Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
flow-tools-examples(1)	    General Commands Manual	flow-tools-examples(1)

NAME
       flow-tools-examples -- Example usage of flow-tools.

EXAMPLE	- Configuring Cisco IOS	Router
       NetFlow is configured on	each input interface, then global commands are
       used to specify the export destination.	To ensure a consistant	source
       address address Loopback0 is configured as the export source.

       ip cef distributed
       ip flow-export version 5	origin-as
       ip flow-export destination 10.0.0.100 5004
       ip flow-export source Loopback0

       interface Loopback0
	ip address 10.1.1.1 255.255.255.255

       interface FastEthernet0/1/0
	ip address 10.0.0.1 255.255.255.0
	no ip directed-broadcast
	ip route-cache flow
	ip route-cache distributed

       Many other options exist	such as	aggregated NetFlow and sampled NetFlow
       which are detailed at  (link to URL http://www.cisco.com) .

EXAMPLE	- Configuring Cisco CatIOS Switch
       Some Cisco Catalyst switches support a different	implementation of Net-
       Flow  that  is  performed on the	supervisor.  With the cache based for-
       warding model which is implemented in  the  Catalyst  55xx  with	 Route
       Switch  Module (RSM) and	NetFlow	Feature	Card (NFFC), the RSM processes
       the first flow and the remaining	packets	in the flow are	 forwarded  by
       the  Supervisor.	 This is also implemented in the early versions	of the
       65xx with MSFC.	The deterministic forwarding model used	 in  the  65xx
       with  MSFC2  do	not  use NetFlow to determine the forwarding path, the
       flow cache is only used for statistics as in the	current	IOS  implemen-
       tations.	  In  all  of  of the above configurations flow	exports	arrive
       from both the RSM/MSFC and the Supervisor engines as distinct  streams.
       In  the	worst cast the RSM exports in version 5	and the	Supervisor ex-
       ports in	version	7.  Fortunately	flow-capture and flow-receive can sort
       all  this out by	processing flows from both sources and converting them
       to a common export format.

       The router side running IOS is configured identically  to  the  example
       given above.  The CatIOS	NetFlow	Data Export configuration follows:

       set mls flow full
       set mls nde version 7
       set mls nde 10.0.0.1 9800
       set mls nde enable

       When  the  65xx is running in Native mode, from a users perspective the
       switch is only running IOS.

       More detailed examples can be found on Cisco's web site
	(link to URL http://www.cisco.com) .

EXAMPLE	- Configuring Juniper Router
       Juniper supports	flow exports by	the  routing  engine  sampling	packet
       headers	and  aggregating  them into flows.  Packet sampling is done by
       defining	a firewall filter to accept and	sample all  traffic,  applying
       that  rule  to  the interface, then configuring the sampling forwarding
       option.

       interfaces {
	   ge-0/3/0 {
	       unit 0 {
		   family inet {
		       filter {
			   input all;
			   output all;
		       }
		       address 10.0.0.1/24;
		   }
	       }
	   }

       firewall	{
	   filter all {
	       term all	{
		   then	{
		       sample;
		       accept;
		   }
	       }
	   }
       }

       forwarding-options {
	   sampling {
	       input {
		   family inet {
		       rate 100;
		   }
	       }
	       output {
		   cflowd 10.0.0.100 {
		       port 9800;
		       version 5;
		   }
	       }
	   }
       }

       Other options exist such	as aggregated  flows  which  are  detailed  at
       (link to	URL http://www.juniper.net) .

EXAMPLE	- Network topology and flow.acl
       The network topology and	flow.acl will be used for many of the examples
       that follow.  Flows are collected and stored in /flows/R.

			       ISP-A	   ISP-B
				+	    +
				 +	   +
		   IP=10.1.2.1/24 +	  + IP=10.1.1.1/24
			ifIndex=2  +	 +  ifIndex=1
	      interface=serial1/1   +	+   interface=serial0/0
				    -----
				    | R	| Campus Router
				    -----
				    +	+
		  IP=10.1.4.1/24   +	 +   IP=10.1.3.1/24
		       ifIndex=4  +	  +  ifIndex=3
	   interface=Ethernet1/1 +	   + interface=Ethernet0/0
				+	    +
			      Sales	 Marketing

