What’s better than WAN Optimization NetFlow support? How about NetFlow reporting designed specifically for the unique elements exported by the WAN Optimizers? Well that is exactly what I will be talking about today, the advanced Riverbed Steelhead NetFlow reporting available in the Scrutinizer NetFlow & sFlow Analyzer solution.
There’s been a lot written about Riverbed NetFlow support since their initial support of NetFlow v5 in 2006, and now with support of NetFlow v9, there’s been even more discussion. So the next logical question is, what to do with the unique elements exported in these WAN Acceleration NetFlow records?
How do we get value of those elements? How can we access those elements? Is there any reporting available? With an advanced NetFlow reporting like Scrutinizer, yes, there is. Currently, you can report on these fields using our advanced Report Designer, available in the Administrative tools. Then, in version 11.5, we will be providing new report types specifically for the new WAN optimization NetFlow elements.
WAN Optimization NetFlow reporting
Let’s start with an example of the standard reporting in Scrutinizer, which is also currently available for Riverbed Steelheads. The report screenshot shown below demonstrates that standard Riverbed Steelhead NetFlow reporting is and has been available, and includes Conversation reports, Source and Destination reports such as Source hosts, domains, countries, Top reports such as Top Applications, well-known ports, and also Volume reports – Traffic volume, flow volume, and many other standard NetFlow reports also.
Advanced Riverbed NetFlow reporting
So then, moving on and up, we now have these other elements in the Riverbed NetFlow templates:
- FEType_rvbd
- maximumTTL
- minimumTTL
- outerConnectionSHipv4Address_rvbd
- outerConnectionSHPort_rvbd
- TCPConnectionRTT_rvbd
- TCPPacketRetransmissionCount_rvbd
- TCPRetransmissionByteCount_rvbd
- innerConnectionCFEIpv4Address_rvbd
- innerConnectionCFEPort_rvbd
- innerConnectionSFEIpv4Address_rvbd
- innerConnectionSFEPort_rvbd
- visibility_rvbd
As I mentioned earlier, we can report on these elements using our advanced Report Designer, but what if I’m not an advanced NetFlow engineer? Well, then, for you, we have pre-designed report types to be released soon.
Riverbed Steelhead NetFlow reporting
1/7/2016 UPDATE: These Riverbed Steelhead NetFlow report types are now available in the free version of Scrutinizer:
- Conversations RTT
- FE Type RTT
- FE Type RTT and Source
- FE Type RTT and Visibility
- Inner Connection IPs and RTT
- Non Optimized Traffic
- Pair RTT and Retrans
- Pair RTT with Ports
- Source RTT
- WRK RTT
- Wan Optimization
Let’s take a look at a couple of these new reports.
First, let’s look at the Pair RTT and Retrans report for Riverbed.
The Pair RTT and Retrans report provides packet and byte retransmit counts in sortable fields, so you can report, filter, and alarm on excessive retransmit counts, as well as round trip times.
Another report example is the Riverbed InnerConnection IPs and RTT NetFlow report:
The Inner Connection IPs and RTT report provides mappings for your Source and Destination IP Addresses and Inner Connection CFE and SFE IP Addresses, while also providing round trip time values. With the RTT field being sortable, you can also set thresholds and generate alarms for excessive RTT values.
What’s in the future?
You tell us.
We’d love to get your feedback on what you’d like to see for Riverbed Steelhead NetFlow reporting.
If you have specific reports you’re interested in, either enter a comment below, or give us a call at 207.324.8805.