NetFlow Analyzer and NBAR – A step closer to better Traffic Management

Oct 27 2009 08:34:29 AM Posted By : Don Thomas Jacob
Comments (0)
Bandwidth monitoring and traffic analysis is turning out to be more important than ever with growing advances in networking technologies and advent of Web 2.0. It is no more possible to simply let the organization's traffic network pass through the WAN links, pushing each other for bandwidth. Prioritizing traffic, so that mission-critical applications receive the bandwidth they need, is the key word today.

There is a little feature called NBAR available in many Cisco devices, which lets you do a lot more than it spells and can play a great role in defining the network's traffic policies.

NBAR or Network-Based Application Recognition is a feature available in Cisco IOS that does a deep packet inspection of traffic passing through an interface and can recognize a wide variety of applications, including applications that dynamically assigns TCP or UDP port numbers or even undesired applications that uses well known port numbers to mask itself.

NBAR will show the details of the applications used on an interface basis. The feature can identify even peer to peer applications like Bit Torrent or applications like Skype which uses random port numbers for connectivity and hogs the organizational bandwidth. The results available from NBAR can also be used to define your QoS policies in a much better manner blocking out the unwanted applications.

NetFlow Analyzer, which uses NetFlow data and other similar flow data to give reports on bandwidth usage by host, port, protocol, applications, DiffServ and conversations, can also report on NBAR statistics from the your devices, making reporting an easy task.

NBAR Report

NBAR with its deep packet inspection capability is a great feature for security analysis also. An example is how NBAR helped to identify CODE-RED worm and the related Cisco information can be seen from here. You can even make use of the AutoQoS for the Enterprise feature available in some Cisco devices which can use NBAR data for prioritizing traffic. Do check out how to do this from here.

Since NBAR data help define CBQoS policies, NetFlow Analyzer can also report on the Class Based QoS policies and its pre and post policy traffic usage and drops. Get a first hand experience of the features in NetFlow Analyzer using the 30 day trail.

Download | Interactive Demo | Product overview video | Twitter | Customers

Regards,
Don Thomas Jacob

Posted Under : Technical
Tags : netflow netflow analyzer QoS traffic analysis NBAR network based application recognition skype tracking cisco NBAR deep packet analysis quality of service peer to peer application
Share this article: Tweet this  Connect with Facebook  Bookmark in Delicious  Add to Digg  Stumble it
Permalink TrackBack

ManageEngine NetFlow Analyzer - Deadly Combination Of Multiple Cisco-IOS Technologies For detailed Network Visibility And Forensics

Oct 12 2009 07:34:45 AM Posted By : vraj
Comments (0)

 Growing network needs complicate the job of network administrators and bring in new challenges. Network Administrators need robust,cutting-edge network management tools to quickly troubleshoot network incidents and increase the network performance. However considering the economic situation, it is very important to choose the right application which can leverage on network performance management data from multiple technologies and of course at an affordable cost. 

       ManageEngine NetFlow Analyzer team constantly interacts with its customers, technology companies and VARS to prioritize the road map. Whenever a new technology is introduced in the product, all existing customers see an immediate value by means of simple free upgrade instead of paying a hefty price. Here the ROI includes cutting bandwidth upgrade costs due to increased visibility using ManageEngine NetFlow Analyzer, avoid unauthorized bandwidth usage and increase the efficiency of business critical applications with almost zero implementation cost.

Multiple technologies - Single Solution:

Cisco NetFlow:

       Cisco's NetFlow technology exports flow records from any IOS capable routers and switches. The exported flow records contain information about protocols, ports, source, destination IP addresses and much more. 

       NetFlow Analyzer provides several instant reports to monitor bandwidth including top talkers, top protocols, top conversations, and more. Apart from these pre-defined bandwidth reports, NetFlow Analyzer also includes options to search for specific bandwidth usage details based on IP address, host name, protocol, and more.

NetFlow Based Bandwidth Information

Bandwidth Monitoring without Probes

       NetFlow Analyzer does network bandwidth monitoring using NetFlow. NetFlow exports are collected, correlated, and analyzed to get granular details to monitor bandwidth usage across each WAN link. There is no need for hardware probes to monitor bandwidth usage. NetFlow Analyzer is an all software solution which is suitable for both Windows and Linux.

Real-time Bandwidth Monitoring

       Bandwidth monitoring reports for each interface shows the current, average, and peak bandwidth usage patterns across each NetFlow-enabled interface. With these bandwidth usage statistics you can get instant visibility into how much bandwidth was used up by hosts, applications, and conversations across a specific interfaces.

Application-wise Bandwidth Distribution

       To monitor bandwidth utilized by different applications, NetFlow Analyzer gives you instant visibility into which applications are using up maximum bandwidth. You can also drill down to see the top sources, destinations and conversations using the bandwidth. With such granular detail, network troubleshooting and problem resolution take far less time than with traditional tools.

Cisco NBAR:

    Cisco NBAR (Network Based Application Recognition) engine runs on the IOS and does deep packet inspection to identify applications riding on regular ports. For example TCP 80 can be identified as kazza2, BitTorrent, Napster etc. The respective utilization, volume and speed can be polled through SNMP protocol over time.

NBAR Reports


    NBAR reports are very useful to set the Quality of Service (CB-QoS) policies. NBAR and QoS policies can work together to prevent bandwidth stealing applications and increase the efficiency of business critical applications.

Cisco CB-QoS (Class Based - Quality of Service):

      We have discussed a lot about deploying CB-QoS policies for improved network performance. You can find CB-QoS blog series in this link.  Cisco    CB-QoS is the simplest way to prioritize network traffic. 

CB-QoS Reports

Having insights over pre and post policy metrics, network administrators can modify their CB-QoS policy configuration for improved performance and to avoid any impact to business critical applications due to misconfiguration.

       This is why we call ManageEngine NetFlow Analyzer is a powerful traffic analysis and forensic solution for a network of any size. Try our 30 days all feature version and write your queries to  netflowanalyzer-support@manageengine.com

Thanks

Raj

Download | Interactive Demo | Product overview video

Posted Under : General
Tags : nbar netflow netflow analyzer validating qos policies network based application recognition cbqos qos network forensics bandwidth monitoring
Share this article: Tweet this  Connect with Facebook  Bookmark in Delicious  Add to Digg  Stumble it
Permalink TrackBack

Search Post
 
Latest Posts
Authors
Categories
BlogRoll
© 2009 Corp. All rights reserved. Trademarks | PrivacyPolicy | Site Map | Contact Us | Careers