Network Security with NetFlow and IPFIX

Omar Santos is a Principal Engineer in the Cisco Product Security Incident Response Team (PSIRT) part of Cisco’s Security Research and Operations. He mentors and leads engineers and incident managers during the investigation and resolution of security vulnerabilities in all Cisco products. Omar has been working with information technology and cyber security since the mid-1990s. Omar has designed, implemented, and supported numerous secure networks for Fortune 100 and 500 companies and for the U.S. government. Prior to his current role, he was a Technical Leader within the World Wide Security Practice and the Cisco Technical Assistance Center (TAC), where he taught, led, and mentored many engineers within both organizations.Omar is an active member of the security community, where he leads several industrywide initiatives and standard bodies. His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants that are dedicated to increasing the security of the critical infrastructure.Omar is the author of several books and numerous whitepapers, articles, and security configuration guidelines and best practices. He has also delivered numerous technical presentations at many conferences and to Cisco customers and partners, in addition to many C-level executive presentations to many organizations. Omar is the author of the following Cisco Press books: CCNA Security 210-260 Official Cert Guide, ISBN-13: 9781587205668Deploying Next-Generation Firewalls Live Lessons, ISBN-13: 9781587205705Cisco’s Advanced Malware Protection (AMP), ISBN-13: 9781587144462Cisco ASA Next-Generation Firewall, IPS, and VPN Services (3rd Edition), ISBN-10: 1587143070Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance (2nd Edition), ISBN-10: 1587058197Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance, ISBN-10: 1587052091Cisco Network Admission Control, Volume: Deployment and Management, ISBN-10: 1587052253End-to-End Network Security: Defense-in-Depth, ISBN-10: 1587053322

• Introduction xviChapter 1 Introduction to NetFlow and IPFIX 1Introduction to NetFlow 1The Attack Continuum 2The Network as a Sensor and as an Enforcer 3What Is a Flow? 4NetFlow Versus IP Accounting and Billing 6NetFlow for Network Security 7Anomaly Detection and DDoS Attacks 8Data Leak Detection and Prevention 9Incident Response and Network Security Forensics 9Traffic Engineering and Network Planning 14IP Flow Information Export 15IPFIX Architecture 16IPFIX Mediators 17IPFIX Templates 17Option Templates 19Introduction to the Stream Control Transmission Protocol (SCTP) 19Supported Platforms 20Introduction to Cisco Cyber Threat Defense 21Cisco Application Visibility and Control and NetFlow 22Application Recognition 22Metrics Collection and Exporting 23Management and Reporting Systems 23Control 23Deployment Scenarios 24Deployment Scenario: User Access Layer 24Deployment Scenario: Wireless LAN 25Deployment Scenario: Internet Edge 26Deployment Scenario: Data Center 28Public, Private, and Hybrid Cloud Environments 32Deployment Scenario: NetFlow in Site-to-Site and Remote VPNs 33NetFlow Remote-Access VPNs 33NetFlow Site-to-Site VPNs 34NetFlow Collection Considerations and Best Practices 35Determining the Flows per Second and Scalability 36Summary 37Chapter 2 Cisco NetFlow Versions and Features 39NetFlow Versions and Respective Features 39NetFlow v1 Flow Header Format and Flow Record Format 40NetFlow v5 Flow Header Format and Flow Record Format 41NetFlow v7 Flow Header Format and Flow Record Format 42NetFlow Version 9 43NetFlow and IPFIX Comparison 57Summary 57Chapter 3 Cisco Flexible NetFlow 59Introduction to Cisco’s Flexible NetFlow 59Simultaneous Application Tracking 60Flexible NetFlow Records 61Flexible NetFlow Key Fields 61Flexible NetFlow Non-Key Fields 63NetFlow Predefined Records 65User-Defined Records 65Flow Monitors 65Flow Exporters 65Flow Samplers 66Flexible NetFlow Configuration 66Configure a Flow Record 67Configuring a Flow Monitor for IPv4 or IPv6 69Configuring a Flow Exporter for the Flow Monitor 71Applying a Flow Monitor to an Interface 73Flexible NetFlow IPFIX Export Format 74Summary 74Chapter 4 NetFlow Commercial and Open Source Monitoring and Analysis Software Packages 75Commercial NetFlow Monitoring and Analysis Software Packages 75Lancope’s StealthWatch Solution 76Plixer’s Scrutinizer 79Open Source NetFlow Monitoring and Analysis Software Packages 80NFdump 81NfSen 86SiLK 86SiLK Configuration Files 87Filtering, Displaying, and Sorting NetFlow Records with SiLK 87SiLK’s Python Extension 88Counting, Grouping, and Mating NetFlow Records with Silk 88SiLK IPset, Bag, and Prefix Map Manipulation Tools 88IP and Port