FLOW-TOOLS-EXAMPLES(1)

💖 NAME 💖

okay bestie, welcome to flow-tools-examples(1) — this is literally the vibe-board of the flow-tools fam ✨ it's a whole collection of example usage of flow-tools, no cap. Like, actual real-world "here's how you'd set this up on your routers and then query the flows" energy. Come learn with me 🫶

---

🎀 EXAMPLE - CONFIGURING CISCO IOS ROUTER 🎀

So NetFlow gets configured on each input interface, and then you use global commands to say where the exports go. And to make sure the source address stays consistent, Loopback0 is configured as the export source. Periodt.

ip cef distributed
ip flow-export version 5 origin-as
ip flow-export destination 10.0.0.100 5004
ip flow-export source Loopback0

interface Loopback0
 ip address 10.1.1.1 255.255.255.255

interface FastEthernet0/1/0
 ip address 10.0.0.1 255.255.255.0
 no ip directed-broadcast
 ip route-cache flow
 ip route-cache distributed

There are so many other options too, like aggregated NetFlow and sampled NetFlow, and all of that is detailed over at <URL:http://www.cisco.com>. iykyk 💅

---

🌈 EXAMPLE - CONFIGURING CISCO CATIOS SWITCH 🌈

okay this one's giving plot twist — some Cisco Catalyst switches support a different implementation of NetFlow that runs on the supervisor. Let me break it down 🧚

• With the cache based forwarding model — which is what's implemented in the Catalyst 55xx with Route Switch Module (RSM) and NetFlow Feature Card (NFFC) — the RSM processes the first flow, and the remaining packets in that flow get forwarded by the Supervisor. This is also implemented in the early versions of the 65xx with MSFC.
• The deterministic forwarding model used in the 65xx with MSFC2 does not use NetFlow to determine the forwarding path — the flow cache is only used for statistics, just like in the current IOS implementations.

In all of the above configurations, flow exports arrive from both the RSM/MSFC and the Supervisor engines as distinct streams. And in the worst case, the RSM exports in version 5 while the Supervisor exports in version 7 😭 Fortunately flow-capture and flow-receive can sort all this out by processing flows from both sources and converting them to a common export format. slay.

The router side running IOS is configured identically to the example given above. The CatIOS NetFlow Data Export configuration follows:

set mls flow full
set mls nde version 7
set mls nde 10.0.0.1 9800
set mls nde enable

And when the 65xx is running in Native mode, from a user's perspective the switch is only running IOS. iconic.

More detailed examples can be found on Cisco's web site <URL:http://www.cisco.com>.

---

🦋 EXAMPLE - CONFIGURING JUNIPER ROUTER 🦋

Juniper supports flow exports by having the routing engine sample packet headers and aggregate them into flows. Packet sampling is done by defining a firewall filter to accept and sample all traffic, applying that rule to the interface, and then configuring the sampling forwarding option. the way that works is lowkey elegant ✨

interfaces {
    ge-0/3/0 {
        unit 0 {
            family inet {
                filter {
                    input all;
                    output all;
                }
                address 10.0.0.1/24;
            }
        }
    }

firewall {
    filter all {
        term all {
            then {
                sample;
                accept;
            }
        }
    }
}

forwarding-options {
    sampling {
        input {
            family inet {
                rate 100;
            }
        }
        output {
            cflowd 10.0.0.100 {
                port 9800;
                version 5;
            }
        }
    }
}

Other options exist too, like aggregated flows, which are detailed at <URL:http://www.juniper.net>.

---

🌸 EXAMPLE - NETWORK TOPOLOGY AND FLOW.ACL 🌸

This network topology and flow.acl are gonna be used for so many of the examples that follow, so pay attention bestie 👑 Flows are collected and stored in /flows/R.

