NetFlow Analyzer Best Practices, Tips, Tricks

Agenda Professional vs Enterprise Edition System Requirements Storage Settings Performance Tuning Configure Flow Exports

Agenda.. Application Groups IP Groups Reports ASAM

Prof vs EE Professional Edition Up to 600 interfaces Standalone version Enterprise Edition Up to 20,000 interfaces Scalable Central – Collector architecture Distributed networks

System Requirments Flow RateProcessorRAMHDD 0 to Ghz Dual2 GB250 GB 3000 to GHz Dual4 GB600 GB 6000 to GHZ Quad8 GB1 TB (High Speed SATA or SAS Drive) Above GHz Quad8 GB1 TB (High Speed S ATA or SAS Drive with RAID 0 or RAID 10 config)

Central Server Configuration

Storage Settings NetFlow Analyzer classifies data into 2 types namely Aggregated Data and the Raw Data. The amount of hard disk space required to store the aggregated data forever is about 150 MB per interface. You will require a free disk space of 2MB to store one month of one minute traffic data for a single interface.

Raw Data Free hard disk space - (150 MB * No. of Managed Interfaces) Raw Data Period (in hours) = Bytes * 3600 seconds * Flows Per Second The maximum raw data storage period is 1 month and the minimum is a day.

JVM Configuration Admin  Performance Tuning Select the RAM View the Recommended Settings and Update You can also change the Maximum Java Memory and update

Configuring Flow Export Make sure the time in the router is correct time Netflow Analyer can handle routers from different time zones automatically, provided the correct time is set. Whenever the time difference between the NetFlow Analyzer Server and the router is above 10 minutes a warning icon will appear in the home page.

Application Groups The Application Mapping option lets you configure the applications identified by NetFlow Analyzer. Applications are categorized based on the source address, destination address, source port, destination port and protocol values in the flow record. These values are matched with the list of applications in the Application Mapping.

IP Groups Monitor Departmental Traffic Monitor Branch Office Bandwidth usage

Reports Schedule Reports Generate Reports based on IP Groups

ASAM Generate Security Events – Bad Src –Dst – Suspect Flows – Probe / Scans – Dos / Flash crowd

Thanks