WEBVTT

1
00:00.000 --> 00:04.160
In the previous two videos, we created a user-defined flow record that's

2
00:04.160 --> 00:08.120
matching on these three elements to identify flows and collecting this

3
00:08.120 --> 00:10.000
additional information about those flows.

4
00:10.000 --> 00:14.550
We also created a flow exporter called our flow exporter that's going to ship

5
00:14.550 --> 00:20.330
the cached information that it collects over to 23.1.2.100, sourcing it from

6
00:20.330 --> 00:25.000
our loopback zero address and using UDP port 9996 as the destination port.

7
00:25.000 --> 00:29.210
That's because the server is currently set up to listen and accept that flow

8
00:29.210 --> 00:33.160
record information on that port and protocol, and it's expecting to receive
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:29.210 --> 00:33.160
record information on that port and protocol, and it's expecting to receive

9
00:33.160 --> 00:34.000
that from our two.

10
00:34.000 --> 00:38.130
So to implement the flow monitor, which is going to include the record

11
00:38.130 --> 00:42.820
information on the exporter, let's go ahead and first of all, let's verify with

12
00:42.820 --> 00:44.000
the show flow monitor.

13
00:44.000 --> 00:46.000
Let's verify we don't yet have one.

14
00:46.000 --> 00:51.080
So we don't have any customized flow monitors, so we'll go into configuration

15
00:51.080 --> 00:55.920
mode and type in flow monitor and let's go ahead and name this our the ash flow

16
00:55.920 --> 00:57.000
dash monitor.

17
00:57.000 --> 00:59.000
And that puts us into flow monitor configuration mode.

18
00:59.000 --> 01:02.000
And here let's specify the record that we want to use.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.000 --> 01:02.000
And here let's specify the record that we want to use.

19
01:02.000 --> 01:05.280
So eventually in the next step, we're going to apply this flow monitor to an

20
01:05.280 --> 01:06.000
interface.

21
01:06.000 --> 01:10.000
So as part of the flow monitor, let's specify which record we want to use,

22
01:10.000 --> 01:12.000
whole type in record space, question mark.

23
01:12.000 --> 01:17.130
Now we could use some of the built in predefined records or we could use our

24
01:17.130 --> 01:21.000
user defined record that we just made, which is what we want to do.

25
01:21.000 --> 01:25.000
So we're going to say record use our flow record, which we scroll up.

26
01:25.000 --> 01:28.670
It's going to be matching on these three elements regarding what it considers a

27
01:28.670 --> 01:31.770
flow and it's going to collect this additional information based on this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.670 --> 01:31.770
flow and it's going to collect this additional information based on this

28
01:31.770 --> 01:33.000
specific flow record.

29
01:33.000 --> 01:36.440
So in our monitor, we're going to indicate we want to use that specific flow

30
01:36.440 --> 01:37.000
record.

31
01:37.000 --> 01:40.780
And then next, let's go ahead and do a question mark and let's also include

32
01:40.780 --> 01:42.000
which exporter to use.

33
01:42.000 --> 01:45.600
So we created if we scroll up this user defined our flow exporter right here

34
01:45.600 --> 01:49.000
with our server information and the port information and so forth.

35
01:49.000 --> 01:53.170
So we're also going to include that as part of this flow monitor by typing in

36
01:53.170 --> 01:57.000
exporter and a question mark and we'll specify our flow exporter.

37
01:57.000 --> 01:58.000
I'll go ahead and copy paste that.

38
01:58.000 --> 01:59.000
So no typos there.

39
01:59.000 --> 02:03.000
And now let's do a do show flow monitor and press enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:59.000 --> 02:03.000
And now let's do a do show flow monitor and press enter.

40
02:03.000 --> 02:04.000
So here's our flow monitor.

41
02:04.000 --> 02:07.000
And right now it has two entries in it.

42
02:07.000 --> 02:09.510
It's specifying what record we want to use and it's going to use our flow

43
02:09.510 --> 02:10.000
record.

44
02:10.000 --> 02:13.000
And it also specifies which export we're going to use.

