Implementation of data collection tools using NetFlow for statistical ...

3 Problem analysis
3 Problem analysis
The assignment revolves around the pmacct software suite. Hence, obtaining and configuring a
working Linux machine with the appropriate software is required. The machine itself should
preferably be plugged in to the network close to the core router in order to avoid unnecessary
overhead by having the NetFlow traffic passing through multiple switches and routers, as the
amount of data will probably be significant.
3.1 Collecting the data
Collecting all traffic from every entry-point at I2B could generate an unnecessary load on the
network and its devices. A way of lessening or compressing the data might be required. The file size
of the logs may grow up to a point of not becoming manageable, since the entire BGP routing table
will be logged. The hardware on the computer must also be taken into consideration, such as the
amount of CPU cores and the amount of RAM available. Tools for monitoring disk I/O may be
needed in order to find -and assess- certain bottlenecks such as the file containing the routing table.
If the disk I/O is too intense and begin to affect normal computer operations, keeping the logs on
another drive might be needed.
3.1.1 Protocol decision
Decision about which flow-protocol to use must be decided; NetFlow, sFlow or IPFIX are the most
prevalent; each protocol presents its own benefits and drawbacks. These protocols must be
examined and evaluated and a conclusion must be made as to which will be used. A balance must
therefore be reached between operability of the protocols and the current topology in use by the
service provider.
3.1.2 Choice of NetFlow-collector
Configuration of the chosen NetFlow-collector would be needed in order to tag and save the desired
information, as well as to implement a feasible method for mitigating DDoS attacks. Since the
company wanted to evaluate pmacct, the choice has already been made. A brief summary of the
different programs available should nonetheless be mentioned. See chapter 4.1.1 for more
information.
3.1.3 Network configuration
BGP peering between the core router and the software router, Quagga, need to be configured and
established since Quagga provides the pmacct suite with a routing table as well as BGP AS
information. Extra thought and careful planning need to be given to the configuration between the
two as this will be done live. Wrongful configuration could end up interrupting the traffic for the
company's customers and steps need to be taken to minimize any such damage, should it occur.
3.2 Storing the data
The collected data need to be stored to allow for a historical view. This can be a either long-term
25