Labeling Files 89SiLK Runtime Plug-Ins 89SiLK Utilities for Packet Capture and IPFIX Processing 90Utilities to Detect Network Scans 90SiLK Flow File Utilities 90Additional SiLK Utilities 91Elasticsearch, Logstash, and Kibana Stack 92Elasticsearch 92Logstash 92Kibana 93Elasticsearch Marvel and Shield 94ELK Deployment Topology 94Installing ELK 95Installing Elasticsearch 96Install Kibana 105Installing Nginx 106Install Logstash 107Summary 109Chapter 5 Big Data Analytics and NetFlow 111Introduction to Big Data Analytics for Cyber Security 111What Is Big Data? 111Unstructured Versus Structured Data 112Extracting Value from Big Data 113NetFlow and Other Telemetry Sources for Big Data Analytics for Cyber Security 114OpenSOC 115Hadoop 116HDFS 117Flume 119Kafka 120Storm 121Hive 122Elasticsearch 123HBase 124Third-Party Analytic Tools 125Other Big Data Projects in the Industry 126Understanding Big Data Scalability: Big Data Analytics in the Internet of Everything 127Summary 128Chapter 6 Cisco Cyber Threat Defense and NetFlow 129Overview of the Cisco Cyber Threat Defense Solution 129The Attack Continuum 130Cisco CTD Solution Components 131NetFlow Platform Support 133Traditional NetFlow Support in Cisco IOS Software 133NetFlow Support in Cisco IOS-XR Software 135Flexible NetFlow Support 135NetFlow Support in Cisco ASA 140Deploying the Lancope StealthWatch System 140Deploying StealthWatch FlowCollectors 142StealthWatch FlowReplicators 146StealthWatch Management Console 146Deploying NetFlow Secure Event Logging in the Cisco ASA 148Deploying NSEL in Cisco ASA Configured for Clustering 151Unit Roles and Functions in Clustering 152Clustering NSEL Operations 152Configuring NSEL in the Cisco ASA 153Configuring NSEL in the Cisco ASA Using ASDM 153Configuring NSEL in the Cisco ASA Using the CLI 155NSEL and Syslog 156Defining the NSEL Export Policy 157Monitoring NSEL 159Configuring NetFlow in the Cisco Nexus 1000V 160Defining a Flow Record 161Defining the Flow Exporter 162Defining a Flow Monitor 163Applying the Flow Monitor to an Interface 164Configuring NetFlow in the Cisco Nexus 7000 Series 164Configuring the Cisco NetFlow Generation Appliance 166Initializing the Cisco NGA 166Configuring NetFlow in the Cisco NGA via the GUI 168Configuring NetFlow in the Cisco NGA via the CLI 169Additional Cisco CTD Solution Components 171Cisco ASA 5500-X Series Next-Generation Firewalls and the Cisco ASA with FirePOWER Services 171Next-Generation Intrusion Prevention Systems 172FireSIGHT Management Center 173AMP for Endpoints 173AMP for Networks 176AMP Threat Grid 176Email Security 177Email Security Appliance 177Cloud Email Security 179Cisco Hybrid Email Security 179Web Security 180Web Security Appliance 180Cisco Content Security Management Appliance 184Cisco Cloud Web Security 185Cisco Identity Services Engine 186Summary 187Chapter 7 Troubleshooting NetFlow 189Troubleshooting Utilities and Debug Commands 189Troubleshooting NetFlow in Cisco IOS and Cisco IOS XE Devices 194Cisco IOS Router Flexible NetFlow Configuration 195Troubleshooting Communication Problems with the NetFlow Collector 201Additional Useful Troubleshooting Debug and Show Commands 204Verifying a Flow Monitor Configuration 204Displaying Flow Exporter Templates and Export IDs 207Debugging Flow Records 212Preventing Export Storms with Flexible NetFlow 213Troubleshooting NetFlow in Cisco NX-OS Software 214Troubleshooting NetFlow in Cisco IOS-XR Software 217Flow Exporter Statistics and Diagnostics 219Flow Monitor Statistics and Diagnostics 222Displaying NetFlow Producer Statistics in Cisco IOS-XR 226Additional Useful Cisco IOS-XR Show Commands 228Troubleshooting NetFlow in the Cisco ASA 228Troubleshooting NetFlow in the Cisco NetFlow Generation Appliance 235Gathering Information About Configured NGA Managed Devices 235Gathering Information About the Flow Collector 236Gathering Information About the Flow Exporter 237Gathering Information About Flow Records 237Gathering Information About the Flow Monitor 238Show Tech-Support 239Additional Useful NGA show Commands 245Summary 246Chapter 8 Case Studies 247Using NetFlow for Anomaly Detection and Identifying DoS Attacks 247Direct DDoS Attacks 248Reflected DDoS Attacks 248Amplification Attacks 249Identifying DDoS Attacks Using NetFlow 250Using NetFlow in Enterprise Networks to Detect DDoS Attacks 250Using NetFlow in Service Provider Networks to Detect DDoS Attacks 253Using NetFlow for Incident Response and Forensics 254Credit Card Theft 254Theft of Intellectual Property 259Using NetFlow for Monitoring Guest Users and Contractors 262Using NetFlow for Capacity Planning 267Using NetFlow to Monitor Cloud Usage 269Summary 271TOC, 9781587144387, 8/25/2015