The packets that traverse the network carry valuable information that can be used to obtain a lot of information. An important parameter that can be monitored is bandwidth utilization and this can include the following associated information:
- Which applications are using the bandwidth
- Which users are generating most of the traffic
- What the peak hours are
Knowing all these details, you can make the right decisions and take proactive measures, including increasing the bandwidth on the network. Traffic analysis also provides information regarding application response times and this can help ensure that the business’s critical applications are performing as expected.
By gathering traffic statistics over a period of time, you can create trends and predict what will happen to the network in the future based on past performance. There are three ways you can perform traffic analysis:
- Gather the packets and perform statistics
- Query the network devices the traffic passes through for network statistics
- Use standalone probes at different points in the network
Dedicated packet analyzers are placed in the traffic path to read every packet that passes through the link to create statistics. These appliances can store either the full data or just the relevant information for statistical purposes (e.g., source, destination, protocol, size, etc.).
Some devices have built-in capabilities to gather traffic statistics using the following protocols:
- SNMP
- RMON
- NetFlow
Once you have the data you can generate a lot of interesting statistics and reports, including:
- Bandwidth utilization reports
- Errors statistics
- Application response times
- TCP/UDP port usage
RMON
Remote network monitoring (RMON) is actually a management information base that allows you to proactively monitor LAN traffic in the network environment. It tracks individual data packets, the number and size of those packets, Broadcast packet tracking, network utilization, errors, and statistics.
RMON agents run on various network devices, such as routers, switches, and servers. If you don’t want to run RMON on those specific devices because of the overhead, you can configure special RMON workstations as probes on specific network segments. RMON offers the possibility to diagnose faults within the LAN and allows network tuning and planning for growth and utilization.
RMON is implemented in two versions: RMON 1 and RMON 2. RMON 1 operates only at the Physical and Data Link Layers, so it must only be used to probe, tune, plan, and look for faults on hubs (at the Physical Layer) and switches (at Layer 2). RMON 2 is the most recent version and it provides much more functionality, as it can be used for Network Layer applications (Layer 3) as well as Layers 4 through 7. Considering this, RMON 2 can monitor database servers, exchange servers, e-mail, and Web traffic.
| Note: RMON is documented in RFC 1757.
|
NetFlow
A better solution to RMON in an enterprise-level environment is to use the NetFlow protocol. NetFlow is a monitoring and measurement technology superior to a simple SNMP/RMON solution in that it provides a lot more detail on the data that passes through a specific interface. NetFlow scales to a large number of interfaces and this makes it a great enterprise and service provider solution.
An IP flow is based on a set of five, and up to seven, IP packet attributes, which may include the following:
- Destination IP address
- Source IP address
- Source port
- Destination port
- Layer 3 protocol type
- Class of Service
- Router or switch interface
NetFlow is also a great solution for service providers because it supports customer service programs and uses popular data warehousing and data mining solutions that are critical for competitive vendor offerings, such as flexible accounting and billing based on application usage, the time of day, bandwidth utilization, and Quality of Service elements. NetFlow is also a great tool for network scalability planning and overall analysis, and it can help lower the organization’s TCO (total cost of ownership).
The NetFlow management architecture consists of three components, which are shown in Figure 24.7 below:
- NetFlow data export service
- NetFlow flow collector service
- NetFlow data analysis service
Figure 24.7 – NetFlow Management Architecture
The NetFlow data export service is at the top of the three-tier NetFlow architecture. This is where the data warehousing and data mining solutions occur and the accounting statistics for traffic on the networking devices are captured. It uses the UDP protocol to export data, which involves a three-part process:
- Data switching
- Data export
- Data aggregation
The data is then exported to the second tier: the NetFlow flow collector service. At this level, using servers and workstations, you can perform data collection, data filtering, aggregation, data storage, and file system management using the existing or third-party file systems.
Network data analysis can be found at the lowest tier (the Access Layer). At this level, you can use network planning tools, overall network analysis tools, and accounting and billing tools, as well as export data to various database systems or Excel spreadsheets.
NetFlow can be used for network traffic accounting, usage-based network billing, network planning, security, Denial of Service (DoS) monitoring capabilities, and network monitoring, in addition to providing information about network users and applications, peak usage times, and traffic routing. All of this makes it a very powerful maintenance, monitoring, and troubleshooting tool.
