Scrutinizer v7.6 has been released. One of my favorite features is the ability to rename NetFlow v9 templates, IPFIX templates and Flexible NetFlow Templates. We had to provide this feature since Cisco NetFlow does not export the template name. Do you know why this is such a cool feature? Read more »
Michael PattersonI was scouring the web looking for information on NetFlow v9 the other day and came across this document on NetFlow. I thought these slides on ‘show ip cache flow’ and ‘show ip cache verbose flow’ were interesting. If you are trouble shooting with a customer, they can be pretty useful. Read more »
Michael PattersonWe had a large carrier call us the other day with a messed up interface names issue in Scrutinizer. The customer was exporting cflowd (NetFlow v5) from an Alcatel-Lucent SR 7750 running TMOS-C-5.0.R21. Read more »
Michael PattersonHave you heard about exporting egress NetFlow? Do you want to know why it is different from ingress NetFlow or more importantly, when to implement it for network traffic monitoring? I’ll cover this topic in today’s blog. Read more »
Michael PattersonMost people collecting NetFlow use it in a very traditional fashion (i.e. NetFlow v5 with ingress flows). Ingress flow means that only inbound (i.e. received) traffic is collected and exported in NetFlow datagrams. This may sound like you won’t know what is going ‘out’ an interface, but have no fear. There is any easy way to calculate outbound traffic using ingress NetFlow.
Above, out bound utilization on interface 1 is determined by looking at the flows from interfaces 2,3 & 4 that are destined for interface 1. Since an ingress flow contains the source and destination interface (i.e. port of the router). Out bound traffic is determined by using ingress flows from the other interfaces. For this reason, it is important to enable NetFlow on all interfaces of the switch or router. This trick is common practice in all NetFlow reporting tools. But, what about NetFlow v9 and its support for ‘Egress’ NetFlow (i.e. traffic going out an interface)?
When was the last time you used a Network General Sniffer™? Do you remember the Matrix view? Read more »
Michael PattersonMany NetFlow Reporting applications claim to tell you who the top 10 bandwidth hogs are by displaying the top 10 or so hosts for a time period based on total amount of traffic sent or received. Yes, this is helpful but it can paint a distorted picture when it comes to network traffic analysis. What about Flow Volume? Read more »
Michael Patterson
If you missed the NetFlow training webinars Plixer offered over the last three days, then feel free to watch the recording we made of Thursday’s presentation. The webinar, which covered Cisco ASA and NBAR NetFlow reporting, was presented by Scrutinizer NetFlow & sFlow Analyzer Product Manager, Michael Patterson.
As always, keep an eye out for emails from Plixer for future webinar invitations. We also try to post many of these signups on our blog. Thanks for watching!
| Join one of our upcoming webinars on Cisco ASA and NBAR NetFlow Reporting. Agenda - Cisco NetFlow: Intro and how to report on it. - Cisco ASA NetFlow exports and how to interpret the data. - Cisco NBAR reporting for layer 7 application reports (e.g. who is using: Skype, kazaa2, RTP, etc.). Register for one of the times below |
Reporting on QoS using NetFlow is a fairly rudimentary report for even the most basic NetFlow reporting tools. Although the name of this report differs from vendor to vendor, we are all talking about the same 8 bit ToS field of an IP datagram. Sometimes mistakenly referred to as DSCP, this 1 byte value is used in an effort to help ensure end to end QoS flow for select business applications. Read more »
Michael Patterson
