Working in technical support I get asked a lot, “I enabled NetFlow on my router, why don’t I see outbound traffic?” This is because NetFlow version 5 only supports ingress flow monitoring and they don’t have NetFlow enabled on all interfaces. In NetFlow v5 outbound traffic is calculated by the idea what goes in must go out (or stop at the router) so, it’s necessary that all interfaces are monitoring ingress traffic to get an accurate representation of outgoing traffic. So, if ingress monitoring has been working great all along why enable egress monitoring?

Read more »

Paul Dube
Technical Support
Follow me on Twitter

What’s your favorite color? Chances are that your favorite color is not the same as mine. When you use Windows, are you a fan of the old classic view, or do you go for the new Windows look?

We have all been talking about Plixer’s NetFlow analyzer, and how it provides the best in traffic analysis, with its ability to support Flexible NetFlow, NBAR, and Cisco ASA NSEL. But did you know that as a Scrutinizer user, you have different options when it comes to how you want our NetFlow and sFlow Traffic Analysis Tool to look?

Currently there are 5 different skin types available to select from. They are configurable on a per user basis. So if you are in a dark kind of mood, you can change to a dark skin with either green or yellow text.

Read more »

Bandwidth monitoring hasn’t been as big a concern for as long as some of us might think. Ethernet was founded in 1973 by Bob Metcalfe and David Boggs. Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Have you heard about exporting egress NetFlow? Do you want to know why it is different from ingress NetFlow or more importantly, when to implement it for network traffic monitoring? I’ll cover this topic in today’s blog. Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Most people collecting NetFlow use it in a very traditional fashion (i.e. NetFlow v5 with ingress flows). Ingress flow means that only inbound (i.e. received) traffic is collected and exported in NetFlow datagrams. This may sound like you won’t know what is going ‘out’ an interface, but have no fear. There is any easy way to calculate outbound traffic using ingress NetFlow.

Above, out bound utilization on interface 1 is determined by looking at the flows from interfaces 2,3 & 4 that are destined for interface 1. Since an ingress flow contains the source and destination interface (i.e. port of the router). Out bound traffic is determined by using ingress flows from the other interfaces. For this reason, it is important to enable NetFlow on all interfaces of the switch or router. This trick is common practice in all NetFlow reporting tools. But, what about NetFlow v9 and its support for ‘Egress’ NetFlow (i.e. traffic going out an interface)?

Read more »

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter

NetFlow analyzers vs. packet analyzers - are really complementary technologies. For years NetFlow has been a valuable tool used to suppliment the use of packet analysis; and to a certain extent that is still the case. With the adoption of Flexible NetFlow and the new release of Scrutinizer 7.5, the value that NetFlow analysis brings to packet analysis becomes even more significant.

Read more »

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter

How do you know if the NetFlow collector is saving or even getting all of the NetFlow datagrams that are being sent to it or that it is receiving? It is important to know if any flows are missing.

Why do we care?

This is a great question. We care because a loss of flow exports is usually caused by one of three things:

1. The network dropped some packets
2. The router can’t keep up
3. The NetFlow receiver / collector can’t keep up

NetFlow sequence numbers are becoming increasingly important. When building a NetFlow collector it is important that the engine scales while staying accountable. If you look at the NetFlow v9 packet format you will notice something called the package_sequence.

Read more »

With the barrage of applications today sharing similar behavior characteristics at the protocol level, it becomes necessary to take deep packet inspection steps to determine what the actual application is that is causing the traffic.  Thankfully, Cisco already does this for us with something called Network-Based Application Recognition (NBAR) .   We explained NBAR support in a recent blog and how it allows us to improve on network traffic analysis.

Once you enable NBAR exports with NetFlow you will notice that since it supports Flexible NetFlow, a few different templates get kicked out.

Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

After a lot of work, we have support in Scrutinizer v7.3 with Flow Analytics for NBAR with Flexible NetFlow.  My contact at Cisco Jean-Charles <below> gave us some help. I wish we had him as a resident Cisco NBAR and NetFlow expert.  Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Plixer International, developers of a market leading NetFlow and sFlow analysis tool set, today released Scrutinizer NetFlow & sFlow Analyzer version 7.3, bringing network traffic analysis software to the next level.

With the latest release of their NetFlow analyzer, Plixer has introduced several new report types, including NBAR reports. Cisco’s NBAR technology does deep packet inspection into the traffic moving through the router to identify the applications being used by hosts. For example; H323, Telnet, RTP, Exchange and Skype are identified and exported in NetFlow.

“We feel, and have felt for some time, that Flexible NetFlow has the potential to expand greatly on the level of information that can be reported on by standard NetFlow,” says Plixer CTO, Marc Bilodeau. “With Scrutinizer NetFlow & sFlow Analyzer version 7.3, Plixer is leading the pack in not only the adoption of Flexible NetFlow, but in the implementation of its key advantages over other versions of NetFlow.”

Read more »

Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter