In order to demonstrate j-Flow v8 configuration on a Juniper device, we will replace the router Exporter (Cisco IOS router with the hostname IOS-1) with an vSRX security device (Picture 8). j-Flow Version 8 Configuration on Juniper vSRX įirstly, we will remove flow monitor from interface Gi0/1. The reduction in the number of packets that are analyzed by the flow monitor causes a corresponding reduction in the accuracy of the information stored in the flow monitor cache. When you apply a sampler to a flow monitor, the overhead load on the router of running the flow monitor is reduced because the number of packets that the flow monitor must analyze is reduced. Picture 6: Captured NetFlow v9 Packet 1.6 Configure Flexible NetFlow Flow Sampling on Cisco IOS The host with the spoofed IP address 23.67.156.61 sent a packet with destination TCP port 22 to the host 172.16.2.1. The structure of flow 1 is depicted in the picture. The FlowSet2 inside the NetFlow protocol structure contains 45 flows.

Picture 6 depicts one of the many captured NetFlow packets that were exported as UDP segments from the flow exporter (192.168.3.1) to the flow collector (192.168.3.2), destination UDP 2055 during the DDoS attacks. The upper layer protocol is TCP (6) which gives the packet size 160Bytes (the payload set by the attacker is 120B + 20B IPv4 header + 20B TCP header. The report confirms that PC2 (172.16.2.1), destination TCP port 22 (SSH) is flooded with many single packets from spoofed source IPv4 addresses. Network administrators can use a network traffic analysis tool or the stored_records.pdf report in the process of further investigation of a DDoS attack. IOS-1# show flow monitor NETFLOW-MONITOR cache format csv | tee flash0:stored_records.csv The following is a set of commands that are issued on a Cisco router to enable Flexible NetFlow on the GigabitEthernet 0/1 interface and export to the NetFlow collector with IP address 192.168.3.2 on UDP port 2055. Flexible NetFlow is comprised of 3 components: Picture 1: Network Topology with Cisco IOS Flexible Netflow Exporterįlexible NetFlow allows the user to configure and customize the exported information using NetFlow version 9. The Exporter router is the Cisco router running IOS 5.6(2)T configured to collect and export NetFlow records to the Linux host – Collector (192.168.3.2). They advertise the subnet 172.16.x.0/24 configured on the intevrface GigabitEthernet0/0. The BGP-1 and BGP-2 network devices are Cisco routers running Cisco IOS 15.6(2)T and are eBGP neighbors. Flexible NetFlow Configuration on Cisco DevicesĪ network topology is depicted in Picture 1. This post however, is more practical and provides the basic configuration steps for the deployment of Cisco Flexible NetFlow and Juniper j-Flow v8. Another blog post discusses the purpose, limitations, accuracy and the overhead of flow sampling. The post also explains differences across different vendor implementations of NetFlow, such as NetFlow, sFlow, IPFIX and NetStream.

One of our recent blog posts dedicated to NetFlow technology provides the necessary knowledge needed to understand NetFlow principles and what it is used for.

Ntp flood with hping3