Skip to main content
Version: 2.10.0

Top Connections Monitor (10063 / 20063)

Description

This Module identifies hosts with the most connections. It consolidates NetFlow records over a period of time (Module execution interval) which all have the same combination of the following fields:

  • Source IP address
  • Destination IP address
  • Source port number
  • Destination port number
  • Layer 3 protocol
  • Input interface
  • Output interface

This information is provided per NetFlow exporter.

Deduplication: optionally the Module can report consolidated flows only from authoritative router/switch. Authoritative network device is determined as follows. The Module sums up bytes, packets, and connections between two hosts over data collection interval (parameter, default = 30 sec), reported by each flow exporter. An exporter with most connections (flows) for each consolidated flow is considered authoritative, and flows reported by all other exporters are discarded.

Parameters

Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 600 sec, default = 30 sec
N – number of reported hostsThe number of top hosts reported per NetFlow exportermin = 0, max = 100000, default = 50 (0 indicates all hosts are reported)
Enable(1) or disable (0) reporting flow denied eventsIf set to 1, enable reporting firewall denied flows. If set to 0, firewall denied flows are not reporteddefault = 1
Enable(1) or disable (0) reporting by authoritative exporters onlyIf set to 1 (deduplication enabled), the Module reports flows only from authoritative exportersdefault = 0
Enable(1) or disable (0) reporting client portIf set to 1, the ephemeral client port number is reported. If set to 0, client port number is not taken into account for consolidation, and reported as 0default = 1
Enable(1) or disable (0) multiplying by sampling rateIf set to 1, when *flow is sampled (e.g. sFlow, sampled NetFlow/IPFIX), the sampling rate is used to multiply bytes and packets to report total traffic as statistical approximationdefault = 0
Default sampler rateIf sampling information is not available, use this rate to multiply bytes and packets to report total traffic as statistical approximationdefault = 1

Input

NetFlow v5, v9, IPFIX, Cisco ASA NSEL, Palo Alto Networks NetFlow v9, sFlow.

Required NetFlow fields

Information Element (IE)IE idIE size, BDescription
IPv4
sourceIPv4Address84The IPv4 source address in the IP packet header
destinationIPv4Address124The IPv4 destination address in the IP packet header
IPv6
sourceIPv6Address2716The IPv6 source address in the IP packet header
destinationIPv6Address2816The IPv6 destination address in the IP packet header

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier"nfc_id=20063"
exp_ipNetFlow exporter IP addressIPv4 address
input_snmpNetFlow exporter ingress interface SNMP indexnumber
output_snmpNetFlow exporter egress interface SNMP indexnumber
protocol 1Transport Protocol (TCP = 6, UDP = 17)number
src_ipSource host IPv4 addressIPv4 address
src_ip6Source host IPv6 addressIPv6 address
src_host 2Source host namestring, included when FQDN is on
src_portSource port numbernumber
dest_ipDestination host IPv4 addressIPv4 address
dest_ip6Destination host IPv6 addressIPv6 address
dest_host 2Destination host namestring, included when FQDN is on
dest_portDestination port numbernumber
tcp_flagCumulative OR of TCP flagsstring, e.g. SYN,ACK,FIN
packets_inPackets in the flow received by the input interfacenumber
bytes_inTotal number of Layer 3 bytes in the packets of the flow received by the input interfacenumber
src_tosInbound IP type of servicenumber
dest_tosOutbound IP type of servicenumber
src_asnSource ASnumber
dest_asnDestination ASnumber
flow_countNumber of flowsnumber
action 3Flow actionstring, The action is determined from IPFIX element 233 - firewallEvent and NFv9 / IPFIX element 89 - forwardingStatus
percent_of_totalPercent of Total (flow_count)decimal, e.g. 25.444% is 25.444
flow_smpl_idFlow Sampler IDnumber
t_intObservation time interval, msecnumber

1 Protocol field is optional. It is reported only if there is a corresponding field in NetFlow.
2 Host name field is optional and included only if FQDN Service is enabled.
3 Action is reported as follows:

  • action=blocked for firewallEvent 0 (ignored), 2 (deleted), and 3 (denied)
  • action=allowed for firewallEvent 1 (created), 4 (alert), and 5 (update)
  • action=unknown for forwardingStatus 00
  • action=forwarded for forwardingStatus 01
  • action=dropped for forwardingStatus 10
  • action=consumed for forwardingStatus 11