45
02:13.000 --> 02:16.050
Now currently says inactive and that's because we haven't applied this flow

46
02:16.050 --> 02:17.000
monitor anywhere.

47
02:17.000 --> 02:22.360
So we need to next apply this flow monitor to one or more interfaces so it can

48
02:22.360 --> 02:24.000
begin the work of collecting the traffic.

49
02:24.000 --> 02:28.280
So in our two, we have these interfaces gig one zero gig two zero F a four

50
02:28.280 --> 02:31.000
slash zero and our two has also gig zero zero.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:28.280 --> 02:31.000
slash zero and our two has also gig zero zero.

51
02:31.000 --> 02:35.000
So let's apply that flow monitor to all four interfaces.

52
02:35.000 --> 02:38.990
And that way any traffic that's coming in on those interfaces will be collected

53
02:38.990 --> 02:39.000
.

54
02:39.000 --> 02:43.310
And then when the cache times out after what are the default time out is for

55
02:43.310 --> 02:47.000
the cache, it'll be shipping that information over to the collector at server

56
02:47.000 --> 02:49.000
23.1.2.100.

57
02:49.000 --> 02:52.000
So let's exit out of monitor configuration mode and let's go to interface.

58
02:52.000 --> 02:54.000
In fact, let's do a range of interfaces.

59
02:54.000 --> 02:55.000
We'll make this faster.

60
02:55.000 --> 02:59.870
So here in our two, let's go ahead and this F a four slash zero interface isn't

61
02:59.870 --> 03:03.770
going to be used too much because OSPF is using the primary link from our two
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:59.870 --> 03:03.770
going to be used too much because OSPF is using the primary link from our two

62
03:03.770 --> 03:06.000
down to our three over the gigabit.

63
03:06.000 --> 03:11.500
So let's apply the net flow monitor to gig zero zero gig one zero and gig two

64
03:11.500 --> 03:12.000
zero.

65
03:12.000 --> 03:15.000
And then I'll collect all our meaningful traffic here in the network.

66
03:15.000 --> 03:20.380
So on our two, we'll go to interface range and we'll go to gig zero slash zero

67
03:20.380 --> 03:26.000
comma gig one slash zero comma and gig two slash zero before I press center.

68
03:26.000 --> 03:28.000
Let me just confirm indeed those are the interfaces.

69
03:28.000 --> 03:30.000
So gig zero zero one zero two zero.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:30.000 --> 03:31.000
That looks good.

71
03:31.000 --> 03:33.360
So we'll press enter there and then to apply the flow monitor to those

72
03:33.360 --> 03:34.000
interfaces.

73
03:34.000 --> 03:38.770
We'll simply type in IP flow monitor and then a space question mark and we'll

74
03:38.770 --> 03:42.000
use the name of our flow monitor, which is showing up right here.

75
03:42.000 --> 03:45.000
Fantastic. So we'll copy paste that in space, the question mark.

76
03:45.000 --> 03:49.330
And then do we want to have that look at the traffic as it's coming in or ing

77
03:49.330 --> 03:53.000
ress on that interface or outgoing on that interface.

78
03:53.000 --> 03:55.750
And because we have it on all of our three gigabit interfaces, we really can go

79
03:55.750 --> 03:57.000
ahead and just focus on input.

80
03:57.000 --> 04:02.100
Now, if we are looking at ingress traffic on all the relevant interfaces, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:57.000 --> 04:02.100
Now, if we are looking at ingress traffic on all the relevant interfaces, we

81
04:02.100 --> 04:05.440
don't really need to do inbound and outbound because if the routers forwarding

82
04:05.440 --> 04:08.000
traffic, they'll be coming in on one of those interfaces and we'll collect it.

83
04:08.000 --> 04:12.530
But you could do in and or out and let's go ahead and do input and then we'll

84
04:12.530 --> 04:14.000
also just for grins.

85
04:14.000 --> 04:16.000
Let's also go ahead and specify output.

86
04:16.000 --> 04:18.000
Although that may be a little bit of overkill.

87
04:18.000 --> 04:19.000
That's okay.

88
04:19.000 --> 04:25.000
So now we do a show flow monitor and press and I fell right show flow monitor.

89
04:25.000 --> 04:27.000
Here's our flow monitor.

90
04:27.000 --> 04:28.000
It's using this record.

91
04:28.000 --> 04:29.000
She's net exporter.

92
04:29.000 --> 04:33.000
And if you'll notice that we already have some cached information showing up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:29.000 --> 04:33.000
And if you'll notice that we already have some cached information showing up.

93
04:33.000 --> 04:37.350
So let's do a show flow monitor space question mark and let's go ahead and type

94
04:37.350 --> 04:38.000
in hour.

95
04:38.000 --> 04:41.780
I'll just tab it out to do a show flow monitor hour flow monitor space question

96
04:41.780 --> 04:42.000
mark.

97
04:42.000 --> 04:46.000
And let's go ahead and take a look at the statistics first press center.

98
04:46.000 --> 04:51.090
So we have some flows it shows four flows added fantastic and if you do a show

99
04:51.090 --> 04:55.420
flow monitor and the name of our flow monitor space cache, it'll show us the

100
04:55.420 --> 04:56.000
cached information.

101
04:56.000 --> 05:01.000
So here we have traffic from 10 23 0 3 going to 224 0 0 5.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:56.000 --> 05:01.000
So here we have traffic from 10 23 0 3 going to 224 0 0 5.

102
05:01.000 --> 05:05.210
That's the destination multi cast address for OSPF and there's the protocol

103
05:05.210 --> 05:08.000
number for OSPF and it has a TTL of one.

104
05:08.000 --> 05:11.000
And here's the application name that it's associated with.

105
05:11.000 --> 05:14.000
Although it'd be much clearer if it said it's OSPF, which is what it is.

106
05:14.000 --> 05:17.840
And also there's the TOS bits because we asked it to collect that information

107
05:17.840 --> 05:19.000
as part of the flows.

108
05:19.000 --> 05:23.060
Here's another one from our one based on the IP address going to the multi cast

109
05:23.060 --> 05:24.000
address for OSPF.

110
05:24.000 --> 05:26.000
So that's the only flows that we have at the moment.

111
05:26.000 --> 05:30.000
So if we go back to our Windows client PC, I think I closed it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:30.000 --> 05:32.000
Let me go ahead and open up client nug again.

113
05:32.000 --> 05:36.360
So here's client nug and if we go back to a command prompt here, let's do a

114
05:36.360 --> 05:37.000
couple of things.

115
05:37.000 --> 05:39.000
Let's actually go to a browser.

116
05:39.000 --> 05:44.450
So here is a shortcut on the taskbar of the Windows 11 client for Chrome and I

117
05:44.450 --> 05:47.000
have a bookmark for the server at 23.1.2.100.

118
05:47.000 --> 05:49.000
And that's using HTTP.

119
05:49.000 --> 05:53.850
So if we launch that and then click on refresh a few times, that should show

120
05:53.850 --> 05:59.000
traffic coming from this PC 10 10 0 50 going up to the server at 23.1.2.100.

121
05:59.000 --> 06:03.000
And the protocol should be protocol number six, which is TCP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:59.000 --> 06:03.000
And the protocol should be protocol number six, which is TCP.

122
06:03.000 --> 06:06.000
So let me click on refresh a couple more times there.

123
06:06.000 --> 06:08.000
And then let's go back to server one.

124
06:08.000 --> 06:10.000
So at the bottom here, I've got server one.

125
06:10.000 --> 06:12.000
Let's go back to R2.

126
06:12.000 --> 06:16.040
And let's hit the upper key into a show flow monitor, the name of our monitor

127
06:16.040 --> 06:18.000
and the keyword cache and press enter.

128
06:18.000 --> 06:19.000
So there's our OSPF again.

129
06:19.000 --> 06:23.000
And as we continue to scroll down now, we have some additional traffic.

130
06:23.000 --> 06:27.000
So here is from 10 10 0 50 going to the server.

131
06:27.000 --> 06:29.000
That's protocol 17.

132
06:29.000 --> 06:30.000
That's in decimal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:30.000 --> 06:31.000
And that is UDP.

134
06:31.000 --> 06:33.000
There's the type of service bits.

135
06:33.000 --> 06:36.000
There's the TTL and there's the application DNS.

136
06:36.000 --> 06:39.680
And if we go down further further, we have more traffic that's going up to that

137
06:39.680 --> 06:42.000
server and using protocol number one.

138
06:42.000 --> 06:44.000
And that is ICMP.

139
06:44.000 --> 06:48.000
And if we continue to scroll down, here's the traffic that we just generated.

140
06:48.000 --> 06:50.000
And that is HTTP.

141
06:50.000 --> 06:52.000
And that is TCP protocol six.

142
06:52.000 --> 06:56.360
And below that, we have the return traffic coming back from the server from 23.

143
06:56.360 --> 07:01.000
1.2.100 going back to the client using protocol six, which is TCP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
06:56.360 --> 07:01.000
1.2.100 going back to the client using protocol six, which is TCP.

144
07:01.000 --> 07:04.000
And there's the TOS bits and there's the TTL.

145
07:04.000 --> 07:07.860
And based on the source port, the server's using his showing right here as HTTP

146
07:07.860 --> 07:08.000
.

147
07:08.000 --> 07:11.000
So if we generate some other traffic, let's go ahead and do a ping to some

148
07:11.000 --> 07:12.000
other destination.

149
07:12.000 --> 07:16.590
So in our topology here, if we did a ping from our Windows client computer over

150
07:16.590 --> 07:22.000
to, let's say, 3 3 3 3 that traffic is going to go from R1 over to R2 down to R

151
07:22.000 --> 07:22.000
3.

152
07:22.000 --> 07:25.000
So that'd be captured as far as the traffic flow here in R2.

153
07:25.000 --> 07:26.000
So let's do a ping.

154
07:26.000 --> 07:31.150
So ping space, let's do a dash N for us to how about 50 of those over to 3 3 3
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
07:26.000 --> 07:31.150
So ping space, let's do a dash N for us to how about 50 of those over to 3 3 3

155
07:31.150 --> 07:33.000
3 and we'll let that go.

156
07:33.000 --> 07:34.000
Fantastic.

157
07:34.000 --> 07:35.000
So that's running.

158
07:35.000 --> 07:39.460
So if we go back to our server, which is right here, server one, and we go back

159
07:39.460 --> 07:41.000
to the console and hit the upper key to show flow.

160
07:41.000 --> 07:45.130
The name of our flow monitor and the keyword cache and press enter and we

161
07:45.130 --> 07:49.000
scroll down, we should have that ICMP traffic as well.

162
07:49.000 --> 07:50.000
And there it is.

163
07:50.000 --> 07:55.000
So there's the traffic going to 3 3 3 3 with protocol one, which is ICMP.

164
07:55.000 --> 08:00.150
And there's the return traffic from 3 3 3 3 coming back to our client at 10 10
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

164
07:55.000 --> 08:00.150
And there's the return traffic from 3 3 3 3 coming back to our client at 10 10

165
08:00.150 --> 08:01.000
0 50.

166
08:01.000 --> 08:06.020
So I also installed a demo version of Manage Engine's NetFlow Analyzer here on

167
08:06.020 --> 08:07.000
server one.

168
08:07.000 --> 08:10.550
So if we go to dashboard here, here it's showing that we have one device using

169
08:10.550 --> 08:13.000
NetFlow version nine that's flexible NetFlow.

170
08:13.000 --> 08:15.000
Here's its IP address of 2 2 2 2.

171
08:15.000 --> 08:19.370
We have flows 10 and if you scroll down here to top applications, let me go

172
08:19.370 --> 08:21.000
ahead and click on refresh there.

173
08:21.000 --> 08:24.000
So it's configured to receive data from 2 2 2 2.

