Configuration Examples; Example For Collecting Statistics About Abnormal Ipv4 Flows At The User Side - Huawei NetEngine5000E Configuration Manual

HUAWEI NetEngine5000E Core Router
Configuration Guide - System Management
l
l
l
l
----End

6.11 Configuration Examples

This section provides NetStream configuration examples in different scenarios.
6.11.1 Example for Collecting Statistics About Abnormal IPv4
Flows at the User Side
The NetStream traffic statistics collection function helps analyze the type and location of
abnormal traffic rapidly.
Networking Requirements
On a single NE5000E, an interface is numbered in the format of slot number/card number/
interface number. On the NE5000E cluster, an interface is numbered in the format of chassis
ID/slot number/card number/interface number. If the slot number is specified, the chassis ID of
the slot must also be specified.
As shown in
destination IP address, port, and protocol information of network packets at the user side. Such
statistics help analyze users' behaviors and detect the worm-infected terminals, source and
destination of DoS/DDos attacks, source of junk mails, and unauthorized web sites. In addition,
NetStream allows users to rapidly identify the virus type and locate the IP address of abnormal
traffic. Based on other characteristics of NetStream flows, uses can take proper actions to filter
out virus-infected traffic and prevent it from spreading on the network.
Issue 01 (2011-10-15)
display ip netstream cache { as | as-tos | bgp-nexthop-tos | destination-
prefix | destination-prefix-tos | index-tos | mpls-label | prefix | prefix-
tos | protocol-port | protocol-port-tos | source-prefix | source-prefix-tos }
slot slot-id
Information about various aggregated flows in the buffer is displayed.
Run:
display ip netstream export option
Information about the output option template is displayed.
Run:
display ipv6 netstream cache origin slot slot-id
Information about the NetStream flow buffer is displayed.
Run:
display ipv6 netstream cache { as | as-tos | destination-prefix | destination-
prefix-tos | prefix | prefix-tos | protocol-port | protocol-port-tos | source-
prefix | source-prefix-tos |mpls-label } slot slot-id
Information about various aggregated flows in the buffer is displayed.
Run:
display ipv6 netstream statistics slot slot-id
Statistics about NetStream flows are displayed.
CAUTION
Figure 6-13, NetStream can collect statistics about the source IP address,
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
6 NetStream Configuration
178