Do you ever need to see the NetFlow or sFlow data down to the actual second interval?  Did you know you can do it with your NetFlow Analyzer?  Sub minute visibility is only a click away for the Network Admin. Below I zoomed in on a two minute interval that I want to take a closer look at. 

Notice above that we are looking at the top 10 of 20 pages.  I then clicked on “View Raw Flows” above which brings up this view:

Notice above that we are looking at the top 10 of 25 pages (i.e. more data). Flow View isn’t just based on the raw data, IT IS THE RAW NETFLOW DATA and it displays every field that was exported in the flow albeit NetFlow v1,v5, v6, v7, v9 or Flexible NetFlow.  As you page through the flows, you will see the intervalTime seconds change.

Why this Granular?
Sometimes when I’m helping a customer understand a bandwidth utilization issue, I find that deep netFlow visibility requires an interface like Flow View to provide the raw flow visibility I need.  With Flow View I can dig in and observe sophisticated network scans, malware, zero day exploits or DNS issues that may not have been detected by the Flow Analytics (FA) Network Behavior Analysis module.

Mike Patterson author pic

Michael

Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.

Related

Big Data

Sankey Flow Graph

One of the greatest benefits of NetFlow collection for traffic analysis, is we’re provided with the ability to visualize the…

Leave a Reply