                       ISP-A       ISP-B
                         +           +
                          +         +
            IP=10.1.2.1/24 +       + IP=10.1.1.1/24
                 ifIndex=2  +     +  ifIndex=1
       interface=serial1/1   +   +   interface=serial0/0
                             -----
                             | R | Campus Router
                             -----
                             +   +
           IP=10.1.4.1/24   +     +   IP=10.1.3.1/24
                ifIndex=4  +       +  ifIndex=3
    interface=Ethernet1/1 +         + interface=Ethernet0/0
                         +           +
                       Sales      Marketing

ip access-list standard sales permit 10.1.4.0 0.0.0.255
ip access-list standard not_sales deny 10.1.4.0 0.0.0.255
ip access-list standard marketing permit 10.1.3.0 0.0.0.255
ip access-list standard not_marketing deny 10.1.3.0 0.0.0.255
ip access-list standard campus permit 10.1.4.0 0.0.0.255
ip access-list standard campus permit 10.1.3.0 0.0.0.255
ip access-list standard not_campus deny 10.1.4.0 0.0.0.255
ip access-list standard not_campus deny 10.1.3.0 0.0.0.255
ip access-list standard evil_hacket permit host 10.6.6.6
ip access-list standard spoofer permit host 10.9.9.9
ip access-list standard multicast 224.0.0.0 15.255.255.255

---

💀 EXAMPLE - FINDING SPOOFED ADDRESSES 💀

A super common problem on the Internet is the use of "spoofed" addresses — like, addresses that are not assigned to an organization — for use in DoS attacks, or for compromising servers that rely on the source IP address for authentication. not the vibe 😭

Display all flow records that originate from the campus and are sent to the Internet but are not using legal addresses.

flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-print

Summary of the destinations of the internally spoofed addresses, sorted by octets.

flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f8 -S2

Summary of the sources of the internally spoofed addresses, sorted by flows.

flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f9 -S1

Summary of the internally spoofed source and destination pairs, sorted by packets.

flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f10 -S4

Display all flow records that originate external to the campus that have campus addresses. A lot of the time these can be attackers trying to exploit host based authentication mechanisms like unix r* commands. Another common source is mobile clients which send packets with their campus addresses before obtaining a valid IP. 🫠

flow-cat /flows/R | flow-filter -Scampus -i1,2 | flow-print

Summary of the destinations of the externally spoofed addresses, sorted by octets.

flow-cat /flows/R | flow-filter -Scampus -i1,2 | flow-stat -f8 -S2

---

🔥 EXAMPLE - LOCATE HOSTS USING OR RUNNING SERVICES 🔥

Find all SMTP servers active during the collection period that have established connections to the Internet. Summarize sorted by octets.

flow-cat /flows/R | flow-filter -I1,2 -P25 | flow-stat -f9 -S2

Find all outbound NNTP connections to the Internet. Summarize with source and destination IP sorted by octets.

flow-cat /flows/R | flow-filter -I1,2 -P119 | flow-stat -f10 -S3

Find all inbound NNTP connections to the Internet. Summarize with source and destination IP sorted by octets.

flow-cat /flows/R | flow-filter -i1,2 -P119 | flow-stat -f10 -S3

---

⭐ EXAMPLE - MULTICAST USAGE ⭐

Summarize Multicast S,G where sources are on campus.

flow-cat /flows/R | flow-filter -Dmulticast -I1,2 | flow-stat -f10 -S3

Summarize Multicast S,G where sources are off campus.

flow-cat /flows/R | flow-filter -Dmulticast -i1,2 | flow-stat -f10 -S3

---

🕵️ EXAMPLE - FIND SCANNERS 🕵️

Find SMTP scanners with flow-dscan. ngl this will also find SMTP clients which try to contact many servers — that behavior is characterized by a recent Microsoft worm, so don't come for me when it shows up 😅

touch dscan.suppress.src dscan.suppress.dst

flow-cat /flows/R | flow-filter -P25 | flow-dscan -b

---

💜 AUTHOR 💜

Mark Fullmer <maf@splintered.net> — the icon, the moment, the blueprint 👑

---

🌟 SEE ALSO 🌟

• flow-tools(1)

---

and that's the whole page bestie!! 🎀 this lil' beauty is from the FLOW-TOOLS-EXAMPLES(1) era, dated 26 Август 2010, and it's all here so you can read it, love it, and live it. go forth and parse some flows 💅✨🦋