NetFlow Analysis with NetQoS ReporterAnalyzer

Improve Network Visibility and Performance Using Cisco IOS NetFlow Data

Cisco NetFlow technology is software contained within the Cisco IOS that provides important information about traffic on the wide area network (WAN). Using Cisco NetFlow and a NetFlow analyzer like NetQoS ReporterAnalyzer, engineers can determine the applications taking up the bandwidth, who is using them, and when. Thousands of IT organizations worldwide have embraced NetFlow which is capable of providing them the same flow information traditional probes provide but at a much lower cost to deploy and maintain.

NetFlow analyzer products such as NetQoS ReporterAnalyzer export NetFlow data periodically, store and analyze the data to help you:

Identify Applications On the Network
To effectively troubleshoot network-related issues, network engineers must have visibility into what applications the traffic is comprised of on a particular network interface. Traditional SNMP-based network management tools provide link utilization statistics but lack the ability to break down the distribution into individual protocols. With NetFlow, routers export statistics about every single application routed through the device. This generates the data that a NetFlow analyzer uses to provide insight into the applications that are on your network and help you determine potential root causes of network performance problems.
NetQoS ReporterAnalyzer collects, analyzes and reports on NetFlow data to graphically show the distribution of applications across a network interface. When troubleshooting a network performance problem, this level of detail is absolutely critical in pinpointing the application responsible for the reduction
Identify Top Users of Bandwidth On the Network
Sometimes knowing the application responsible for performance problems is not enough. In fact, in many instances, it is more critical to identify which particular clients or servers are participating in the use of the application. With NetFlow, the routers not only export information regarding the application flows on a network, but the actual hosts (clients, servers, networked devices, and so on) communicating via the application. This information is useful for isolating "top talkers" or top users of bandwidth on your network and aids in identifying illegitimate hosts that can be eliminated or blocked.
Unlike flow sampling technologies, NetFlow reports every single host's IP address that passes through the routing device. Because of this, NetFlow analyzers can report security and audit violations on the network. With other sampling technologies, some flows are omitted making them unsuitable for this purpose.
To understand whether the web traffic is legitimate or not, you need visibility into the actual hosts involved in conversations. While troubleshooting network performance problems, it is critical to have visibility into hosts responsible for impacting business-critical applications. NetQoS ReporterAnalyzer provides charts and tabular data to give you this level of host-based visibility.
Investigate Threshold Exceptions
As an option, routers can be configured to export network traffic statistics via NetFlow in near real time. With this level of exporting frequency from the routers, NetFlow analyzers should have a mechanism to detect potentially problematic network conditions - so that you can be notified when alarm conditions occur.
While there are many ways to set these alarms, NetQoS ReporterAnalyzer automatically sends SNMP traps to log and investigate whenever rates or utilization exceed thresholds - these traps can capture information such as the interface on which the exception occurred, the application causing the exception, and the actual value of rate, utilization, etc., recorded at the time of the alarm.
Validate QoS Implementations
Quality of Service (QoS) is commonly implemented when specific applications require a guaranteed priority on the network. Latency-sensitive applications like Voice-over-IP (VoIP) or streaming video often demand a high level of service to provide a good end-user experience.
The increasing popularity of Multiprotocol Label Switching (MPLS) networks is also driving network teams to become more educated on proper implementation strategies. One of the requirements for a successful MPLS implementation is to categorize specific applications into different classes within a given set of QoS policies.
Regardless of the business use, NetFlow is a great source of data to help validate QoS implementations. And a NetFlow analyzer like NetQoS ReporterAnalyzer can extract QoS information to report on different Type of Service (ToS) class usage as well as queue-based protocol distribution, to help you do exactly that.
Compare Application Usage Patterns
Because routers are not intended to store NetFlow indefinitely, collectors and external data stores are required to capture NetFlow for historical analysis and reporting purposes. Without long-term NetFlow data retention, there is no way to compare current traffic behavior with historical patterns for particular applications. Ideally, reporting products should marry up-to-the-minute real-time application performance data with historical data for trending and capacity planning. Correlating application use patterns to a historical baseline using NetQoS ReporterAnalyzer helps to track down the root causes of performance problems.
Understand Bandwidth Utilization and Growth
Another powerful use of long term, historical NetFlow data is the ability to plan for future capacity requirements. By understanding how bandwidth and application utilization grow over time, organizations are equipped with information to help them make educated resource predictions to accommodate future growth.
Many capacity planning groups are starting to realize the value of long term, historical NetFlow data when projecting resource. By trending application growth on particular interfaces, they can make informed decisions regarding bandwidth upgrades and when they will be required. For some organizations with global deployments, knowing when an interface requires upgrading allows them to plan for the long lead times that are needed to implement the upgrade and, as a result, avoid performance deteriorations.
By analyzing long-term, historical NetFlow data, you can make projections of capacity requirements one week, one month, or one year into the future. NetQoS ReporterAnalyzer provides analysis of application growth trends as well - as well as chart them.
NetFlow, NetFlow analyzers, and other flow technologies will continue to evolve to provide traffic analysis statistics useful to organizations of all sizes. And, ReporterAnalyzer is the only NetFlow monitoring product that scales to support the volume of flow data typical in the world's largest networks, providing real-time visibility into network traffic throughout the enterprise. Uniquely capable of accessing one year of enterprise-wide

Register for an evaluation of NetQoS ReporterAnalyzer today and learn why it is the industry standard NetFlow analyzer for monitoring and analysis.