WEBVTT

1
00:00.000 --> 00:00.990 align:middle line:84%


2
00:00.990 --> 00:02.850 align:middle line:90%
If someone gave us
a gift and we just

3
00:02.850 --> 00:05.640 align:middle line:90%
put it in a closet somewhere
and didn't ever look at it

4
00:05.640 --> 00:08.170 align:middle line:90%
or use it, that's not
too effective of a gift.

5
00:08.170 --> 00:11.820 align:middle line:90%
Well, in the world of NetFlow,
as we are collecting that flow

6
00:11.820 --> 00:14.473 align:middle line:90%
information from our network,
think of it like a gift.

7
00:14.473 --> 00:16.140 align:middle line:90%
And it's sitting there
on the collector.

8
00:16.140 --> 00:17.682 align:middle line:90%
We need to take a
look at it and make

9
00:17.682 --> 00:21.060 align:middle line:90%
sure we can use it for
provisioning our network,

10
00:21.060 --> 00:24.263 align:middle line:90%
or for looking for problems in
the network, or for security.

11
00:24.263 --> 00:25.680 align:middle line:90%
So in this video
I'd like to share

12
00:25.680 --> 00:29.160 align:middle line:90%
with you a glimpse at an option
for looking at that data.

13
00:29.160 --> 00:30.990 align:middle line:90%
And that's through
a network analyzer
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.160 --> 00:30.990 align:middle line:90%
And that's through
a network analyzer

14
00:30.990 --> 00:34.890 align:middle line:90%
for NetFlow information from
Cisco called Stealthwatch.

15
00:34.890 --> 00:38.070 align:middle line:90%
So here's the router that we
left off in the previous video.

16
00:38.070 --> 00:40.590 align:middle line:90%
And currently in this
exporter it has destination

17
00:40.590 --> 00:45.360 align:middle line:90%
172.20.30.201, which is
in a VRF named Internal.

18
00:45.360 --> 00:47.670 align:middle line:90%
So it's shipping all
this NetFlow information

19
00:47.670 --> 00:48.990 align:middle line:84%
to that device.

20
00:48.990 --> 00:50.550 align:middle line:84%
Now, that is a collector.

21
00:50.550 --> 00:52.330 align:middle line:90%
Let me show you what
that looks like.

22
00:52.330 --> 00:55.080 align:middle line:90%
So this is the flow collector
for NetFlow Virtual Edition.

23
00:55.080 --> 00:56.340 align:middle line:84%
It's a Cisco product.

24
00:56.340 --> 00:58.230 align:middle line:90%
And all the devices
on the network,

25
00:58.230 --> 00:59.875 align:middle line:90%
including the router
we just looked at,

26
00:59.875 --> 01:01.500 align:middle line:90%
have been configured
in their X borders
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.875 --> 01:01.500 align:middle line:90%
have been configured
in their X borders

27
01:01.500 --> 01:04.080 align:middle line:90%
to target this specific
device on the ports

28
01:04.080 --> 01:07.080 align:middle line:90%
we specified using the
Export protocol of IPFIX,

29
01:07.080 --> 01:09.570 align:middle line:90%
and sending those messages
over to this device

30
01:09.570 --> 01:10.770 align:middle line:84%
where it's collecting them.

31
01:10.770 --> 01:12.960 align:middle line:90%
Now, in the Cisco
world, this device

32
01:12.960 --> 01:15.960 align:middle line:90%
here is mainly a collector,
just taking all the data.

33
01:15.960 --> 01:19.620 align:middle line:90%
And then we need some kind of an
analyzer to analyze that data.

34
01:19.620 --> 01:22.410 align:middle line:90%
And to do that, we could use a
tool like Stealthwatch, which

35
01:22.410 --> 01:26.013 align:middle line:90%
is a NetFlow analyzer with an
angle towards security to help

36
01:26.013 --> 01:27.930 align:middle line:90%
make sure there's nothing
mischievous going on

37
01:27.930 --> 01:29.408 align:middle line:84%
on our networks.

38
01:29.408 --> 01:31.200 align:middle line:90%
So over here on the
left on this dashboard,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:29.408 --> 01:31.200 align:middle line:90%
So over here on the
left on this dashboard,

39
01:31.200 --> 01:33.300 align:middle line:90%
I've got some Top
Alarming Hosts, and then

40
01:33.300 --> 01:35.490 align:middle line:90%
Alarms by Type,
and Today's Alarms,

41
01:35.490 --> 01:36.930 align:middle line:84%
lots of cool stuff going on.

42
01:36.930 --> 01:39.810 align:middle line:90%
But the key here is,
with a NetFlow analyzer,

43
01:39.810 --> 01:41.700 align:middle line:84%
is that we have all this data.

