Best Practices in Network Behavior Analysis: Part 1 of 2

Posted in NetFlow on December 2nd, 2009 by mike@plixer.com
Best Practices in Network Behavior Analysis: Part 1 of 2

Many companies are primarily concerned with Internet security threats.  I feel that majority of security threats are derived internally. According to Forrester Research, the majority of security breaches involve internal employees, with some estimates as high as 85 percent. Read more »

Michael Patterson
Founder and CEO

For a free 30 day trial of Scrutinizer, Download Now!

Sign up for Advanced NetFlow Training™ coming to a city near you!

Tags: , , , , , , , , , , , ,

2 Comments »

How to detect anomalies across multiple Cisco NetFlow, sFlow data sources

Posted in NetFlow, NetFlow Analyzer, Network Traffic Analysis, Network Traffic Monitor, Scrutinizer, sFlow on May 25th, 2009 by mike@plixer.com
How to detect anomalies across multiple Cisco NetFlow, sFlow data sources

Anomaly detection across multiple Cisco NetFlow- and sFlow-exporting devices is a topic I believe we engineered well. It is also an important subject because performing Network Behavior Analysis across dozens of flow-sending devices is critical to avoid excessive notifications and to gain:
* A global view of the problem.
* Alarm capture at the ingress interface or edge of the network.
* Ease of configuration enterprise wide.

The Flow Analytics Overview shown below outlines each algorithm as well as the corresponding Time it takes to run and the Count of violations in the last 5 minutes. Click on each value to display a trend.

faoverview

To add or remove routers from an algorithm, simply click on the router icon shown above. The window below will appear:

faaddremovedevices

Adding and removing routers and switches from each algorithm is simple. Select the drop-down box to jump to another algorithm. Other Flow Analytics blogs can be found here.

Michael Patterson
Founder and CEO

For a free 30 day trial of Scrutinizer, Download Now!

Sign up for Advanced NetFlow Training™ coming to a city near you!

Tags: , , , ,

Leave A Comment »