mcetech2006adulau

TODO

• Find the correct term for "netflow-technologies". What is the standard terminology ?
  • Do we use inventory ? cartography ? What is the difference ? only on representation ? more ?
• Find a correct definition of "netflow-technologies".
  • From some paper: "flow is a sequence of packets matching"
    • From me: "flow is a set of packets having common characteristics"
• Existing paper and references. link on references to paper clearly covering the aspect we target.
• "" Double quote mean we have to find a better term.
• topology, cartography, typology, classification, taxinomy

Using flow-based IP traffic measurement for network security, discovery and inventory: a practical approcach on a satellite operator network

Abstract

Software using TCP/IP model as an underlying layer for communication is very common in various large-scale production network. The behavior of software and its interaction within the network is very different following various aspect from software design, application operation to configuration. The analysis of the networked interactions from software components permits to better understand the operation of the software, design network structure, enforce a network security policy or debug communication. Prior to securing a network, crippled with legacy byzantine applications, a huge cartography work has to be undertaken to classify the network nodes and applications' behavior. Flow-based IP traffic measurement as popularized with Cisco NetFlow?, provides a solution to the discovery and inventory of these network interactions not a perfect approach but give already a starting technological tool. As the tool is only covering specific aspect of collection, a customized framework using FLOSS (Free/Libre and Open Source Software) tools has to be build on top to meet the expectation. Our expectation was to build a cartography of the operational network of the satellite operator infrastructure. Our approach is quite generic and could be applied to any other TCP/IP networks used for operational activities. By the use of the flow-based technology, we discovered some potential lacks on the technical and procedural aspects. Flow-based technologies for IP traffic measurement is still in the early stage of large adoption in the industry. Therefore the tools in use to mine the data collected with such technologies are often immature. From our practical point of view, we propose some tracks to improve flow-based analysis as well as the surrounding research.

Authors

Introduction

An intro "Netflow-technologies" correct term ?

What we want ? by doing the analysis

Research track to be explored

Conclusion

Misc metaphysical questions

What makes our status of satellites operators interesting to others regarding the subject ? I mean, NetFlow? analysis presented by a SP is interesting, due to the volume of traffic dealed with. What makes our experience on the SOC network interesting to others ? The pervasiveness of byzantine applications, using dynamic ports, not documented, and so on ? this is indeed a good playground to work on cartography problematics. Should we not cheat a bit and wear also a SP hat ? (which we have) . What worries me is that if we say "we work on 30 flows/s" this is not very spectacular, to say the least. Hell, we could as well use a full pcap capture, it would still be manageable on the SOC. And this is at best misleading, because our experience and knowledge go way beyond the problematics faced on the SOC

> We can find a way to mix both.

Official abstract structure

1. A tentative title

• Security in wild area networks: a flow-based IP traffic measurement approach to network domestication

2. Authors, and their affiliation

• Alexandre Dulaunoy, SES ASTRA
• Yann Berthier, SES ASTRA

3. Author for correspondence

Alexandre Dulaunoy, adulau@foo.be

4. Keywords that best describe the contents of the paper. Make sure to include the industry, and the problem area (e.g., “automative industry, e-procurement”)

flow-based IP traffic measurement, NetFlow?, Network Security, Network Analysis, Network Cartography

5. A description of the problem

Prior to securing a network, crippled with legacy byzantine applications, a huge cartography work has to be undertaken to classify the network nodes and applications' behavior.

6. A description of existing approaches and of their adverstised benefits

As traditional network capture does not play well on Gigabit Ethernet links, other approaches must be taken to fit the needs of the analysis.

7. A description of the challenges you faced when applying existing approaches, or of the benefits you realized (or losses you incurred) when adopting such approaches

flow-based technologies for IP traffic measurement is still in the early stage of large adoption in the industry. By that, the tools to use and mind the data provided by such technologies are still more younger.

8. A description of the contents of your paper

Paper structure

An introduction to flow-based technologies for IP traffic measurement

NetFlow as a use case

Other "for information"

1 paragraph of others flow-based technology.

Particularisms from an analyst's point of view

• No payload
• Uni-directional
• Long traffic streams span multiple flow records
• IP centric
• Some fields may not be populated

Situation of industrial and telecom networks

Industrial networks have often grown in an organic way regarding evolution of their topologies but also regarding the technologies used. Historicaly the topology of industrial networks were composed of very separated components with no or small interaction to the other networks. These separation were by effect creating various islands in the system and provided a kind of security due to the separation. The different proprietary network and bus protocols used were preventing the various systems to communicate by default. The effect was also the limitation of the risk associated of an open network.

Internet-based technologies (footnote : We mean by interned-based technologies using the TCP/IP model and application protocols often defined/standardzed by the IETF) were introduced in the industrial sector to optimize efficiency and interoperability of components. But sometimes, the security process is neglected and the ease of building interoperable compents are creating a (ref: www.hse.gov.uk/research/crr_pdf/2002/crr02408.pdf - Safety implications of industrial uses of internet technology) new security and safety risks. Flow-based IP traffic measurement plays an important role here to bring new tools and process in a highly connected environment.

Telecom side (industrial side + larger risks, volume of data to analyze, growing/instable networks, depends on interaction to others)…

-→ a satellite operator is often playing into the two fields : industrial and telecom. It's understood that the two fields are often not linked but it's generally accepted that's a company wide process this can be cross-linked on an operational interdependency perspective (e.g. in a satellite operator network, the need to get telemetry data from Satellites in order to provide Internet connectivity in the other services).

Technical approach used with flow-based technologies

A demonstration of the empirical approach.

The use of nfdump. (why ? background of nfdump (ref: RIPE presentation support))

• Data storage perspective

The use of time sliced storage, the nfdump data storage structure.

• Query perspective
• Representation perspective

the use of nfsen. (why ?)

Outcome from the analysis

• Software implementing flow-based IP traffic measurement is still young (collection);
  • Storage strategy may evolved in the following years by the need to handle larger volume,
  • Due to the convergence and the multitude of Internet-based technologies the kind of queries on the flow-based data will become more complex,
  • The two points (data storage and querying) are linked together on the software design perspective. e.g. queries on long-term flow for forensic analysis reasons
• On exporter side ( ref: New directions in traffic measurement and accounting), can we conclude something ? version ? the lack of unified behavior ?

Evolution needed in the flow-based technologies

Conclusion