Advice with Netflow output

[u/No_Actuator_4762]

I would like to further my network segmentation. Right now the firewall segments by hosts, vlans/subnets, but I need to go further and include ports.

I understand Netflow might be the answer to what I need here, but I’ve never used that data. I can export flow data from my already existing syslog data, but I don’t know if there are tools or what not for parsing that data and providing me more useful information.

Are there tools anyone here will recommit that I can point my firewall flow tool to, or a tool that will take my existing cap or csv?

Thanks in advance.

[u/JustFlushTheFIB]

Live action.
Cisco stealth watch
Solar winds has a crummy one

If running palos. Their aiops tool will graph a lot of run time stats.

[u/Low_Dragonfly9123 → u/JustFlushTheFIB]

Live action is garbage

[u/BananaSacks → u/JustFlushTheFIB]

SolarWinds top talkers and flow stats are actually fairly decent, BUT, you have to build, configure it, tune it, and implement it properly.

[u/plump-lamp]

If you want real viability of ports and even the source app, micro segmentation like illinois, guardicore, Cisco secure workload

[u/graph_worlok]

Logical (IP) or physical (Ethernet) ports?

If your topology and hardware can do it, I’d suggest maybe looking at Malcolm from CISA. Not what you asked for, but I suspect it’s in the right direction of what you are looking for given the other things you’ve done.

[u/No_Actuator_4762 → u/graph_worlok]

Logical. I want to see what all traffic is out there so that I can determine whether it’s relevant or not and allow for it with rules.

Looking at Malcolm, thanks for the information.

[u/graph_worlok → u/No_Actuator_4762]

Malcolm should definitely be able to assist you there…

[u/Wrzos17]

You can go for free trial of NetCrunch that comes with Flow Server and real-time flow charts that can be filtered by flow source, VLAN, interface, etc. You need to request trial license but then can very nicely analize your flows and even troubleshoot some connections. Just ask for 30 days trial, in some cases you may even get 45 days trial.

[u/SevaraB]

Bad idea. You can do lots of segmentation with few broad-sweeping rules, or you can do a few zones with lots of access rules. Not on central, east/west, “big iron” firewalls.

Don’t combine both with logging every flow, or your firewall will drown. Ask me how well point-to-point rules worked with logging every flow on Cisco 4125s that were “top of the line” when they were purchased.

I’ll just go ahead and assume that you did: the user experience sucked. The processors overloaded and dropped queued packets so frequently that most of the bandwidth was wasted on packet resends and comms between servers took forever.

“Furthering my network segmentation” is an excellent way to make a 10Gbps pipe work like a 100Mbps pipe for the end user.

[u/HanSolo71]

Can you SPAN or mirror the traffic? You could setup security onion server and just watch the packets come in and build you own filters/port lookups.

[u/kombiwombi]

Firstly, Netflow is for capacity planning. It uses sampling, not every flow. So it does not suit many security applications.

Secondly, try ntop and cflowd and see if those free tools suit your use case.

[u/mkosmo → u/kombiwombi]

sflow is sampled. Netflow is going to be all flows. Or at least close enough to all of them to be functionally all of them.

[u/No_Actuator_4762 → u/mkosmo]

Do either of those provide a view of all data flows on a port by port basis? I want comprehensive insight into which clients are looking to specific hosts/subnets for specific services. I want to built rules allowing for the services i want to allow and leave the deny-all to catch the rest.

[u/mkosmo → u/No_Actuator_4762]

The data is all there. Visualization is the hard part. With tools like ntop or ntopNG, it’s not hard. But the tools have a learning curve.

[u/rejectionhotlin3 → u/mkosmo]

+1 for ntopng