Introduction

Real-time NetFlow Analyzer provides a granular view of your network traffic. Using this tool you can see the last 5 to 60 minutes of flow data broken out by applications, conversation, domains, endpoints, and protocols. You can use Real-time NetFlow Analyzer to explore exactly how your bandwidth is being used and by whom.

Capturing NetFlow and AppFlow Data

Before you can begin analyzing data exported by your routers and switches, you need to capture the flows. Ensure you complete the following tasks before attempting to monitor data with Real-time NetFlow Analyzer:

To begin capturing your NetFlow or AppFlow data:

  1. Click Start > All Programs > SolarWinds Real-time NetFlow Analyzer > SolarWinds Real-time NetFlow Analyzer.
  2. Specify the port on which your NetFlow or AppFlow device is exporting data in the Listen on port field.
  3. Click Tools > Add NetFlow Device, and then specify the following information on the NetFlow Device Credentials window.
  4. Click Test, and then review the Credentials Test window.
  5. Make any necessary adjustments to your values on the NetFlow Device Credentials window, and then click OK.
    Note: If Real-time NetFlow Analyzer is able to see data, either NetFlow or AppFlow displays in the Flow Type column of the Realtime NetFlow Analyzer user interface.

Storing NetFlow Data

Real-time NetFlow Analyzer stores up to 60 minutes of captured data in Microsoft Access-readable capture files. You can modify the location of capture files by changing the path displayed in the Capture file field of the Real-time NetFlow Analyzer user interface.

Analyzing NetFlow Data

Real-time NetFlow Analyzer analyzes traffic, grouped in a number of different ways:

Applications
Allows you to see all the traffic passing through the specific port based on the application. Applications use specific ports to send data. This mapping between port, application, and traffic is used to create the specific data points. Depending on the value selected in the Display list, the number of applications listed in the tree changes. Expanding Applications provides an inclusive graph.
Conversations
Allows you to see traffic based on source and destination IP, source and destination port, and the protocol used. These 5 data points grouped together and matched create a single conversation. For example, a conversation between 1.1.10.10 and google.com is defined by 1.1.10.10, google.com, port 80 (HTTP) on both IP addresses, and the TCP protocol. Clicking an IP address in the tree provides a view of all the other IP addresses or domains with which this IP address is communicating. Expanding Conversations provides an inclusive graph of your highest traffic conversations.
Domains
Allows you to see all traffic in a domain. The domain consists of all IP addresses that were resolvable, using reverse DNS, to that domain. Clicking a domain or IP address in the tree provides a view of all the other domains or IP addresses with which this domain is communicating. Expanding Domains provides an inclusive graph of all the domains on which traffic is being detected.
Endpoints
Allows you to select specific IP addresses (hosts) and view all the data transmitted and received by that host. Expanding Endpoints provides an inclusive graph. This view does not separate data by application (port) or protocol, but provides an overview of your highest traffic producers.
Protocols
Allows you to see all the traffic that matches a specific protocol, for example, TCP or UDP. Clicking a specific protocol provides a view of the individual applications used by the protocol to traverse the specified interface. Expanding Protocols provides an inclusive graph of all traffic produced split into protocols.

Analyzing AppFlow Data

Real-time AppFlow Analyzer displays a summary of the top AppFlow applications, grouped by the number of HTTP requests.

Applications
Allows you to see a summary view of the top services/servers by number of requests with which the application is communicating. Expanding Applications displays an inclusive graph of all inbound traffic being detected.
Clients
Expanding the client listed allows you to see a summary of the Top Clients and Top User Agents. Top Clients are the clients who have generated the most number of HTTP requests. Top User Agents are the top browsers who have generated web requests. For example, it will show the number of times that FireFox sent a request.
Services
Top URLs by Latency shows the requests to resources that took the longest to complete. Displays both latency between the client and the NetScaler device, and between the NetScaler device and the services. HTTP Status Codes displays the list of HTTP Response Codes returned by the services and how many times they appeared. HTTP Methods displays the top HTTP Request Methods and the amount of times they have occurred.

Viewing Data

To view the data collected in easily analyzed graphs:

  1. Click the interface through which NetFlow data is flowing and you want to analyze, and then click Start Flow Capture.
  2. Review the information displayed in the analysis graphs.
    Notes:

Defining Applications and Modifying Port Definitions

Real-time NetFlow Analyzer uses the port utilized by an application to define the application.

To modify the definition of a port or define an unknown port:

  1. Click the interface through which NetFlow data is flowing and you want to analyze, and then click Start Flow Capture.
  2. Click Tools > Application Mappings.
  3. To add a new Application definition:
    1. Click the Add New Mapping () icon.
    2. Provide the appropriate information on the Add New Mapping window, and then click OK.
    3. Ensure the spreadsheet of applications, protocols, and ports is correct, and then click OK.
  4. To edit the definition of a port or Application:
    1. Click the Edit Selected Entry () icon.
    2. Modify the appropriate fields on the Edit Mapping window, and then click OK.
    3. Ensure the spreadsheet of applications, protocols, and ports is correct, and then click OK.


Legal