Many NetFlow Reporting applications claim to tell you who the top 10 bandwidth hogs are by displaying the top 10 or so hosts for a time period based on total amount of traffic sent or received.  Yes, this is helpful but it can paint a distorted picture when it comes to network traffic analysis.  What about Flow Volume? Read more »

Apparently, many WAN Optimization companies price their appliances based on Flow Volume.  What does Flow Volume mean?  Flow Volume is the number of concurrent flows on a specific interface or all interfaces at any given time.  For example, if you download a web page, this could create several flows.  If you ping something, this would create a flow as well.  In fact, syslogs, SNMP traps, etc. all create flows.  TCP tends to create flows that linger longer than ICMP or UDP flows. Read more »

This is the final part in a two-part blog series on using Cisco NetFlow to identify if your network is part of a botnet. Part 1 gave a quick overview of distributed denial of service (DDoS) attacks and how they’re often caused by botnets flooding Web sites with requests, thus making the Web site inaccessible to others.

It’s not just home computers that could be part of botnets. Any work computer could be compromised if users unwittingly download malware or visit malicious Web sites, putting corporate networks at risk.  How can Cisco NetFlow be used to identify DDoS attacks?
Read more »