tag:blogger.com,1999:blog-24661149932076672872011-11-27T19:22:30.435-05:00Networking Tips and Tricks from a self-admitted dorkTomhttp://www.blogger.com/profile/05660576820598168926noreply@blogger.comBlogger21100tag:blogger.com,1999:blog-2466114993207667287.post-31465278134142675312009-04-28T18:54:00.004-04:002009-04-28T19:20:08.811-04:00Recently, I've been working alot with Netflow trying to nail down a particular problem, so I thought it would be a good topic to discuss.<br /><br /><span style="font-weight: bold;">What is Netflow?</span><br /><br />Cisco developed the Netflow protocol to provide a method of IP accounting. Although it began as a proprietary protocol, Netflow has been supported on other platforms such as Juniper's JunOS.<br /><br />Multiple versions of the protocol are defined. Version 5 is the most common, and what most administrators would use.<br /><span style="font-weight: bold;"><br />So what exactly is a flow?</span><br /><br />A flow is a unidirectional packet stream that all share common attributes. Those attributes are:<br /><ul><li>Source and destination IP</li><li>Source and destination port (Can also be 0 for non-TCP/UDP traffic, or type codes for ICMP)</li><li>IP Protocol</li><li>Ingress Interface</li><li>Type of Service</li></ul>If you think it through, it's not as complicated as it sounds. The important thing to remember is the unidirectional aspect of it. When you load up this site, there is a packet stream from you to the web server, and there is another packet stream from the web server to you. There is a distinct <span style="font-weight: bold;">flow</span> of data in each direction, and thus, two flows. Firewall and security junkies will instinctively think of this as a single connection, but don't let that trip you up.<br /><br /><span style="font-weight: bold;">So why is this useful?</span><br /><br />Basic network monitoring tools will show you a link's utilization, but don't tell you much about what that traffic actually is. Netflow allows you to 'drill down' into the traffic, and see who is doing what, and where.<br /><br />In future posts, I'll talk about the different ways to configure and use Netflow to help analyze and troubleshoot your networks.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2466114993207667287-3146527813414267531?l=ciscodork.blogspot.com' alt='' /></div>Tomhttp://www.blogger.com/profile/05660576820598168926noreply@blogger.com0tag:blogger.com,1999:blog-2466114993207667287.post-27789849181213376872009-04-24T11:28:00.003-04:002009-04-24T16:35:59.457-04:00After some prompting from some friends, I've decided to enter the blogging world. I thought that I would begin with something I know very well: Networking.<br /><br />I've used many a blog post over the years to help solve a particular problem, and decided that it's only right to give back. Hopefully the tips and tricks I can share will be helpful for someone else down the road!!<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/2466114993207667287-2778984918121337687?l=ciscodork.blogspot.com' alt='' /></div>Tomhttp://www.blogger.com/profile/05660576820598168926noreply@blogger.com0