Network Flow Analysis

; Dedication; ACKNOWLEDGMENTS; INTRODUCTION; Network Administration and Network Management; Network Management Tools; Enough Griping: What's the Solution?; Flow-Tools and Its Prerequisites; Flows and This Book; Chapter 1: FLOW FUNDAMENTALS; 1.1 What Is a Flow?; 1.2 Flow System Architecture; 1.3 The History of Network Flow; 1.4 Flows in the Real World; 1.5 Flow Export and Timeouts; 1.6 Packet-Sampled Flows; Chapter 2: COLLECTORS AND SENSORS; 2.1 Collector Considerations; 2.2 Sensor Considerations; 2.3 Implementing the Collector; 2.4 Installing Flow-tools; 2.5 Running flow-capture; 2.6 How Many Collectors?; 2.7 Collector Log Files; 2.8 Collector Troubleshooting; 2.9 Configuring Hardware Flow Sensors; 2.10 Configuring Software Flow Sensors; 2.11 The Sensor: softflowd; Chapter 3: VIEWING FLOWS; 3.1 Using flow-print; 3.2 Setting flow-print Formats with -f; 3.3 TCP Control Bits and Flow Records; 3.4 ICMP Types and Codes and Flow Records; Chapter 4: FILTERING FLOWS; 4.1 Filter Fundamentals; 4.2 Useful Primitives; 4.3 Filter Match Statements; 4.4 Using Multiple Filters; 4.5 Logical Operators in Filter Definitions; 4.6 Filters and Variables; Chapter 5: REPORTING AND FOLLOW-UP ANALYSIS; 5.1 Default Report; 5.2 Modifying the Default Report; 5.3 Analyzing Individual Flows from Reports; 5.4 Other Report Customizations; 5.5 Useful Report Types; 5.6 Customizing Reports; Chapter 6: PERL, FLOWSCAN, AND CFLOW.PM; 6.1 Installing Cflow.pm; 6.2 flowdumper and Full Flow Information; 6.3 FlowScan and CUFlow; 6.4 FlowScan Prerequisites; 6.5 Installing FlowScan and CUFlow; 6.6 Flow Record Splitting and CUFlow; 6.7 Using Cflow.pm; Chapter 7: FLOWVIEWER; 7.1 FlowTracker and FlowGrapher vs. CUFlow; 7.2 FlowViewer Security; 7.3 Installing FlowViewer; 7.4 Configuring FlowViewer; 7.5 Using FlowViewer; 7.6 FlowGrapher; 7.7 FlowTracker; 7.8 Interface Names and FlowViewer; Chapter 8: AD HOC FLOW VISUALIZATION; 8.1 gnuplot 101; 8.2 Time-Series Example: Bandwidth; 8.3 Automating Graph Production; 8.4 Comparison Graphs; Chapter 9: EDGES AND ANALYSIS; 9.1 NetFlow v9; 9.2 sFlow; 9.3 Problem Solving with Flow Data; 9.4 Afterword; UPDATES;