1. NetVizura A network traffic analysis tool

2. Agenda Why NetVizura is needed How NetVizura works Where NetVizura is deployed Use cases

3. 3 Why Use NetVizura?

4. 4 1.A flow is unidirectional 2.Defined by inspecting a packet’s key fields (common properties) and identifying the values 3.If the set of key field values is unique create a flow record or cache entry How Does NetVizura Work? Part 1: IPFIX Flow Data

5. How Does NetVizura Work? Part 2: Define Traffic Patterns Traffic pattern = IP addresses that represent an internal and external network 5 Internal Network: 128.117.0.0/16 External Network: Internet

6. NetVizura Deployment 6

7. Case 1: NCAR’s Top Hosts 7

8. Case 2: Glade Who does Glade exchange traffic with? 8

9. Case 3: MSUD Traffic Spike Port Utilization 9

10. Case 3: MSUD DOS Attack Top Hosts 10

11. Case 3: MSUD DOS Attack Top ASs 11

12. Questions? 12