Featured Posts

An alert touches multiple segments of the network, representing the challenge to reduce false positives
Deep Network Observability

How to Reduce False Positives with Shared Context

False positives are rarely caused by too many alerts, but by missing context. Let’s say a spike in outbound traffic shows up in the firewall logs. Around the same time, ...

Read More
Magnifying glass on top of a diagram that looks like both a fingerprint and a network, representing end-to-end network troubleshooting
Network Operations

Why Most Performance Investigations Start in the Wrong Place

A padlock silhouetted against a dark background, surrounded by a spray of white particles, representing password spraying detection.
Security Operations

What Password Spraying Looks Like in Raw Network Telemetry

All Posts

Configuration

Flexible NetFlow: NBAR NetFlow configuration

Did you ever consider that using Flexible NetFlow, specifically an NBAR NetFlow configuration, could provide another aspect of network

Read More
Network Operations

NetFlow Port Number

What is the preferred Cisco NetFlow Port Number to listen on?  Well, it depends.  The NetFlow RFC 3954 does

Read More
Flexible NetFlow

Packet Length Report using NetFlow / IPFIX

We figured out how to report on packet length with NetFlow.  All you have to do is enter “match

Read More
Flexible NetFlow

Network Traffic Management : Cisco NBAR and Performance Monitoring

Most businesses want to take network traffic management to the next step and luckily the IT Gurus within these

Read More
Network Operations

VoIP DSCP Prioritization : NetFlow Reporting

Today I’ll cover the importance of VoIP DSCP prioritization when NetFlow reporting.  We have 3 employees that work remotely

Read More