This tell-all flow encyclopedia explains in detail how flow technologies are affecting businesses and improving the way IT organizations around the world are able to more easily manage huge amounts of information more easily, more quickly, and with more knowledge into the transactions using the network infrastructure. Using nearly 150 color illustrations, the book covers what has been accomplished to date with flow technologies such as NetFlow, sFlow, and IPFIX. It includes examples from different vendors and clearly outlines where this message export is going in the next 5 years.
At the first level, this book will satisfy those managers, professionals, and engineers who need conceptual and practical answers to the questions:
• What are NetFlow and IPFIX (IP Flow Information eXport)?
• How do they work? Where do they fit in the world of network troubleshooting and traffic monitoring?
• Why do we need or not need them?
This level is a refresher to moderately experienced NetFlow-aware IT professionals. It dissipates the fog of acronyms and special terminology that seems especially dense in the vicinity of NetFlow, including Flexible NetFlow, AppFlow, J-Flow, NetStream, and sFlow. The book also includes information about some of the many new performance and security applications emerging from Cisco, SonicWALL, Palo Alto, Plixer, and other vendors. Additionally, it explains what these new technologies are for, and whether they are really needed.
At the second level, this book spends little time deciphering and comparing NetFlow v1, v5, v6, v7, v8, v9 formats to one another or even to IPFIX. There is plenty of documentation on the Internet that covers this topic and frankly, a chapter on this subject is not in-line with the goal of this book.
It is assumed that the reader has had some exposure to NetFlow and how to configure traditional NetFlow v5 and v9. This book, therefore, is intended to open the eyes of IT professionals to what is possible with NetFlow v9 (Flexible NetFlow) and IPFIX, how to properly implement them (and avoid the pitfalls), and why these flow exports can allow businesses to be far more competitive. As of the date of this book’s publication, these are considered to be the most cutting-edge flow technologies.
Performance issues are discussed as well as how the right hardware can dramatically improve exporting, collection, reporting, and threat detection speeds. Basic guidelines are provided on where these technologies should be deployed, along with practical reasons why certain technologies can bring value to business applications. The troubleshooting potential of these technologies is also explored.
At the third and final level, some sections are more technical and can be skipped by some readers without missing out on important concepts. These clearly indicated paragraphs are meant to help product managers and software engineers understand concepts such as how flow templates should be implemented, when metadata and option templates are useful, and how to structure them to ensure speedy reporting. Suggestions on the creation of new elements and the reuse of existing IDs are also outlined. Examples are given on the pitfalls to avoid, but again, these technical sections can easily be skipped without diminishing the value of this book.
CHAPTER 1: What is NetFlow 13
CHAPTER 2: Exporting NetFlow or IPFIX 23
CHAPTER 3: Collecting Flows 58
CHAPTER 4: Reporting on Flows 74
CHAPTER 5: Detecting and Mitigating Threats 111
CHAPTER 6: Troubleshooting and Examining Flow Data 137
“As the IPFIX (based on cisco’s NetFlow v9) data export standard becomes well adopted across the networking industry, the experiences of Plixer and Mike Patterson become highly relevant for network operators, vendors but also other IPFIX/NetFlow management systems. ‘Unleashing the Power of NetFlow and IPFIX’ provides a basic background on the technology, the bleeding edge of where it is today, but most importantly provides the implementer’s experiences that are missing from the specifications.
Michael Patterson has loaded the book up with clearly written examples of what is possible with NetFlow and IPFIX. Flow technology is spreading beyond basic packet counting on routers into virtual environments, threat detection, data inspection but also application analysis as well. With the increasing demand to gain greater network traffic insight on elements such as jitter, packet loss and URLs, the volume of Flow exports is exploding. Because of this, scalability is a concern and the content in these pages explores important aspects of NetFlow export and processing such as distributed collection, flow deduplication and stitching. If you are a developer or a product manager, leverage this book as an implementation guide. Its contents are designed to help with perspective on what you may want to achieve, the exports that match your goals and how to go about achieving them. The next step of course is figuring out how to best implement NetFlow and IPFIX, the problems to avoid and how to take your exports to the next level to stay competitive.
For the last 6 years I have been working with cisco’s NetFlow engineering team, customers as well as many network management system vendors. I have had the pleasure of working with the Plixer team in my various roles at cisco and this book further reinforces by belief that Plixer is one of the industry’s premier thought leaders. It is clear to me that Michael and the team at Plixer are passionate when it comes to anything NetFlow and IPFIX related. This is a company that is on the bleeding edge of NetFlow/IPFIX."
Technical Leader & Architect for Network Management Solutions
100% of all proceeds after publication and shipping costs are donated to Grahamtastic Connection.
"We thank the Grahamtastic Connection for the support they have given to children during prolonged hospitalization. Although thousands of charities need donations, this organizations mission seems to tug the most at my heart. Please send a donation and a prayer to these children.”
Michael Patterson, NetFlow Knight: CEO, Plixer
Become a NetFlow Knight™
A NetFlow Knight™ is an individual who believes that flow technology is one of the ideal technologies available today for gaining deeper insight into IT related issues. They demonstrate chivalry by fatefully serving their family, community, company and set good examples in leadership and character.
At Plixer, our NetFlow Knights serve our customers and promote the technology in our blog and Advanced NetFlow Training class.