1. POSTECH DP&NM Lab Detailed Design Document NetFlow Generator 2003. 11. 17. 정승화 DPNM Lab. in Postech.

2. POSTECH DP&NM Lab. 2 Contents Introduction & Goal Architectural Design Processes Initialization Process NetFlow Generating Process NetFlow Exporting Process Data Formats IP Packet Format NetFlow Format MySQL Table Field Overall Architecture Configuration Testing

3. POSTECH DP&NM Lab. 3 Introduction Monitoring Network Packets Flows CISCO Router  NetFlow InMon  sFlow Goal Free (or Cheap) Generating NetFlow

4. POSTECH DP&NM Lab. 4 Architecture (1/2) Capturing all Packets Passively for each interface. (Using Libpcap) Compared Packet Header information to put Buffer. Buffer gather Packets and Extracting NetFlow Info. Capture Packet Analysis Buffer Packet Comparing Comparing with another Captured Packet Header information to check Interface.

5. POSTECH DP&NM Lab. 5 Architecture (2/2) Buffer Export Two buffers are switched by Configured Time Interval. Exporting Flow Info. in NetFlow (V.5) Format to configured Analyzer IP & Port on every configured time interval. Analyzer

6. POSTECH DP&NM Lab. 6 Initialization Process Getting Configuration Packet Pool Initialization Buffer Initialization Export Thread Start Timer Start Capture Thread Start

7. POSTECH DP&NM Lab. 7 NetFlow Generating Process Receiving Captured Packets Checking Ethernet Type Ethernet Type: IP Buffer Insertion Repeat Checking Interface Interface: OK

8. POSTECH DP&NM Lab. 8 NetFlow Exporting Process Repeat Exporting NetFlow Resetting Buffer Switching Buffer Repeating above process every configured time interval Buffer

9. POSTECH DP&NM Lab. 9 Packet Header Format Timestamp Source Address Destination Address Source PortDestination Port Packet SizeEther Type IP IdentificationIP Offset ProtocolToSTCP flagUnused (zero) Input InterfaceOut Interface 0 8 16 24 31

10. POSTECH DP&NM Lab. 10 NetFlow Format NetFlow V.5 Header Flow Record Flow Record Flow Record Flow Record Flow Record UDP message format transmitted from traffic meter NetFlow VersionFlow Record Count (1-30) SysUptime of the export device booted Current count of seconds since 0000 UTC 1970 Residual nanoseconds since 0000 UTC 1970 Sequence counter of total flows seen engine_typeengine_idUnused (zero) Format of NetFlow V.5 Header 0 8 16 24 31

11. POSTECH DP&NM Lab. 11 NetFlow Format Source IP address Destination IP address IP address of next hop router Input InterfaceOutput Interface Packets in the flow Bytes in the packets of the flow SysUptime at start of flow SysUptime at the last packet of the flow was received Source PortDestination Port Unused (zero)TCP flagIP protocol typeToS Source ASDestination AS Src. MaskDst. MaskUnused (zero) 0 8 16 24 31

12. POSTECH DP&NM Lab. 12 MySQL Table Field First Timestamp:int(4) unsigned Last Timestamp:int(4) unsigned Source Address:char(20) Destination Address:char(20) Source Port:int(2) unsigned Destination Port:int(2) unsigned Packets:int(10) unsigned Bytes:int(10) unsigned Protocol:int(1) unsigned

13. POSTECH DP&NM Lab. 13 Overall Architecture Control Signal Data Flow Packet Analysis (Buffer Insert) Buffer [0] [Hash]Buffer [1] [Hash] Export Packet (Sending UDP) Time Handler (Switching Buffers) Packet Comparing Capture Packet

14. POSTECH DP&NM Lab. 14 Capturing Interface Exporting Time Interval Analyzer IP Analyzer Port MySQL Info. Sampling Rate Configuration Export Module gets below configure Info. when it starts. We can have export module to each interface separately by changing this option. This exporting time interval unit is assumed to be 10 sec at least. Export Module will send NetFlow Info. to this IP address & Port MySQL Information to use NetFlow Info.

15. POSTECH DP&NM Lab. 15 Configuration (Detail)

16. POSTECH DP&NM Lab. 16 Traffic Meter Testing UDP NMS Testing NetFlow Generator Testing NetFlow Receiving Server by fdget Program CISCO developed a tool named fdget for viewing the data exported from a NetFlow router.