Measurement and analysis of traffic filtered by network infrastructure
A computer-implemented method and device for analyzing network packet traffic flow affected by a network security device in a communication network. Received in a network monitoring device is packet traffic flow data from a network security device that filters network traffic based upon prescribed security filter settings. The network monitoring device analyzes the received packet traffic flow data by correlating the received traffic flow data with the security filter settings prescribed in the network security device. Certain statistics are identified regarding the network traffic flow affected by the security filter settings of the network security device based upon the correlating of the received traffic flow data with the security filter settings prescribed in the network security device. A report regarding the identified statistics is preferably sent to a network administrator.
1. A computer-implemented method for analyzing network packet traffic flow affected by a network security device, comprising the steps:
receiving, in a network monitoring device, packet traffic flow data from a network security device that filters network traffic based upon prescribed security filter settings;
analyzing, in the network monitoring device, the received packet traffic flow data by correlating the received traffic flow data with the security filter settings prescribed in the network security device;
identifying certain statistics regarding the network traffic flow affected by the security filter settings of the network security device based upon the correlating of the received traffic flow data with the security filter settings prescribed in the network security device;
automatically adjusting the prescribed security filter settings based upon the analyzing of the received traffic flow data associated with the prescribed security filter settings, and identifying certain statistics regarding the analyzed traffic flow; and
reporting the identified statistics to a network administrator.
2. The computer-implemented method as recited in claim 1 , wherein the prescribed security filter settings are adjusted to mitigate legitimate traffic flow from being effected by the prescribed security filter settings of the network security device.
3. The computer-implemented method as recited in claim 1 , wherein the adjusted security filter settings are sent from the network monitoring device to the network security device without user intervention.
4. The computer-implemented method as recited in claim 3 , wherein a BGP flowspec route is utilized between the network monitoring device and the network security device for prescribing the adjusted security filter settings in a security filter of the network security device.
5. The computer-implemented method as recited in claim 1 , wherein the network security device is a network router device.
6. The computer-implemented method as recited in claim 5 , wherein the network router device is located upstream of the network monitoring device relative to the network packet traffic flow.
7. The computer-implemented method as recited in claim 1 , wherein the network security device exports telemetry data to the network monitoring device regarding network traffic flow data received by the network monitoring device wherein the telemetry data traffic flow records indicate performance metrics associated with the network security filter.
8. The computer-implemented method as recited in claim 7 , wherein a network protocol utilized for sending the telemetry data from the network security device to the network monitoring device is selected from the group consisting of: Netflow, IPFIX, and sFlow.
9. The computer-implemented method as recited in claim 1 , wherein reporting the identified statistics to a network administrator includes indicating whether a network attack is currently ongoing based upon the identifying certain statistics regarding the traffic flow.
10. The computer-implemented method as recited in claim 1 , wherein reporting the identified statistics to a network administrator includes reporting traffic flow change characteristics associated with the indicated ongoing network attack so as to indicate how the current network attack is changing.
11. The computer-implemented method as recited in claim 1 , wherein reporting the identified statistics to a network administrator includes one or more data parameters associated with a network attack: origin country, IP address, network, and organization.
12. The computer-implemented method as recited in claim 1 , wherein reporting the identified statistics to a network administrator includes indicating the types of the traffic included in a network attack.
13. The computer-implemented method as recited in claim 1 , wherein the identified statistics are reported to the network administrator via one or more of: a graphical user interface (GUI), Application Program Interface (API) and a Command-Line Interface.
14. A network monitoring device for analyzing network packet traffic flow affected by a network router device configured to filter network traffic flow, comprising:
a memory configured to store instructions;
a processor disposed in communication with the memory, wherein said processor upon execution of the instructions is configured to:
receive packet traffic flow data from at least one network router device that filters network traffic based upon prescribed security filter settings;
analyze the received packet traffic flow data by correlating the received traffic flow data with the security filter settings prescribed in the at least one network router device;
identifying certain statistics regarding the network traffic flow affected by the security filter settings of the at least one network router device based upon the correlating of the received traffic flow data with the security filter settings prescribed in the at least one network router device;
automatically adjusting the prescribed security filter settings based upon the analyzing of the received traffic flow data associated with the prescribed security filter settings, and identifying certain statistics regarding the analyzed traffic flow; and
reporting the identified statistics to a network administrator.
15. The network monitoring device as recited in claim 14 , wherein the prescribed security filter settings are adjusted to mitigate legitimate traffic flow from being effected by the prescribed security filter settings of the at least one network router device.
16. The network monitoring device as recited in claim 15 , wherein a BGP flowspec route is utilized between the network monitoring device and the at least one network router device for prescribing the adjusted security filter settings in a security filter of the at least one network router device.
17. The network monitoring device as recited in claim 16 , wherein the at least one network router device exports telemetry data to the network monitoring device regarding network traffic flow data received by the at least network router device wherein the telemetry data traffic flow records indicate performance metrics associated with the network security filter.
18. The network monitoring device as recited in claim 17 , wherein reporting the identified statistics to a network administrator includes indicating whether a network attack is currently ongoing based upon the identifying certain statistics regarding the traffic flow.