 input