Networks with flow data reported from multiple sources can pose a challenge to flow analysis when those sources overlap in their observation of network sessions. This situation is commonly encountered by ISPs and telecommunications networks where there are multiple points of ingress and egress, and where large-scale events such as denial of service attacks may follow many paths.
Without deduplication capability, portions of such traffic would be duplicated as they're reported by different network interfaces being traversed. This in turn leads to difficulties in adequately estimating traffic volume, such as the size of DDoS attacks. In order to deduplicate, FlowTraq must know the role each reporting interface plays in the network so that it can correctly determine how its reports contribute to the overall traffic seen by a traffic group.
To facilitate deduplication, FlowTraq offers five different types of interface categories. Each category is referred to as a "Ring", relative to its place in a network diagram.
- Default
Interfaces marked 'default' are treated as individual sources of flow data, and no deduplication is applied. Most FlowTraq installs will contain only default interfaces.
- Uplink/Border
Interfaces marked "uplink/border" typically link to the broader Internet, where the other side of the link is an external peer.
- Edge
Edge interfaces are internal-facing (as opposed to uplink/border interfaces). Two sets of Edge interfaces (1 and 2) can be tracked separately.
- Core
Core interfaces are typically defined as being connected to another core interface rather than facing customers, network resources, or the wider internet. If two core routers exchange traffic, the interfaces between the two devices will both be marked 'core' so that FlowTraq understands that two interfaces will be expected to report exactly the same traffic.
Two sets of Core interfaces (Core 1 and Core 2) may be tracked in parallel, for organizational purposes. Core 1 and Core 2 are not inherently related to Edge 1 and Edge 2, and may be used without reference to those selections if needed.
- Ignored
Flows from ignored interfaces are disregarded when analyzing data. Interfaces should only be marked as ignored when their data is not useful to understanding network traffic.
Configuring and labeling interfaces is performed on the Data Sources page (available Q3/16 and later), which is available to admin users under the Administrator menu.
The left side of the page shows the list of exporters and interfaces that have been observed to send data to FlowTraq, organized by partition. Under each partition is each exporter assigned to it, and each of its interfaces listed underneath it. Both exporters and interfaces can be named on this page in their respective config sections.
Each exporter has a sampling rate associated with it. Typically this is reported by the exporter itself and should not be changed; occasionally a device will not report its sampling rate. In this case it can be set by selecting an exporter in this list and changing the rate.
Individual interfaces can be configured by selecting them from the list. FlowTraq estimates a line rate for each interface based on the observed traffic; this can be set directly on this page for later reference. In addition, the ring for an interface can be selected.
Interfaces which are no longer in use may be deleted from the list. If an interface is observed again after being deleted (if traffic arrives at FlowTraq listing that interface number) then it will reappear.
