Implementation of data collection tools using NetFlow for statistical ...

4 Implementation
• Once an attack was in place from another AS, the amount of flows, packets and bytes
received would increase rapidly and cause a spike in the graphed data for that particular AS,
indicating there might be a problem.
• Focusing on that particular AS with a new tag, named [attack] would yield the wanted
detailed information such as IP addresses of the sender and receiver, bytes sent and received
as well the number of packets sent.
With this in mind, the pmacct configuration took place and divided the traffic accordingly. The
configuration used several individual configuration files in order to accomplish the tagging
procedure. The main configuration was done in the regular configuration file with the BGP peering
being done in the configuration file agent.map, which was referenced to from the main
configuration. The act of tagging traffic was done in pretag.map, in which I2B would change the
configuration and focus on the attacking AS and thus give them the detailed information they would
require.
See the appendix, chapter 8.5 and it's sub-chapters for the configuration.
The amount of traffic sent to the Linux machine from the small router turned out to be more than
estimated, however very manageable. Observation showed that close to 20gb data was sent per day,
all of it being flow data. Considering that the only thing being sent is the header information itself
and that a TCP header is only 20 bytes in size, this amounts to quite a lot of data.
4.3.2 Storing the data – solution
MySQL was configured with a default configuration with the decision that a default configuration
would suffice, given the approximated small load. Fine-tuning for optimal performance was
therefore not necessary. A graphical front end called phpMyAdmin was however installed to help
visualize the collected data.
The computer hardware turned out to be more than sufficient, after both testing and hearing about a
case-study peering at AS286 in which pmacct was running on a dual-core CPU with 4GB RAM and
collecting data from a 250+ Gbps routing-domain [53].
33