44
01:41.700 --> 01:43.400 align:middle line:90%
We're getting flows
in our network.

45
01:43.400 --> 01:45.780 align:middle line:90%
And NetFlow Analyzer
gives us the ability

46
01:45.780 --> 01:47.950 align:middle line:84%
to make sense of that data.

47
01:47.950 --> 01:51.273 align:middle line:90%
So if we went to, for example,
Analyze and to Flow Search,

48
01:51.273 --> 01:53.190 align:middle line:90%
if we were looking, if
we had some device that

49
01:53.190 --> 01:55.260 align:middle line:90%
was compromised, we
could do a flow search

50
01:55.260 --> 01:57.860 align:middle line:90%
and search just for the
data about that flow--

51
01:57.860 --> 01:59.550 align:middle line:90%
its IP address or the
type of protocol--

52
01:59.550 --> 02:02.520 align:middle line:90%
and drill down in to find
more about what happened
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.550 --> 02:02.520 align:middle line:90%
and drill down in to find
more about what happened

53
02:02.520 --> 02:04.380 align:middle line:90%
and what went on
regarding attack

54
02:04.380 --> 02:05.950 align:middle line:84%
or compromise that occurred.

55
02:05.950 --> 02:09.150 align:middle line:90%
So for this one, I'm just
going to go ahead and just do

56
02:09.150 --> 02:11.190 align:middle line:90%
the last five minutes
and click on Search.

57
02:11.190 --> 02:15.000 align:middle line:90%
So this is going to show us the
search results of the NetFlow

58
02:15.000 --> 02:18.180 align:middle line:90%
information that was sent to
the collector over the last five

59
02:18.180 --> 02:19.170 align:middle line:84%
minutes.

60
02:19.170 --> 02:21.810 align:middle line:90%
And so if we scroll down,
we have GRE traffic,

61
02:21.810 --> 02:23.700 align:middle line:84%
a bunch of TCP traffic.

62
02:23.700 --> 02:27.120 align:middle line:90%
It's got ESP, which is
IPsec, and a whole bunch

63
02:27.120 --> 02:28.830 align:middle line:84%
of other ports and protocols.

64
02:28.830 --> 02:30.390 align:middle line:90%
We could find out
what's going on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.830 --> 02:30.390 align:middle line:90%
We could find out
what's going on.

65
02:30.390 --> 02:31.500 align:middle line:90%
Or if we just want
to get a summary,

66
02:31.500 --> 02:32.500 align:middle line:84%
we can click on Summary.

67
02:32.500 --> 02:35.760 align:middle line:90%
And then on the left hand
side here, it has locations--

68
02:35.760 --> 02:39.240 align:middle line:90%
Belgium, United States, China,
France, Russian Federation.

69
02:39.240 --> 02:42.080 align:middle line:84%


70
02:42.080 --> 02:44.640 align:middle line:90%
The reason I'm chuckling is
because this is a live network.

71
02:44.640 --> 02:48.960 align:middle line:90%
So it would probably serve
us to, based on this NetFlow

72
02:48.960 --> 02:51.360 align:middle line:90%
information, to say,
whoa, why are we

73
02:51.360 --> 02:53.460 align:middle line:84%
going to all those locations?

74
02:53.460 --> 02:55.570 align:middle line:90%
Or is that real traffic
that's happening?

75
02:55.570 --> 02:57.570 align:middle line:90%
And if it is, we would
want to investigate that

76
02:57.570 --> 03:00.250 align:middle line:90%
further and make sure we're
not being compromised.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:57.570 --> 03:00.250 align:middle line:90%
further and make sure we're
not being compromised.

77
03:00.250 --> 03:02.430 align:middle line:90%
So, again, the key
with NetFlow is

78
03:02.430 --> 03:05.610 align:middle line:90%
that we want to collect the
data, export it to a collector,

79
03:05.610 --> 03:08.070 align:middle line:90%
and then analyze it with some
type of a network analysis

80
03:08.070 --> 03:10.890 align:middle line:90%
software, also called
a NetFlow analyzer,

81
03:10.890 --> 03:13.230 align:middle line:90%
so we can find out what's
going on on our network

82
03:13.230 --> 03:15.240 align:middle line:90%
and use it for
troubleshooting-- or use it

83
03:15.240 --> 03:18.703 align:middle line:90%
for planning for the future
or use it for security.

84
03:18.703 --> 03:20.370 align:middle line:90%
So thanks for joining
me in these videos

85
03:20.370 --> 03:22.320 align:middle line:90%
regarding NetFlow in
a Cisco environment.

86
03:22.320 --> 03:24.240 align:middle line:90%
And I'll see you in
the next set of videos.

87
03:24.240 --> 03:26.700 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

88
03:26.700 --> 03:29.890 align:middle line:90%
And I'd like to thank
you for viewing.