How to Determine Concurrent Connections on a Router?

[kevin.hu]

We need to purchase an IPS and one of the criteria is to determine the proper max concurrent connections.  As I understand it, router is not stateful thus it does not have the capability to keep concurrent connection information.  Am I right or is there a way to determine that on a router?

Thanks!

[Giuseppe Larosa]

Hello Kevin,

if the objective is to track IP flows going through the router you can consider the use of netflow that allows for this.

There is no state on the netflow table just the tracking of IP flows but it is a possible use of netflow for security.

Hope to help

Giuseppe

[kevin.hu]

Thanks Giuseppe.  I considered Netflow as well but I also thought about its limitation.

Although frequently used, the router-based approach suffers from  several limitations:

• Enabling NetFlow monitoring on software-based routers (for example  Cisco 7200) may reduce the routing performance.
• Even when using built-in hardware (like on Cisco or Alcatel/Lucent  high-end routers) or dedicated hardware (like on Juniper or Huawei  high-end routers) the number of supported packets/sec or flows/sec will  be limited by the available processing power and memory (for the flow  cache), and make sampling mandatory, at least on typical Internet  backbone traffic.
• Due to sampling or flow processing limitations, the provided  statistics may not be reliable enough for billing (under evaluation of  volumes) or security applications (higher inaccuracy of Netflow when  lots of small packets must be processed).
• The routers have fixed placement, and layer 3 visibility makes them a  target for attacks.