NetFlow Configuration Example
Three primary steps are required when configuring NetFlow (on a Cisco IOS platform), as follows:
- Configure the interface to capture flows into the NetFlow cache using the ip flow ingress interface configuration command on all interfaces for which you want information to be captured and stored in the flow cache. It is important to remember that NetFlow is configured on a per-interface basis only.
The NetFlow information is then stored on the local router and can be viewed using the show ip cache flow command on the local device. In the event that you want to export data to the NetFlow flow collector, two additional tasks will be required, as follows:
- Configure the Cisco IOS NetFlow version or format that you want to use via the ip flow-export version [1 | 5 | 9] global configuration command. NetFlow version 1 (v1) is the original format supported in the initial NetFlow releases. This version should be used when it is the only NetFlow data export format version that is supported by the application that you are using to analyze the exported NetFlow data. Version 5 exports more fields than version 1 does and is the most widely deployed version. Version 9 is the latest Cisco IOS NetFlow version and is the basis of a new IETF standard. Version 9 is a flexible export format version.
- Configure and specify the IP address of the NetFlow flow collector, and then specify the UDP port that the NetFlow flow collector will use to receive the UDP export from the Cisco device using the ip flow-export destination [hostname | address] <port> [udp] global configuration command. The [udp] keyword is optional and does not need to be specified when using this command because UDP is the default transport protocol used when sending data to the NetFlow flow collector.
The following output illustrates how to enable NetFlow for a specified router interface:
|
Router#config t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface Serial0/0 Router(config-if)#ip flow ingress Router(config-if)#end
|
Following this configuration, the show ip cache flow command can be used to view the statistics collected in the flow cache, as illustrated in the output below:
|
Router#show ip cache flow IP packet size distribution (721 total packets): 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480 .000 .980 .016 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .002 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 278544 bytes 4 active, 4092 inactive, 56 added 1195 ager polls, 0 flow alloc failures Active flows timeout in 30 minutes Inactive flows timeout in 15 seconds IP Sub Flow Cache, 21640 bytes 4 active, 1020 inactive, 56 added, 56 added to flow 0 alloc failures, 0 force free 1 chunk, 1 chunk added last clearing of statistics never Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) ——– Flows /Sec /Flow /Pkt /Sec /Flow /Flow TCP-Telnet 2 0.0 34 40 0.0 10.5 15.7 TCP-WWW 2 0.0 9 93 0.0 0.1 1.5 UDP-NTP 1 0.0 1 76 0.0 0.0 15.4 UDP-other 42 0.0 5 59 0.0 0.0 15.7 ICMP 5 0.0 10 64 0.0 0.0 15.1 Total: 52 0.0 7 58 0.0 0.4 15.1
SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Se0/0 150.1.1.254 Local 10.0.0.1 01 0000 0800 339 Se0/0 10.0.0.2 Local 1.1.1.1 06 C0B3 0017 7 Se0/0 10.0.0.2 Local 10.0.0.1 11 07AF D0F1 1 Se0/0 10.0.0.2 Local 10.0.0.1 11 8000 D0F1 10 Se0/0 150.1.1.254 Local 10.0.0.1 01 0000 0800 271 Se0/0 10.0.0.2 Local 1.1.1.1 06 C0B3 0017 59 |
The following output illustrates how to configure and enable NetFlow data collection for the specified router interfaces, and then export the data to a NetFlow flow collector with the IP address 150.1.1.254 over UDP port 5000 using NetFlow version 5 or the version 5 data format:
|
Router(config)#interface Serial0/0 Router(config-if)#ip flow ingress Router(config-if)#exit Router(config)#interface FastEthernet0/0 Router(config-if)#ip flow ingress Router(config-if)#exit Router(config)#interface Serial0/1 Router(config-if)#exit Router(config)#ip flow-export version 5 Router(config)#ip flow-export destination 150.1.1.254 5000 Router(config)#exit
|
Following this configuration, the information collected can then be viewed using an application reporting tool on the NetFlow flow collector. Despite the export of the data, the show ip cache flow command can still be used to view statistics on the local device, which can be a useful tool when troubleshooting network issues or problem reports.