       ip access-list standard sales permit 10.1.4.0 0.0.0.255
       ip access-list standard not_sales deny 10.1.4.0 0.0.0.255
       ip access-list standard marketing permit	10.1.3.0 0.0.0.255
       ip access-list standard not_marketing deny 10.1.3.0 0.0.0.255
       ip access-list standard campus permit 10.1.4.0 0.0.0.255
       ip access-list standard campus permit 10.1.3.0 0.0.0.255
       ip access-list standard not_campus deny 10.1.4.0	0.0.0.255
       ip access-list standard not_campus deny 10.1.3.0	0.0.0.255
       ip access-list standard evil_hacket permit host 10.6.6.6
       ip access-list standard spoofer permit host 10.9.9.9
       ip access-list standard multicast 224.0.0.0 15.255.255.255

EXAMPLE	- Finding spoofed addresses
       A common	problem	on the Internet	is the	use  of	 "spoofed"  (addresses
       that  are  not  assigned	 to an organization) for use in	DoS attacks or
       compromising servers that rely on the source IP address for authentica-
       tion.

       Display all flow	records	that originate from the	campus and are sent to
       the Internet but	are not	using legal addresses.

       flow-cat	/flows/R | flow-filter -Snot_campus -I1,2 | flow-print

       Summary of the destinations of the internally spoofed addresses	sorted
       by octets.

       flow-cat	/flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f8 -S2

       Summary	of  the	 sources of the	internally spoofed addresses sorted by
       flows.

       flow-cat	/flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f9 -S1

       Summary of the internally spoofed sources and destination pairs	sorted
       by packets.

       flow-cat	/flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f10 -S4

       Display	all  flow  records  that originate external to the campus that
       have campus addresses.  Many times these	can be attackers trying	to ex-
       ploit  host based authentication	mechanisms like	unix r*	commands.  An-
       other common source is mobile clients which  send  packets  with	 their
       campus addresses	before obtaining a valid IP.

       flow-cat	/flows/R | flow-filter -Scampus	-i1,2 |	flow-print

       Summary	of the destinations of the externally spoofed addresses	sorted
       by octets.

       flow-cat	/flows/R | flow-filter -Scampus	-i1,2 |	flow-stat -f8 -S2

EXAMPLE	- Locate hosts using or	running	services
       Find all	SMTP servers active during the collection period that have es-
       tablished connections to	the Internet.  Summarize sorted	by octets.

       flow-cat	/flows/R | flow-filter -I1,2 -P25 | flow-stat -f9 -S2

       Find  all  outbound  NNTP  connections to the Internet.	Summarize with
       source and destination IP sorted	by octets.

       flow-cat	/flows/R | flow-filter -I1,2 -P119 | flow-stat -f10 -S3

       Find all	inbound	NNTP connections  to  the  Internet.   Summarize  with
       source and destination IP sorted	by octets.

       flow-cat	/flows/R | flow-filter -i1,2 -P119 | flow-stat -f10 -S3

EXAMPLE	- Multicast usage
       Summarize Multicast S,G where sources are on campus.

       flow-cat	/flows/R | flow-filter -Dmulticast -I1,2 | flow-stat -f10 -S3

       Summarize Multicast S,G where sources are off campus.

       flow-cat	/flows/R | flow-filter -Dmulticast -i1,2 | flow-stat -f10 -S3

EXAMPLE	- Find scanners
       Find  SMTP  scanners with flow-dscan.  This will	also find SMTP clients
       which try to contact many servers.  This	behavior is characterized by a
       recent Microsoft	worm.

       touch dscan.suppress.src	dscan.suppress.dst
       flow-cat	/flows/R | flow-filter -P25 | flow-dscan -b

AUTHOR
       Mark Fullmer maf@splintered.net

SEE ALSO
       flow-tools(1)

							flow-tools-examples(1)

NAME | EXAMPLE - Configuring Cisco IOS Router | EXAMPLE - Configuring Cisco CatIOS Switch | EXAMPLE - Configuring Juniper Router | EXAMPLE - Network topology and flow.acl | EXAMPLE - Finding spoofed addresses | EXAMPLE - Locate hosts using or running services | EXAMPLE - Multicast usage | EXAMPLE - Find scanners | AUTHOR | SEE ALSO

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=flow-tools-examples&sektion=1&manpath=FreeBSD+12.2-RELEASE+and+Ports>

home | help