2

We had DDoS couple days ago and following is netflow data but i am confused with numbers which i am seeing here.

If you look at first Bytes(%) column 67.2 G(80.6) so it's in GB what does this means? I have checked network interface graph and i am seeing only 2G spike in link. 

Top 10 IP Addr ordered by packets:
Date first seen          Duration Proto           IP Addr    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp
2017-01-02 13:49:03.031   960.927 any        70.xx.xx.26    18659( 1.5)   52.3 M(29.4)   67.2 G(80.6)    54456  559.6 M  1284
2017-01-02 13:56:24.412   258.948 any       23.xx.xx.62        9( 0.0)   15.8 M( 8.9)   21.9 G(26.3)    60904  677.0 M  1389
2017-01-02 13:49:02.981   961.013 any         70.xx.xx.6    76721( 6.0)   15.3 M( 8.6)    2.1 G( 2.5)    15957   17.4 M   136
2017-01-02 13:49:03.029   960.970 any         70.xx.xx.5    76277( 5.9)   15.1 M( 8.5)    2.1 G( 2.5)    15675   17.1 M   136

EDIT

Netflow config:

flow record netflow-record
 match ipv4 destination address
 match ipv4 source address
 match transport destination-port
 match transport source-port
 match ipv4 protocol
 collect counter bytes
 collect counter packets
 collect timestamp sys-uptime first
 collect timestamp sys-uptime last
!
flow exporter netflow-exporter
 destination x.x.x.x
 source TenGigabitEthernet0/0/0
 transport udp 9995
!
flow monitor netflow-monitor
 exporter netflow-exporter
 cache timeout active 60
 record netflow-record
Improve this question
7
  • 1
    Are you sure you configured the netflow sampling rate configured on the router in nfsen? If you don't you, you can get numbers which are way off.
    – Teun Vink ♦
    Jan 3 '17 at 21:19
  • I have updated question with config, what is default sample rate? should i adjust that ?
    – Satish
    Jan 4 '17 at 16:51
  • One thing you need to be aware of is where you apply NetFlow. If you don't carefully plan, you will get multiples of the real values. For instance, if you record as it enters a device, and you record as it leaves a device, you will get double counts. Normally, you pick a single direction.
    – Ron Maupin ♦
    Jan 4 '17 at 16:53
  • I have no idea what the default is (and I don't use Cisco routers), but be sure to use the same sampling rate on your router and in your nfsen config. And as @RonMaupin said, make sure you don't count traffic twice.
    – Teun Vink ♦
    Jan 4 '17 at 16:56
  • @RonMaupin we are using only for inbound traffic to get alert for DDoS
    – Satish
    Jan 4 '17 at 16:57
2

The column "Bytes(%)" refers to the total volume of data coming from and going to that host during the sampling interval (~960 seconds for 3 of the flows and ~260 for the fourth) and the percentage of all data this number represents in the overall interval while, in contrast, "bps" refers to average bits per second during the individual interval - so ostensibly (bytes * 8) / (interval in seconds).

The percentages add up to over 100% - which is why I think this table is actually capturing total data to- and from- the IP's in question and that it's likely that some amount of this traffic could be between some of these hosts. A top-n table based on source + destination or, better still, source IP + destination subnet might be more illuminating and should be pretty easy to generate from the data.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.