Acknowledgments |
|
xv | |
Introduction |
|
1 | (8) |
|
Network Administration and Network Management |
|
|
3 | (1) |
|
|
3 | (2) |
|
|
3 | (1) |
|
|
4 | (1) |
|
|
4 | (1) |
|
CiscoWorks, OpenView, and More |
|
|
4 | (1) |
|
Enough Griping: What's the Solution! |
|
|
5 | (1) |
|
Flow-Tools and Its Prerequisites |
|
|
6 | (1) |
|
|
6 | (3) |
|
|
9 | (12) |
|
|
10 | (1) |
|
|
11 | (1) |
|
The History of Network Flow |
|
|
12 | (2) |
|
|
12 | (1) |
|
|
13 | (1) |
|
|
13 | (1) |
|
|
14 | (4) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (2) |
|
|
21 | (20) |
|
|
21 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
|
22 | (2) |
|
|
23 | (1) |
|
|
24 | (1) |
|
From Private Network Segments/DMZs |
|
|
24 | (1) |
|
Implementing the Collector |
|
|
24 | (1) |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
26 | (2) |
|
Starting flow-capture at Boot |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
Collector Troubleshooting |
|
|
29 | (1) |
|
Configuring Hardware Flow Sensors |
|
|
29 | (3) |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
Configuring Software Flow Sensors |
|
|
32 | (2) |
|
Setting Up Sensor Server Hardware |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
34 | (1) |
|
Running the Sensor on the Collector |
|
|
34 | (1) |
|
|
34 | (7) |
|
|
35 | (1) |
|
|
35 | (6) |
|
|
41 | (16) |
|
|
41 | (5) |
|
Printing Protocol and Port Names |
|
|
43 | (1) |
|
Common Protocol and Port Number Assignments |
|
|
44 | (1) |
|
Viewing Flow Record Header Information with -p |
|
|
45 | (1) |
|
Printing to a Wide Terminal |
|
|
45 | (1) |
|
Setting flow-print Formats with -f |
|
|
46 | (4) |
|
Showing Interfaces and Ports in Hex with Format -f 0 |
|
|
46 | (1) |
|
Two Lines with Times, Flags, and Hex Ports Using -f 1 |
|
|
47 | (1) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
49 | (1) |
|
TCP Control Bits and Flow Records |
|
|
50 | (2) |
|
ICMP Types and Codes and Flow Records |
|
|
52 | (5) |
|
|
53 | (1) |
|
|
54 | (3) |
|
|
57 | (24) |
|
|
58 | (3) |
|
|
58 | (2) |
|
Creating a Simple Filter with Conditions and Primitives |
|
|
60 | (1) |
|
|
61 | (1) |
|
|
61 | (9) |
|
Protocol, Port, and Control Bit Primitives |
|
|
61 | (3) |
|
IP Address and Subnet Primitives |
|
|
64 | (1) |
|
Time, Counter, and Double Primitives |
|
|
65 | (2) |
|
Interface and BGP Primitives |
|
|
67 | (3) |
|
|
70 | (5) |
|
Protocols, Ports, and Control Bits |
|
|
70 | (2) |
|
|
72 | (1) |
|
Filtering by Sensor or Exporter |
|
|
72 | (1) |
|
|
73 | (1) |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
75 | (1) |
|
Logical Operators in Filter Definitions |
|
|
76 | (2) |
|
|
76 | (1) |
|
|
77 | (1) |
|
|
78 | (3) |
|
Using Variable-Driven Filters |
|
|
79 | (1) |
|
Defining Your Own Variable-Driven Filters |
|
|
79 | (1) |
|
Creating Your Own Variables |
|
|
80 | (1) |
|
5 Reporting and Follow-Up Analysis |
|
|
81 | (36) |
|
|
82 | (3) |
|
|
83 | (1) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
Modifying the Default Report |
|
|
85 | (3) |
|
Using Variables: Report Type |
