NetFlow Analysis
An Overview of NetFlow Analysis
Characterizing IP traffic and understanding how and where it flows is critical for ensuring network availability, performance, and security. NetFlow analysis is the practice of using tools to perform monitoring, troubleshooting, and in-depth inspection, interpretation, and synthesis of traffic flow data. Analyzing NetFlow traffic data facilitates more accurate capacity planning and ensures that resources are used appropriately in support of organizational goals. In addition, netflow analysis helps network operators determine where to apply Quality of Service (QoS) policies as well as how to optimize resource usage, and it plays a vital role in network security to detect Distributed Denial-of-Service (DDoS) attacks and other undesirable network events and activity.
Overcoming Common Network Challenges with NetFlow Analysis
NetFlow analysis offers insight to overcome many common challenges encountered by network operators, managers, and engineers, including:
- Monitoring major contributors of network traffic: Network engineers can easily see top talkers and listeners on the network.
- Understanding application traffic and its network impact: An example is identifying unusual application network loads such as video content or large file transfers. NetFlow statistics can also be used to measure how application and policy changes affect costly WAN traffic.
- Optimizing Internet peering relationships: Organizations operating BGP peerings to maintain multi-homed connectivity to the Internet can utilize NetFlow data fused with BGP routing data to perform sophisticated peering analysis and optimize their peering arrangements. This can help improve service quality, reduce peering costs, or even uncover new revenue opportunities based on usage pattern analysis.
- Troubleshooting and understanding network pain points: NetFlow Analytics can diagnose slow network performance, recognize bandwidth hogs or misconfigurations, and characterize bandwidth utilization quickly via the intrinsic representation of traffic totals and traffic details.
- Detecting unauthorized WAN traffic: By analyzing NetFlow, it becomes possible to avoid costly upgrades to expensive WAN services by identifying the applications causing congestion, verifying legitimacy, and adjusting delivery policies to mitigate any adverse impact on higher-value concurrent traffic streams.
- DDoS and anomaly detection: NetFlow can also be used to detect DoS/DDoS and other types of network behavior anomalies.
- Validating QoS parameters: Because NetFlow includes all packet priority markings, it can be used to confirm that appropriate bandwidth has been allocated to each Class of Service (CoS) and that no CoS is over or under-subscribed.
Various organizations, such as network operations (NetOps), engineering, planning, architecture, and security, can use NetFlow analysis as a primary source of intelligence. Proper use of a NetFlow traffic analyzer can reduce the number of hardware and software technologies needed to manage networks. This reduces network administration costs, enhances cross-organizational collaboration and communications, and helps cross-functional teams get the most out of network investments.
Network Planning and Analysis
NetFlow data provides critical network monitoring information for sophisticated analysis to optimize strategic network planning (e.g., who to peer with, backbone upgrade planning, routing policy planning) as well as tactical network engineering decisions (e.g., adding additional VIPs to routers, upgrading link capacity) – minimizing the total cost of network operations while maximizing network performance, capacity, and reliability.
Network Monitoring
NetFlow data enables extensive, near-real-time network monitoring capabilities. Flow-based analysis techniques may be utilized to visualize traffic patterns associated with individual routers and switches as well as on a network-wide basis (providing aggregate traffic or application-based views) to provide proactive problem detection, efficient troubleshooting, and rapid problem resolution. Analysis of NetFlow can also be used as a basis for real-time alerting, improving network operators’ ability to react quickly and accurately to any major service disruptions as well as get early warning indicators of potential performance and service quality degradations that warrant proactive intervention.
Application Monitoring and Profiling
NetFlow data enables network managers to gain a detailed, time-based view of application usage over the network. Any common NetFlow type can be used to recognize applications by port/protocol, and some of the more advanced extensions to NetFlow (via sFlow or v9/IPFIX templates), such as Cisco’s Application Visibility and Control (AVC) solution, can document much greater application detail. Content and service providers may utilize this information to plan and allocate network and application resources (e.g., web server sizing and location) to responsively meet customer demands. Enterprises can use these same insights to understand application dependencies and resource consumption.
User Monitoring and Profiling
NetFlow data enables network operators to gain a detailed understanding of customer/user utilization of network and application resources. This information may then be used to efficiently plan and allocate network access, backbone, and application resources, as well as to detect and resolve potential network security and policy violations.
Related Resources about Netflow Analysis
At Kentik, we’ve taken NetFlow analysis to big data scale and offered it as an easy-to-use SaaS. Learn more about NetFlow analysis from these blog posts:
