WEBVTT

1
00:00.000 --> 00:01.220 align:middle line:84%


2
00:01.220 --> 00:03.140 align:middle line:90%
There are a lot of
great reasons why

3
00:03.140 --> 00:05.720 align:middle line:90%
we might want to know what's
going on on a network.

4
00:05.720 --> 00:07.658 align:middle line:90%
They can include
capacity planning,

5
00:07.658 --> 00:09.950 align:middle line:90%
or implementing a new service
that we want to make sure

6
00:09.950 --> 00:12.260 align:middle line:90%
we have the bandwidth for
or the quality of service

7
00:12.260 --> 00:14.183 align:middle line:84%
for, or perhaps, security.

8
00:14.183 --> 00:15.725 align:middle line:90%
We're curious about
certain protocols

9
00:15.725 --> 00:18.050 align:middle line:90%
that are banned or
shouldn't be on our network.

10
00:18.050 --> 00:19.040 align:middle line:84%
Are they there?

11
00:19.040 --> 00:21.470 align:middle line:90%
Those are all great
reasons for running NetFlow

12
00:21.470 --> 00:23.220 align:middle line:84%
to find out what's going on.

13
00:23.220 --> 00:25.520 align:middle line:90%
So there are three basic
steps of getting NetFlow

14
00:25.520 --> 00:27.860 align:middle line:90%
up and working, assuming we
have gear that supports it.

15
00:27.860 --> 00:31.280 align:middle line:90%
Number one, we need to
train devices to do it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:27.860 --> 00:31.280 align:middle line:90%
Number one, we need to
train devices to do it.

16
00:31.280 --> 00:34.820 align:middle line:90%
So let's imagine here on R1
that we want to use NetFlow.

17
00:34.820 --> 00:37.400 align:middle line:90%
And we would go to the routers,
a couple ways of doing this.

18
00:37.400 --> 00:38.120 align:middle line:84%
We'll talk about both.

19
00:38.120 --> 00:39.912 align:middle line:90%
We'd go to the router,
though, effectively,

20
00:39.912 --> 00:43.455 align:middle line:90%
and say, "Dear Mr. Router,
on this interface, gig 1/0,

21
00:43.455 --> 00:45.830 align:middle line:90%
we want you to pay attention
to traffic that's going out,

22
00:45.830 --> 00:47.360 align:middle line:84%
the routing of that interface.

23
00:47.360 --> 00:49.850 align:middle line:90%
And also that you're
receiving on that interface

24
00:49.850 --> 00:52.450 align:middle line:90%
and keeping track of
those flows of traffic."

25
00:52.450 --> 00:54.620 align:middle line:90%
So we're not asking it
to capture the traffic

26
00:54.620 --> 00:55.940 align:middle line:84%
and save the packets.

27
00:55.940 --> 00:59.208 align:middle line:90%
We're just asking it to
remember what it was, like, oh,

28
00:59.208 --> 00:59.750 align:middle line:84%
that was TCP.

29
00:59.750 --> 01:02.990 align:middle line:90%
It was from here to there,
and so forth, things
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.750 --> 01:02.990 align:middle line:90%
It was from here to there,
and so forth, things

30
01:02.990 --> 01:04.920 align:middle line:84%
like that, each flow of traffic.

31
01:04.920 --> 01:07.760 align:middle line:90%
So if we had a client,
like, this PC here,

32
01:07.760 --> 01:10.640 align:middle line:90%
who is accessing a
server over here--

33
01:10.640 --> 01:12.740 align:middle line:84%
I'll draw one; there you go--

34
01:12.740 --> 01:16.220 align:middle line:90%
and we are using NetFlow
here, that one flow of traffic

35
01:16.220 --> 01:19.190 align:middle line:90%
would be recorded by the
router from the ports involved,

36
01:19.190 --> 01:21.800 align:middle line:90%
or based on what we were
looking for for that flow.

37
01:21.800 --> 01:24.020 align:middle line:90%
And then when the
server responded back,

38
01:24.020 --> 01:26.240 align:middle line:90%
if we were analyzing
traffic inbound as well,

39
01:26.240 --> 01:28.040 align:middle line:84%
we'd have two flows of data.

40
01:28.040 --> 01:30.470 align:middle line:90%
Now you multiply that by
thousands and thousands
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.040 --> 01:30.470 align:middle line:90%
Now you multiply that by
thousands and thousands

41
01:30.470 --> 01:34.140 align:middle line:90%
of different flows, and the
router has a lot of information

42
01:34.140 --> 01:34.932 align:middle line:84%
it's collecting.

43
01:34.932 --> 01:37.140 align:middle line:90%
So, what we're going to do
is collect the data first.

44
01:37.140 --> 01:38.180 align:middle line:84%
That's the first task.

45
01:38.180 --> 01:40.513 align:middle line:90%
And then the second thing is
we are going to ship it off

46
01:40.513 --> 01:43.070 align:middle line:84%
to a storage point.

47
01:43.070 --> 01:46.050 align:middle line:90%
So that is going to be our
storage for all these records.

48
01:46.050 --> 01:49.340 align:middle line:90%
So that storage point is
referred to as a collector.

49
01:49.340 --> 01:52.880 align:middle line:90%
Think of a collector, like,
some people collect stamps.

50
01:52.880 --> 01:55.130 align:middle line:90%
Some people collect
model planes.

51
01:55.130 --> 01:57.950 align:middle line:90%
This collector is
collecting the flow records

52
01:57.950 --> 01:59.480 align:middle line:90%
from network
devices for NetFlow.

53
01:59.480 --> 02:00.980 align:middle line:90%
And so what we
would do is we would
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.480 --> 02:00.980 align:middle line:90%
And so what we
would do is we would

54
02:00.980 --> 02:05.433 align:middle line:90%
train R1 that, hey, go ahead
and cache that information

55
02:05.433 --> 02:06.975 align:middle line:90%
about those flows
that are happening.

56
02:06.975 --> 02:08.690 align:middle line:90%
There could be
thousands of them.

57
02:08.690 --> 02:10.220 align:middle line:90%
Cache it for a short
period of time.

58
02:10.220 --> 02:13.940 align:middle line:90%
And then periodically, go
ahead and send that information

59
02:13.940 --> 02:16.420 align:middle line:90%
down to your collector,
or to a collector.

60
02:16.420 --> 02:20.710 align:middle line:90%
And that is referred
to as an export.

61
02:20.710 --> 02:24.120 align:middle line:90%
So if we are exporting our
flow records to a collector,

62
02:24.120 --> 02:25.870 align:middle line:90%
that's how we get them
from the device who

63
02:25.870 --> 02:28.060 align:middle line:90%
saw the traffic,
down to the collector

64
02:28.060 --> 02:29.920 align:middle line:84%
who can capture the traffic.

65
02:29.920 --> 02:31.900 align:middle line:90%
And once that data
is stored there,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.920 --> 02:31.900 align:middle line:90%
And once that data
is stored there,

66
02:31.900 --> 02:36.150 align:middle line:90%
we can then go ahead and use
tools to analyze traffic Now

67
02:36.150 --> 02:38.743 align:middle line:90%
that analyzing tool may
be on the same server,

68
02:38.743 --> 02:40.160 align:middle line:90%
or maybe a different
server that's

69
02:40.160 --> 02:41.298 align:middle line:84%
just digging into the data.

70
02:41.298 --> 02:43.340 align:middle line:90%
And then it can build all
the cool graphs for us,

71
02:43.340 --> 02:46.400 align:middle line:90%
the graphs saying, hey,
your majority of traffic

72
02:46.400 --> 02:47.930 align:middle line:84%
is this type of protocol.

73
02:47.930 --> 02:50.870 align:middle line:90%
Or the majority
of the top talkers

74
02:50.870 --> 02:52.880 align:middle line:90%
were these devices
on the network--

75
02:52.880 --> 02:54.887 align:middle line:90%
and anything you'd like
to know about flows

76
02:54.887 --> 02:55.970 align:middle line:84%
going through this device.

77
02:55.970 --> 02:58.070 align:middle line:90%
If he saw them, he's
collecting that information,

78
02:58.070 --> 03:01.667 align:middle line:90%
not collecting the packets, just
a Reader's Digest overview of,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:58.070 --> 03:01.667 align:middle line:90%
not collecting the packets, just
a Reader's Digest overview of,

79
03:01.667 --> 03:02.750 align:middle line:84%
hey, here's what happened.

80
03:02.750 --> 03:04.125 align:middle line:90%
I don't have the
packets anymore.

81
03:04.125 --> 03:05.630 align:middle line:90%
But I just remember
what happened

82
03:05.630 --> 03:06.770 align:middle line:84%
and I sent them over here.

83
03:06.770 --> 03:09.470 align:middle line:90%
So that's the
concept of NetFlow,

84
03:09.470 --> 03:11.160 align:middle line:90%
to collect the
information regarding

85
03:11.160 --> 03:14.540 align:middle line:90%
the flows the traffic, to
export them over to a collector,

86
03:14.540 --> 03:16.280 align:middle line:90%
and then analyze
them or use that data

87
03:16.280 --> 03:18.050 align:middle line:90%
in some meaningful
way-- for security

88
03:18.050 --> 03:19.512 align:middle line:90%
or for capacity
planning, or just

89
03:19.512 --> 03:21.470 align:middle line:90%
to have a better
understanding of what's really

90
03:21.470 --> 03:23.005 align:middle line:84%
happening on the network.

91
03:23.005 --> 03:24.630 align:middle line:90%
So that's the big
picture with NetFlow.

92
03:24.630 --> 03:26.660 align:middle line:90%
And in the next video,
what I'd like to do

93
03:26.660 --> 03:29.480 align:middle line:90%
is chat with you about
some evolution of NetFlow,

94
03:29.480 --> 03:33.200 align:middle line:90%
including the two major
versions, and then
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.480 --> 03:33.200 align:middle line:90%
including the two major
versions, and then

95
03:33.200 --> 03:35.015 align:middle line:90%
a little tweak for
version 10 as well.

96
03:35.015 --> 03:36.890 align:middle line:90%
So we'll take care of
that in the next video.

97
03:36.890 --> 03:39.380 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

98
03:39.380 --> 03:42.510 align:middle line:90%
And I'd like to thank
you for viewing.