How to lower a price of Data retention for ISP

Title

What helped ISP to comply with national data retention policy with low costs within complex network of 130+ sites with NAT translation

Situation

Most countries oblige its internet service providers to collect forensic data on who is communicating with whom. In essence it usually translates to netflow data. Mandatory data retention policy for operators ranges from 6 months to 5 years depending on the country.

 

What is the challenge for an operator to comply with national policy?

Challange

There are several challenges, all of them were the case for this operator:

  • In order to identify the customer responsible for communication, an operator has to consider NAT translation – there can be many private IP addresses behind one public IP address.
  • Architecture differs a lot among operators – some operator quite diverse network with many pop in many regions. In this case, there were individual isolated 130+ sites, each with its own NAT router.
  • Routers can be of various vendors and firmware versions.
  • Amount of traffic for small ISP is about 10K flows per second, up to 1M flows/s for large operators.
  • Storing such a traffic’s netflow data is demanding.

Solution

ISP implemented following solution to comply Data retention policy:

  • Operator setup export of (private traffic) netflow from 130+ routers
  • In addition FLOWCUTTER probes were installed at perimeter to monitor public traffic
  • Netflow data streams were continually sent to the central collector with FLOWCUTTER software.
  • FLOWCUTTER supports all the incoming flow format NF5/8/IPFIX

    Results

    The project was successfully delivered and all the expectations were met. Correct sizing of the project made sure ISP would be able to store the data for a necessary period for another 3 to 5 years.

    In comparison to the competing projects, the solution including FLOWCUTTER results in 75% price tag decrease due to its versatility and broad compatibility because the operator was able to leverage its own resources and not buy the whole complete solution from scratch.



      TRY DEMO

      Resources

      • Network probes
      • Flow formats & compatibility
      • Hardware appliance
      • Flows compression ratio

      Takeaway

      The project was successfully delivered, expectations were met.

      In addition, the total price tag was lowered by 75%.

        you might be interested…