North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Interesting netflow entry

  • From: Bill Nash
  • Date: Mon Feb 06 18:28:34 2006 
On Mon, 6 Feb 2006, Wil Schultz wrote:


Here is another pattern, sourced off of one the destinations:
[snip]

You may find it far simpler to just ask the person who owns the sources that those packets are. While this may not be politically feasible (insert network and privacy policies here), given the amount of VPN traffic that's encapsulated in UDP, that may be anything. The problem with netflow is that it does reveal many interesting, hypnotic patterns inside your network. Having spent my share of time on the receiving end of that lunacy, I can only offer this advice: Drinking from the firehose is only funny for a little while.

Depending on your deployment method (transit flow monitoring vs locally sourced, data center vs office campus, college campus vs four hippies with tin cans), identifying flows may be far easier if you have a network inventory to refer to. Even something as simple as parsing XML output from NMAP into a db will give you better insight into what your flows are.

Incidentally (because I ask everyone this), what's your flow volume (flows per second)?

- billn