Working in technical support I get asked a lot, “I enabled NetFlow on my router, why don’t I see outbound traffic?” This is because NetFlow version 5 only supports ingress flow monitoring and they don’t have NetFlow enabled on all interfaces. In NetFlow v5 outbound traffic is calculated by the idea what goes in must go out (or stop at the router) so, it’s necessary that all interfaces are monitoring ingress traffic to get an accurate representation of outgoing traffic. So, if ingress monitoring has been working great all along why enable egress monitoring?

Read more »

Paul Dube
Technical Support
Follow me on Twitter

Most of my blogs are related to NetFlow or sFlow.  This weekend I’m taking a break from network traffic monitoring.  My father in law, some friends and I took off snowmobiling up in Sherman, Maine.

I have so many trade show shirts that I end up wearing them on events like this from time to time. I couldn’t resist this picture below.  Funny thing is, I’ve had people approach me in restaurants when they see my t-shirts for Cisco, Nortel, etc. Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

If you missed the NetFlow training webinars Plixer offered over the last three days, then feel free to watch the recording we made of Thursday’s presentation. The webinar, which covered Cisco ASA and NBAR NetFlow reporting, was presented by Scrutinizer NetFlow & sFlow Analyzer Product Manager, Michael Patterson.

As always, keep an eye out for emails from Plixer for future webinar invitations. We also try to post many of these signups on our blog. Thanks for watching!

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter

Join one of our upcoming webinars on Cisco ASA and NBAR NetFlow Reporting. Agenda - Cisco NetFlow: Intro and how to report on it. - Cisco ASA NetFlow exports and how to interpret the data. - Cisco NBAR reporting for layer 7 application reports (e.g. who is using: Skype, kazaa2, RTP, etc.). Register for one of the times below » Tuesday, Dec. 15 @ 11am EST » Wednesday, Dec. 16 @ 9am EST » Thursday, Dec. 17 @ 1pm EST

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter

Since the launch of our Systrax community website, we have written over three hundred blogs and generated two unique cases of Carpal Tunnel to bring you informative and sometimes quasi entertaining content.

I think its time though to lasso in some of the highlights over the year into one summary blog for quick and easy reference. This blog will link to others that have answered some of the more commonly asked questions. We hope you enjoy it.

Read more »

The holiday’s are nearly upon us, and in the spirit of giving, Mix Master Mitch has graced us with his latest rap video. This time around, Mitch decided to focus on setting up NetFlow on a Cisco Catalyst 6509 switch. Take a look.

Read the lyrics

Mix Master Mitch was also kind enough to give Systrax an exclusive interview. It was hard to pull him away from his legion of screaming fans, but he managed to sneak off for a few minutes to give us his insight on his latest creation.

Read more »

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter

I was working with a customer at a University in the Northeast.  He was having some TCAM overflow issues with his Cisco Catalyst 6513 and was looking at the NetFlow exports to see if it could help him get a better understanding of the issue.   Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

With the barrage of applications today sharing similar behavior characteristics at the protocol level, it becomes necessary to take deep packet inspection steps to determine what the actual application is that is causing the traffic.  Thankfully, Cisco already does this for us with something called Network-Based Application Recognition (NBAR) .   We explained NBAR support in a recent blog and how it allows us to improve on network traffic analysis.

Once you enable NBAR exports with NetFlow you will notice that since it supports Flexible NetFlow, a few different templates get kicked out.

Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Plixer International, developers of a market leading NetFlow and sFlow analysis tool set, today released Scrutinizer NetFlow & sFlow Analyzer version 7.3, bringing network traffic analysis software to the next level.

With the latest release of their NetFlow analyzer, Plixer has introduced several new report types, including NBAR reports. Cisco’s NBAR technology does deep packet inspection into the traffic moving through the router to identify the applications being used by hosts. For example; H323, Telnet, RTP, Exchange and Skype are identified and exported in NetFlow.

“We feel, and have felt for some time, that Flexible NetFlow has the potential to expand greatly on the level of information that can be reported on by standard NetFlow,” says Plixer CTO, Marc Bilodeau. “With Scrutinizer NetFlow & sFlow Analyzer version 7.3, Plixer is leading the pack in not only the adoption of Flexible NetFlow, but in the implementation of its key advantages over other versions of NetFlow.”

Read more »

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter

Apparently the Cisco ASA is becoming a popular appliance for securing today’s businesses from the uglies that plague the Internet.  More specifically, the ASA running v8.2.1 or newer exports Flexible NetFlow (a variant of NetFlow v9). Why is this so cool?

The Key Advantages of using Flexible NetFlow on Routers:

A) User configurable ability to monitor a wider range of packet information which produces new information about network behavior: In other words, we can specify exactly what we want.  This is useful if you are trouble shooting and looking for very specific information that isn’t exported in traditional NetFlow (e.g. MAC addresses, VLAN IDs, NBAR, etc.).

B) Enhanced network anomaly and security detection: Basically, Flexible NetFlow can monitor more deeply inside packets.  What could these mean to the market for NBAD solutions?

C) Convergence of multiple accounting technologies into a single mechanism: This is basically reinforcing the above feature of collecting on any specific information but, using it for different purposes.  For example, maybe the NetFlow volume is so high that you have to use sampling.  This could throw a wrench into your accounting and billing plans as they likely won’t be accurate without 100% traditional NetFlow capture. Flexible NetFlow allows you to have a sampling export as well as other exports specific to traffic type (e.g. IP subnet) occurring simultaneously.

Read more »