Transcript Peakflow SP

Network Monitoring System In CSTNET
Long Chun
China Science & Technology Network
Agenda
1
Introduction of Peakflow SP
2
Basic Traffic Analysis
3
BGP Analysis Function
44
Role of Peakflow SP in Security Area
4
2
Peakflow SP Platform
Managed Services Device
 Customer facing DoS detection and mitigation
Converged Platform Device
 Infrastructure Security
 Traffic and Routing Analysis
Infrastructure Security
 DoS/worm detection
 Traceback
 Analysis
 Mitigation
Traffic and Routing
 Routing management
 Transit/peering mgmt
 Customer accounting
 Backbone mgmt
3
Peakflow Network Appliances
Measurement
 Collect Netflow, Cflow, Sflow, SNMP and optionally
BGP information from network routers/devices
 Collector – collect data from routers, baseline
traffic, detect anomalies.
 Controller –aggregate data from other devices;
create a central network-wide view
Intel 2U Servers
Deployment


Monitor up to 5 routers per Peakflow Device
Up to 15 devices managed by controller
Reporting


Reports available on controller through CLI or GUI
Notifications via email, snmp, or syslog
4
Netflow
Peakflow examines NetFlow packets that are generated by the router or
switch as traffic is forwarded. The NetFlow is analyzed to benchmark network
behavior and identify anomalies.
5
Topology
6
Agenda
1
Introduction of Peakflow SP
2
Basic Traffic Analysis
3
BGP Analysis Function
44
Role of Peakflow SP in Security Area
4
7
Traffic Analysis

Automatically Configured Analysis Objects:
－【Network】
－【Router】
－【Peer】
－【Interface】
No Complex Configuration

Objects Customized by User:
－【Customer】
－【Profile】
Flexibly customize objects we need
8
Traffic Analysis
User define objects:
－【Profile】
Include：
1、IP Address（or Block of IP Addresses）
2、AS Path Regular Expressions
3、Local AS/Sub AS
4、BGP community
5、Peer ASN
6、TCP/UDP port
7、 Interface
Boolean Operation：AND、OR、NOT
We can define analysis objects flexibly:




community '2:20'and not 92.2.1.0/25
aspath ‘^23849’ and not aspath ‘^23849_9800’
community ‘2:20’ and aspath ‘^4134’
9
Traffic Summary
10
Traffic Analysis Base on TCP/UDP Port (1)
11
Traffic Analysis Base on TCP/UDP Port(2)
12
Top Talkers
13
Agenda
1
Introduction of Peakflow SP
2
Basic Traffic Analysis
3
BGP Analysis Function
44
Role of Peakflow SP in Security Area
4
14
Transit Traffic
Analysis Object：【Network】 【Router】【Peer】
【Customer】【Profile】【Interface】
Operation：Network BGP Attribute ASxAS
15
Traffic Analysis Base on AS
16
Traffic Analysis Base on AS Path
17
Peering Evaluation and Visualization
18
Agenda
1
Introduction of Peakflow SP
2
Basic Traffic Analysis
3
BGP Analysis Function
44
Role of Peakflow SP in Security Area
4
19
Peakflow SP Anomaly Reporting

Profiled Anomalies – deviations from normal traffic levels
on the network

Misuse Anomalies – Traffic towards specific hosts that
exceed what should normally be seen on a network

Fingerprint/Worm Anomalies – Traffic that fits a user
specified signature
20
Detect Attack - Profiled Anomalies

Detects network-wide anomalies such as DDoS attacks and worm
outbreaks in non-intrusive data collection methods.

A baseline of normal
behavior leveraging
flow data available
from the routers
deployed on the
network would be built.
In real-time, the
system compares
traffic against the
baseline.

21
Detection Classes: Misuse



Detected independently from the established baselines,
on a set of known attack signatures.
Traffic of specific types exceeding what should be
normal for a network.
Misuse anomalies cover the following types of traffic:







ICMP Anomaly
TCP NULL Flag Anomaly
TCP SYN Flag Anomaly
TCP RST Flag Anomaly
IP NULL (Proto 0) Anomaly
IP Fragmentation Anomaly
IP Private Address Space Anomaly
22
Misuse Anomalies - Dark IP
23
Fingerprint/Worm Anomalies(1)
24
Tracing Anomalies



Automatically trace the source and destination IP/Port,
TCP Flag of abnormal traffic.
Distribution of attack traffic by source and destination
IP/Port.
Trace the network device that the abnormal traffic pass
through.
25
Prevent/Mitigate Network-wide Anomalies

System can recommend appropriate mitigation
measures to mitigate anomalies such as DoS attack and
worm outbreaks.



Generate recommended ACLs or rate limit commands.
Blackhole routing
Sinkhole routing
26
Alert

BGP



Data Source





BGP Instability
BGP Route Hijacking
BGP Down
Flow Down
SNMP Down
DoS Alert
Interface Usage: traffic exceeded configured baseline
Use E-mail, SNMP Traps, Syslog etc to notify
network administrators.
27
Thank you !