174
08:24.000 --> 08:26.000
Again, it's just an eval license.

175
08:26.000 --> 08:27.000
It's here temporarily.

176
08:27.000 --> 08:31.000
It shows here the IP address we're receiving from is 2 2 2 2 flows 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
08:27.000 --> 08:31.000
It shows here the IP address we're receiving from is 2 2 2 2 flows 10.

177
08:31.000 --> 08:35.690
So let's go ahead and generate a little more data and also give it a minute or

178
08:35.690 --> 08:41.000
two for the cache to timeout so that our two can actually send the data over

179
08:41.000 --> 08:46.000
here to this NetFlow Analyzer, which is also referred to as a collector in the

180
08:46.000 --> 08:47.000
concept of NetFlow.

181
08:47.000 --> 08:51.000
The device that's receiving the exported information from our router.

182
08:51.000 --> 08:55.000
So here's the tab for our to let's go over to the Windows client machine.

183
08:55.000 --> 09:01.000
Let's generate some more traffic. Let's go to how about 4.4.4.4.4.4.4.4.4.4.4.4
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
08:55.000 --> 09:01.000
Let's generate some more traffic. Let's go to how about 4.4.4.4.4.4.4.4.4.4.4.4

184
09:01.000 --> 09:01.000
.5 times.

185
09:01.000 --> 09:03.000
Let's go back to the browser.

186
09:03.000 --> 09:07.200
I'll refresh that a few times to make sure we're setting additional traffic and

187
09:07.200 --> 09:10.000
that information should show up at the CLI here.

188
09:10.000 --> 09:15.000
If we do the show flow monitor, the name of our flow monitor space cache.

189
09:15.000 --> 09:20.340
So that's going to show up there and it also once the cache times out, it

190
09:20.340 --> 09:24.000
should also be sending that data over to the NetFlow Analyzer.

191
09:24.000 --> 09:27.810
So once network information is generated be a tool similar to this that we

192
09:27.810 --> 09:32.000
would use to go ahead and see the information regarding the flows of traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
09:27.810 --> 09:32.000
would use to go ahead and see the information regarding the flows of traffic

193
09:32.000 --> 09:36.420
instead of looking at the command line and also for a tool like this like a Net

194
09:36.420 --> 09:41.090
Flow collector, we could create reports and search for, for example, top talkers

195
09:41.090 --> 09:45.000
and top destinations and top protocols in use and so forth.

196
09:45.000 --> 09:52.260
So I'm going to go ahead and close the NetFlow Analyzer. So even without a tool

197
09:52.260 --> 09:53.300
like a NetFlow Analyzer or a collector that can receive this information, we

198
09:53.300 --> 09:58.470
can verify that flexible NetFlow is working just by using this command right

199
09:58.470 --> 10:00.000
here once it's set up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

200
10:00.000 --> 10:04.240
Again, that command is show flow monitor space and the name of your flow

201
10:04.240 --> 10:06.000
monitor space and cache.

202
10:06.000 --> 10:08.000
Then hit the space bar to go one page down at a time.

203
10:08.000 --> 10:13.400
So now that we had the opportunity to see the creation of a flow record as well

204
10:13.400 --> 10:18.330
as see the creation of a flow exporter and also see the creation and

205
10:18.330 --> 10:22.340
implementation of a flow monitor, which is then applied to an interface for

206
10:22.340 --> 10:24.000
your show run and paste gig one slash zero.

207
10:24.000 --> 10:28.540
Now that we've seen that done in the next video, I'd like to put you on a hands

208
10:28.540 --> 10:33.000
on lab so you get practice at the router in configuring those same elements.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

208
10:28.540 --> 10:33.000
on lab so you get practice at the router in configuring those same elements.

209
10:33.000 --> 10:37.010
A flow record, a flow exporter and a flow monitor and then apply it to the

210
10:37.010 --> 10:40.000
interfaces where you want to track the traffic.

211
10:40.000 --> 10:43.000
So I'll see you in the next video for the hands on lab.