User Tools

Site Tools


IPv6 Security Lab - Netflow

Exploring Netflow

Netflow identifies anomalous and security-related network activity by tracking network flows. NetFlow data can be viewed and analysed via the command line interface (CLI), or the data can be exported to a commercial or freeware NetFlow collector for aggregation and analysis. NetFlow collectors, through long-term trending, can provide network behaviour and usage analysis. NetFlow functions by performing analysis on specific attributes within IP packets and creating flows. Version 5 is the most commonly used version of NetFlow, however, version 9 is more extensible and is required to support IPv6. NetFlow flows can be created using sampled traffic data in high-volume environments. Cisco Express Forwarding (CEF) is a prerequisite to enabling NetFlow.

NetFlow can be configured on routers and switches. In older releases of Cisco IOS software, the command to enable NetFlow on an interface was:

ip route-cache flow

In newer releases of Cisco IOS (12.4 onwards), the command has been replaced by:

ip flow {ingress | egress}

The following configuration illustrates the basic configuration of this feature.

ip flow-export destination <ip-address> <udp-port>
ip flow-export version <version>
interface fastethernet 0/0 
 ip flow ingress
 ip flow egress

The following is an example of NetFlow output from the router command line interface. The SrcIf attribute can aid in traceback.

router#show ip cache flow
IP packet size distribution (26662860 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .741 .124 .047 .006 .005 .005 .002 .008 .000 .000 .003 .000 .001 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .001 .007   .039   .000   .000  .000  .000  .000   .000

IP Flow Switching Cache, 4456704 bytes
  55 active, 65481 inactive, 1014683 added
  41000680 ager polls, 0 flow alloc failures
  Active flows timeout in 2 minutes
  Inactive flows timeout in 60 seconds
IP Sub Flow Cache, 336520 bytes
  110 active, 16274 inactive, 2029366 added, 1014683 added to flow
  0 alloc failures, 0 force free
  1 chunk, 15 chunks added
  last clearing of statistics never

Protocol        Total   Flows  Packets  Bytes  Packets Active(Sec) Idle(Sec)
--------        Flows   /Sec    /Flow   /Pkt     /Sec     /Flow     /Flow
TCP-Telnet      11512    0.0      15      42      0.2      33.8      44.8
TCP-FTP          5606    0.0       3      45      0.0      59.5      47.1
TCP-FTPD         1075    0.0      13      52      0.0       1.2      61.1
TCP-WWW         77155    0.0      11     530      1.0      13.9      31.5
TCP-SMTP         8913    0.0       2      43      0.0      74.2      44.4
TCP-X             351    0.0       2      40      0.0       0.0      60.8
TCP-BGP           114    0.0       1      40      0.0       0.0      62.4
TCP-NNTP          120    0.0       1      42      0.0       0.7      61.4
TCP-other      556070    0.6       8     318      6.0       8.2      38.3
UDP-DNS        130909    0.1       2      55      0.3      24.0      53.1
UDP-NTP        116213    0.1       1      75      0.1       5.0      58.6
UDP-TFTP          169    0.0       3      51      0.0      15.3      64.2
UDP-Frag            1    0.0       1    1405      0.0       0.0      86.8
UDP-other       86247    0.1     226      29     24.0      31.4      54.3
ICMP            19989    0.0      37      33      0.9      26.0      53.9
IP-other          193    0.0       1      22      0.0       3.0      78.2
Total:        1014637    1.2      26      99     32.8      13.8      43.9

SrcIf    SrcIPaddress      DstIf    DstIPaddress     Pr    SrcP     DstP   Pkts
Gi0/1     Local   11    CB2B     07A       3
Gi0/1     Gi0/0     06    0016     101F     55 
Gi0/0       Gi0/1   06    101F     0016      9 
Gi0/1     Local   01    0000     0303     11 
Gi0/0       Gi0/1   06    07F1     0016      1

Netflow for IPv4

To get some practice, we will first turn on Netflow for IPv4. The IPv4 command set uses Cisco’s original Netflow configuration. For IPv6 flow information, we can only use Flexible Netflow, and we will try that out in the next section.

Activating Netflow for IPv4

Each Group should turn on Netflow on the border router of their AS. To do this, simply go to the border interface and do something similar to this:

interface fastethernet 0/0
 ip flow ingress
 ip flow egress

Once this has been running for a few minutes, commands like “show ip cache flow” will display output similar to that from the introduction above. To create traffic for Netflow to see, try some ICMPs, traceroutes, and even telnet or ssh to other routers in the lab. This will generate traffic, and the info will persist in Netflow’s cache for a few minutes.

Top talkers in Netflow

Each team should also configure a set of top-talkers, to see what the busiest source and destinations are. Try this configuration:

ip flow-top-talkers
 top 20
 sort-by bytes 

This displays the top 20 talkers, sorting them in descending order of bytes transferred.

Try some of the other CLI options available under the ip flow-top-talkers configurations. There are many match options:

gw(config-flow-top-talkers)# match ?
  byte-range        Match a range of bytes
  class-map         Match a class
  destination       Match destination criteria
  direction         Match direction
  flow-sampler      Match a flow sampler
  input-interface   Match input interface
  nexthop-address   Match next hop
  output-interface  Match output interface
  packet-range      Match a range of packets
  protocol          Match protocol
  source            Match source criteria
  tos               Match TOS 

Try some of these and see what happens to the output.

Netflow for IPv6

Cisco IOS used to support IPv6 with standard Netflow. But this was only briefly the case in IOS 12.3 and 12.4. From 12.4T onwards, IPv6 support in Netflow was replaced by Flexible Netflow for IPv6 (it is also available for IPv4).

Activating Netflow for IPv6

The configuration syntax for Flexible Netflow is somewhat different and a lot more sophisticated. First off we need to create Flow Monitors for our incoming and outgoing Netflow captures. Here is an example

flow monitor FLOW-MONITOR-V6-IN
 cache timeout active 300
 record netflow ipv6 original-input
flow monitor FLOW-MONITOR-V6-OUT
 cache timeout active 300
 record netflow ipv6 original-output

And then we apply these flow monitors to the interface we want to monitor:

interface FastEthernet0/0
 ipv6 flow monitor FLOW-MONITOR-V6-IN input
 ipv6 flow monitor FLOW-MONITOR-V6-OUT output

Top talkers in Flexible Netflow

The top talkers in the Flexible Netflow configuration is somewhat different – there is no need to create a specific stanza to set up the top talkers as the router can simply display the top talkers from the command line. Here is an example

show flow monitor FLOW-MONITOR-V6-OUT cache aggregate \
ipv6 source address ipv6 destination address sort counter \
bytes top 20

This is all one command line and displays the top 20 talkers for outbound traffic, sorting them in descending order of bytes transferred. The command above can be modified to look at the inbound traffic also, by using the inbound flow monitor.


While this exercise has shown how to set up Netflow for both IPv4 and IPv6, it has a more serious aspect. It is possible for a network operator to very simply see what traffic is traversing their network. If it very easy to spot malicious activity, scanning, etc, simply by looking at the flow data and searching for particular signatures (tcp or udp ports, addresses, etc). This makes Netflow a valuable security tool for all network operators, whether they are running an IPv4-only network, or are dual stack IPv4 and IPv6.

Try some of the other CLI options available under the show flow monitor command.

Back to Agenda page

training/sanog32/7-netflow.txt · Last modified: 2018/07/19 22:12 by philip