Educación de usuarios

(sorting by field or displaying select fields) can answer a number of questions:

1. Is there a standard bytes-per-packet ratio? Do any bytes-per-packet ratios fall outside the baseline? 2. Do any sessions’ byte counts, packet counts, or other fields fall outside the norm?

There are many such questions to ask, but keep the focus of exploration on the behavior being examined. Chasing down weird cases is tempting but can add little understanding of network behavior.

3.7

Counting Flows with rwuniq

rwuniq, summarized in Figure 3.12, is a general-purpose counting tool: It provides counts of the records, bytes, and packets for any combination of fields, including binning by time intervals. Flow records need not be sorted before being passed to rwuniq. If the records are sorted in the same order as indicated by the --fields parameter to rwuniq, using the --presorted-input parameter may reduce memory requirements forrwuniq.

Figure 3.12: Summary of rwuniq

rwuniq

Description Counts records per combination of multiple-field keys

Call rwuniq filterfile.rw --fields=1-5,sensor --values=Records Parameters --fields Specifies fields to use as key (required)

--values Specifies aggregate counts (default: Records) --bin-time Establishes bin size for time-oriented bins

--presorted-input Reduces memory requirements for presorted records --sort-output Sorts results by key, as specified in the--fields parameter For options to filter output rows, see Table3.12.

For additional parameters, see Table3.13on page 71 and Table3.14.

Table 3.12: Output-Filtering Options forrwuniq

Parameter Description

--bytes Only output rows whose aggregate byte counts are in the specified range --packets Only output rows whose aggregate packet counts are in the specified range --flows Only output rows whose aggregate flow (record) counts are in the specified range --sip-distinct Only output rows whose counts of distinct (unique) source IP addresses are in the

specified range

--dip-distinct Only output rows whose counts of distinct (unique) destination IP addresses are in the specified range

Example3.31shows a count on source IP addresses (field 1). The count shown in Example3.31is a count of individual flow records.

Example 3.31: rwuniq for Counting in Terms of a Single Field

<1>$ rwuniq fastfile .rw --field = sIP | head -n 10 sIP | Records | 172.30.138.196| 5| 172.30.21.175| 9| 172.30.172.55| 2| 172.30.206.153| 1| 172.29.120.119| 7| 172.29.215.89| 1| 172.31.6.207| 5| 172.30.193.137| 1| 172.29.123.130| 4|

3.7.1

Using Thresholds with rwuniq to Profile a Slice of Flows

rwuniq provides a capability to set thresholds on counts. For example, to show only those source IP addresses with 200 flow records or more, use the--flows parameter as shown in Example3.32. In addition to providing counts of flow records, rwuniq can count bytes and packets through the Bytes and Packets values in the --values parameter, as shown in Example3.33.

Example 3.32: rwuniq --flows for Constraining Counts to a Threshold

<1>$ rwuniq in_month .rw --field = sIP --value = Flows -- flows =200 - | head -n 10 sIP | Records | 172.31.27.146| 249| 172.31.83.171| 216| 172.31.177.128| 646| 172.31.96.95| 284| 192.0.2.220| 220| 172.31.219.3| 226| 172.31.239.58| 258| 198.51.100.99| 327| 172.31.243.204| 203|

The --bytes, --packets, and --flows parameters are all threshold operators for filtering output rows. Without a specified range (such as --flows=200-2000), the parameter simply adds the named aggregate count to the list of aggregates started by the--values parameter; it is preferable to use the --values pa- rameter for this purpose since that parameter provides greater control over the order in which the aggregates are displayed. A range may be specified in three ways: with the low and high bounds separated by a hyphen (e.g., 200–2000), with a low bound followed by a hyphen (e.g., 200–) denoting that there is no upper bound, or with a low bound alone (e.g., 200) which, unlikerwfilter partitioning values, still denotes a range with no upper bound, not just a single value. The last form is discouraged, since it is misinterpreted easily. When multiple threshold parameters are specified,rwuniq will print all records that meet all the threshold criteria, as shown in Example3.34.

3.7. COUNTING FLOWS WITH RWUNIQ 67

Example 3.33: rwuniq --bytes and --packets with Minimum Flow Threshold

<1>$ rwuniq in_month .rw --field = sIP -- values =Bytes , Packets , Flows --flows =2000 -

sIP | Bytes | Packets | Records |

192.0.2.6| 14955948| 128191| 22563| 198.51.100.123| 313208842| 1692517| 5083| 203.0.113.240| 45685747| 63650| 4202| 172.31.102.236| 5626076| 72300| 7609| 198.51.100.18| 92736014| 1065135| 163370| 172.31.47.56| 7053117| 74897| 6083| 203.0.113.189| 20888986| 326759| 22007| 203.0.113.68| 516609610| 3522213| 13069| 198.51.100.44| 1598689| 23084| 2397|

Example 3.34: rwuniq --flows and --packets to Constrain Flow and Packet Counts

<1>$ rwuniq in_month .rw --field = sIP -- values =Bytes , Packets , Flows \ --flows =2000 - -- packets =100000 -

sIP | Bytes | Packets | Records |

192.0.2.6| 14955948| 128191| 22563|

198.51.100.123| 313208842| 1692517| 5083|

198.51.100.18| 92736014| 1065135| 163370|

203.0.113.189| 20888986| 326759| 22007|

3.7.2

Counting IPv6 Flows

rwuniq automatically adjusts to process IPv6 flow records if they are supplied as input. No specific parameter is needed to identify these flow records, as shown in Example 3.35. This example uses rwfilter to isolate IPv6 “Packet Too Big” flow records (ICMPv6 Type 2) and then usesrwuniq to profile how often each host sends these and to how many destinations. These flows are used for Path Maximum Transmission Unit (PMTU) discovery, an optimization of packet sizing within IPv6 to prevent the need for frequent packet fragmentation and reassembly. A low number of such flow records is considered acceptable. If a source IP address has a high count, that host is throttling back network connections for communicating hosts.

Example 3.35: Using rwuniq to Detect IPv6 PMTU Throttling

<1>$ rwfilter --ip - version =6 --icmp - type =2 --pass = stdout \

| rwuniq -- fields = sIP -- values =Flows , Distinct : dIP --flows =2- sIP | Records |dIP - Distin |

2001: db8 :0:320 a:9 ce3 : a2ff : ae0 : e169 | 5| 2|

2001: db8 :0:3 e00 ::2 e28 :0| 2| 2|

2001: db8 : a401 : fe00 ::51 f6| 8| 1|

2001: db8 :0:64 b2 :: a5| 2| 1|

3.7.3

Using Compound Keys with rwuniq to Profile Selected Cases

In addition to the simple counting shown above, rwuniq can count on combinations of fields. To use a compound key, specify it using a comma-separated list of values or ranges inrwuniq’s --fields parameter. Keys can be manipulated as in rwcut, so --fields=3,1 is a different key than --fields=1,3. In Exam- ple 3.36, --fields is used to identify communication between clients and specific services only when the number of flows for the key exceeds a threshold.

Example 3.36: rwuniq --fields to Count with Respect to Combinations of Fields

<1>$ rwfilter in_month .rw -- protocol =6 --pass = stdout \

| rwuniq -- fields =sIP , sPort --value = Flows --flows =20 - \ | head -n 11

sIP | sPort | Records |

172.31.102.236|40553| 24| 192.0.2.37| 80| 21| 172.31.46.127|54168| 21| 172.31.102.236|41622| 20| 198.51.100.123| 22| 5083| 172.31.102.236|40546| 20| 192.0.2.104|39135| 59| 172.31.188.210|13904| 24| 198.51.100.121| 22| 713| 198.51.100.144|20806| 21|

In Example 3.36, incoming traffic is used to identify those source IP addresses with the highest number of flow records connecting to specific TCP ports.