Enterprises, who serve a large customer base spread geographically, need a distributed setup of branch offices and head quarters. This helps organizations grow their business through better reach and customer interaction. Connectivity between the various office branches and head office is also a major requirement for faster data and information transfer. With such a distributed setup also comes the requirement for monitoring the traffic from the branches to the Internet and to other sites to ensure connectivity which can otherwise affect business continuity.

Trying to diagnose and troubleshoot network problems at the remote locations can be a tough task as your router cannot show who is consuming the bandwidth, what application is used, the hosts involved, when spikes or choke in bandwidth occurred and due to what this happened. Deploying technical staffs at all branches for monitoring purposes is not a feasible solution too.

This is where NetFlow and NetFlow Analyzer comes into the picture. Most of the Cisco devices supports NetFlow feature by default and other major vendors like HP, Riverbed, Juniper, Enterasys and so on also have a similar flow technology. NetFlow Analyzer supports not only NetFlow but most of the major flow formats. All you need to do is enable NetFlow on the devices and have them exported to your server running NetFlow Analyzer. And yes, you do not have to worry about the bandwidth taken up by NetFlow export as NetFlow itself does not utilize more than 2% to 3% of the link capacity.

Using NetFlow Analyzer you can see traffic statistics for the whole branch office, who used what applications and how much of it and so on. As a network administrator you may also want to specifically see the traffic to the Internet and not to the main office. Now, how can this be achieved?
For this purpose, the IP Group feature available in NetFlow Analyzer can be used. Using IP Groups, you can monitor a specific ‘IP’ entity and make use of include and exclude options. To monitor traffic from the branches to the Internet and not the main office, create an IP Group and include the IP Network of the branch and exclude the IP Network of your main office. Also set the speed of the IP Group which is used for utilization calculation and can be set based on the associated interface speed or on the bandwidth allocated to the branch for Internet traffic.

Creating IP Group for branch office monitoring
Creating IP Group for branch office monitoring

Once the IP Group is created, the traffic will be categorized based on the added criteria. In this IP Group, all traffic from the branch, but excluding the traffic to the main office, will be accounted for. You can see the traffic utilization to the Internet by the branches, the speed at which traffic is traversing, the applications going to the Internet, the hosts involved with the traffic and etc. When there is a bandwidth choke, you can check the traffic report and drill down to see the hosts involved, the destination to which they send traffic and what application was used.

Branch office Link utilization
Branch office Link utilization

Applications to Internet from branch
Applications to Internet from branch

So, sitting at the main office, you can monitor the branch office traffic to the Internet, if the links provided are being utilized or if there is unwanted traffic. This data helps make capacity planning decisions, find who misused the WAN connection and you can also get reports to your email using Schedule Reports and also have Alerts generated when the utilization exceeds a certain percentage. With NetFlow Analyzer and these features, remote management is taken to the next level.

You can view a live demo of the product from here. Do post your suggestions and download NetFlow Analyzer trail edition to see what more you can do with the product.

Regards,
Don Thomas Jacob