This is part 2 of a 3 part series. Part 1 can be found here. In the second NetFlow lab we did a HTTP Comparison using my web browser and going to a common web site. I wanted to see what kind of traffic occured when I visited the front page of llbean.com without clicking on anything. How many packets were transfered and how many flows were created?
Here are the steps I used in the study:
* I started WireShark
* I surfed to www.llbean.com
* I went to another web site
* I stopped WireShark
* 2 Ingress Flows represents 11 packets going out from my PC
* 1 Ingress Flow represents 13 packets coming back from llbean.com
Flows from my PC
First I looked at the traffic from my PC. The NetFlow received from the Cisco router was displayed with Scrutinizer NetFlow, sFlow and IPFIX Analyzer. It displayed 11 packets and two flows from my PC. Why are there two flows? You’ll need a packet trace to figure this out. Click on the image below to enlarge.
Since the data went through our NetFlow capable switch ‘Enterasys’, I decided to take a look at the NetFlow data there as well with our NetFlow collector. It still displayed 11 packets, but the octetDeltaCount was a bit higher as Enterasys counts things a bit differently.
Flows from llbean.com
Second, I looked at the traffic from llbean.com. There was only 1 NetFlow datagram received, but since it was sending all of the content from the web site, the octetDeltaCount was over 5 times greater (12466) in the screen shot below. It is the number next to the packetDeltaCount.
Lets take a look at the packet trace in Wireshark and compare it to the data that we see above from our NetFlow Analyzer.
Below you can see that the packet trace also revealed 13 packets from llbean.com. Notice the big red arrow pointing at the domain.
A packet trace gives you the actual URL, traditional NetFlow does not export this. However, I am seeing URLs exported from some up and coming hardware vendors supporting IPFIX.
This concluded the lab on HTTP – NetFlow reporting. Now we are onto part 3 of this series.