|
|
86 | (1) |
|
|
86 | (2) |
|
Analyzing Individual Flows from Reports |
|
|
88 | (1) |
|
Other Report Customizations |
|
|
89 | (3) |
|
|
89 | (1) |
|
Displaying Headers, Hostnames, and Percentages |
|
|
90 | (1) |
|
Presenting Reports in HTML |
|
|
91 | (1) |
|
|
92 | (15) |
|
|
92 | (2) |
|
Network Protocol and Port Reports |
|
|
94 | (2) |
|
|
96 | (1) |
|
|
97 | (2) |
|
Routing, Interfaces, and Next Hops |
|
|
99 | (5) |
|
|
104 | (1) |
|
|
104 | (3) |
|
|
107 | (10) |
|
Custom Report: Reset-Only Flows |
|
|
107 | (3) |
|
More Report Customizations |
|
|
110 | (2) |
|
Customizing Report Appearance |
|
|
112 | (5) |
|
6 Perl, Flowscan, and Cflow.Pm |
|
|
117 | (22) |
|
|
118 | (1) |
|
|
118 | (1) |
|
Install from Operating System Package |
|
|
118 | (1) |
|
|
119 | (1) |
|
Installing from Source with a Big Hammer |
|
|
119 | (1) |
|
flowdumper and Full Flow Information |
|
|
119 | (1) |
|
|
120 | (1) |
|
|
121 | (1) |
|
Installing FlowScan and CUFlow |
|
|
121 | (9) |
|
FlowScan User, Group, and Data Directories |
|
|
122 | (1) |
|
|
123 | (1) |
|
|
123 | (1) |
|
Configuring CUFlow: CUFlow.cf |
|
|
124 | (3) |
|
Rotation Programs and flow-capture |
|
|
127 | (1) |
|
|
128 | (1) |
|
|
128 | (1) |
|
|
129 | (1) |
|
Flow Record Splitting and CUFlow |
|
|
130 | (3) |
|
|
131 | (1) |
|
Scripting Flow Record Splitting |
|
|
132 | (1) |
|
Filtered CUFlow and Directory Setup |
|
|
132 | (1) |
|
|
133 | (6) |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
135 | (2) |
|
|
137 | (1) |
|
|
137 | (1) |
|
|
138 | (1) |
|
|
139 | (18) |
|
FlowTracker and FlowGrapher vs. CUFlow |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
141 | (1) |
|
FlowViewer Installation Process |
|
|
141 | (1) |
|
|
141 | (5) |
|
Directories and Site Paths |
|
|
142 | (2) |
|
|
144 | (1) |
|
|
144 | (1) |
|
Troubleshooting the FlowViewer Suite |
|
|
145 | (1) |
|
|
146 | (4) |
|
Filtering Flows with FlowViewer |
|
|
146 | (1) |
|
|
147 | (2) |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
150 | (2) |
|
|
150 | (1) |
|
|
151 | (1) |
|
|
152 | (4) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
153 | (1) |
|
|
154 | (2) |
|
Interface Names and FlowViewer |
|
|
156 | (1) |
|
8 Ad Hoc Flow Visualization |
|
|
157 | (20) |
|
|
158 | (2) |
|
|
158 | (1) |
|
gnuplot Configuration Files |
|
|
159 | (1) |
|
Time-Series Example: Bandwidth |
|
|
160 | (13) |
|
|
160 | (8) |
|
Unidirectional Bandwidth Reports |
|
|
168 | (2) |
|
Combined Inbound/Outbound Traffic |
|
|
170 | (3) |
|
Automating Graph Production |
|
|
173 | (2) |
|
|
175 | (2) |
|
|
175 | (1) |
|
|
175 | (2) |
|
|
177 | (14) |
|
|
177 | (3) |
|
|
178 | (1) |
|
|
178 | (1) |
|
Converting flowd Data to Flow-tools |
|
|
179 | (1) |
|
|
180 | (2) |
|
Configuring sFlow Export with sflowenable |
|
|
181 | (1) |
|
|
181 | (1) |
|
Problem Solving with Flow Data |
|
|
182 | (7) |
|
|
182 | (4) |
|
|
186 | (1) |
|
Traffic to Illegal Addresses |
|
|
187 | (1) |
|
Traffic to Nonexistent Hosts |
|
|
188 | (1) |
|
|
189 | (2) |
Index |
|
191 | |