How to Determine Concurrent Connections on a Router?

kevin.hu · ‎06-02-2010

We need to purchase an IPS and one of the criteria is to determine the proper max concurrent connections. As I understand it, router is not stateful thus it does not have the capability to keep concurrent connection information. Am I right or is there a way to determine that on a router?

Thanks!

Giuseppe Larosa · ‎06-02-2010

Hello Kevin,

if the objective is to track IP flows going through the router you can consider the use of netflow that allows for this.

There is no state on the netflow table just the tracking of IP flows but it is a possible use of netflow for security.

Hope to help

Giuseppe

kevin.hu · ‎06-02-2010

Thanks Giuseppe. I considered Netflow as well but I also thought about its limitation.

Although frequently used, the router-based approach suffers from several limitations:

Enabling NetFlow monitoring on software-based routers (for example Cisco 7200) may reduce the routing performance.
Even when using built-in hardware (like on Cisco or Alcatel/Lucent high-end routers) or dedicated hardware (like on Juniper or Huawei high-end routers) the number of supported packets/sec or flows/sec will be limited by the available processing power and memory (for the flow cache), and make sampling mandatory, at least on typical Internet backbone traffic.
Due to sampling or flow processing limitations, the provided statistics may not be reliable enough for billing (under evaluation of volumes) or security applications (higher inaccuracy of Netflow when lots of small packets must be processed).
The routers have fixed placement, and layer 3 visibility makes them a target for attacks.