Introduction
Real-time NetFlow Analyzer provides a granular view of your network traffic. Using this
tool you can see the last 5 to 60 minutes of flow data broken out by
applications, conversation, domains, endpoints, and protocols. You can use
Real-time NetFlow Analyzer to explore exactly how your bandwidth is being used and
by whom.
Capturing NetFlow and AppFlow Data
Before you can begin analyzing data exported by your
routers and switches, you need to capture the flows. Ensure you complete
the following tasks before attempting to monitor data with Real-time NetFlow Analyzer:
- Modify the configuration of your NetFlow device to ensure it is exporting
NetFlow data. Due to the large number of different routers and switches
that can export NetFlow data, consult your Cisco device documentation
as to how to enable NetFlow data export. A technical reference is
available on the SolarWinds website that provides guidance. For more
information, see
SolarWinds Documentation and
review the Enabling NetFlow and NetFlow Data Export on Cisco Catalyst
Switches technical reference.
- Modify the configuration of your AppFlow device to ensure it is exporting data. AppFlow only displays data captured using a Citrix Netscaler device. For more
information, see Citrix NetScaler
- Ensure you know the port on which to listen for NetFlow/AppFlow data. This port is
part of the configuration of the NetFlow device.
- Ensure you know the IP address or hostname of the NetFlow or AppFlow device.
- Ensure you know the community string or SNMP version 3 credentials.
To begin capturing your NetFlow or AppFlow data:
- Click Start > All Programs > SolarWinds Real-time NetFlow Analyzer > SolarWinds Real-time NetFlow Analyzer.
- Specify the port on which your NetFlow or AppFlow device is exporting data in the
Listen on port field.
-
Click Tools > Add NetFlow Device, and then specify the following
information on the NetFlow Device Credentials window.
- IP address or hostname of the NetFlow device
- Community string or SNMP version 3 credentials.
- Click Test, and then review the Credentials Test window.
- Make any necessary adjustments to your values on the NetFlow Device
Credentials window, and then click OK.
Note: If Real-time NetFlow Analyzer is able to see data, either NetFlow or AppFlow displays in the Flow Type column of the Realtime NetFlow
Analyzer user interface.
Storing NetFlow Data
Real-time NetFlow Analyzer stores up to 60 minutes of captured data in
Microsoft Access-readable capture files. You can modify the location of
capture files by changing the path displayed in the Capture file field of the
Real-time NetFlow Analyzer user interface.
Analyzing NetFlow Data
Real-time NetFlow Analyzer analyzes traffic, grouped in a
number of different ways:
- Applications
- Allows you to see all the traffic passing through the specific port based on the
application. Applications use specific ports to send data. This mapping
between port, application, and traffic is used to create the specific data
points. Depending on the value selected in the Display list, the number of applications listed
in the tree changes. Expanding Applications provides an
inclusive graph.
- Conversations
- Allows you to see traffic based on source and destination IP, source and
destination port, and the protocol used. These 5 data points grouped
together and matched create a single conversation. For example, a
conversation between 1.1.10.10 and google.com is defined by 1.1.10.10,
google.com, port 80 (HTTP) on both IP addresses, and the TCP
protocol. Clicking an IP address in the tree provides a view of all the
other IP addresses or domains with which this IP address is
communicating. Expanding Conversations provides an
inclusive graph of your highest traffic conversations.
- Domains
- Allows you to see all traffic in a domain. The domain consists of all IP
addresses that were resolvable, using reverse DNS, to that domain.
Clicking a domain or IP address in the tree provides a view of all the
other domains or IP addresses with which this domain is communicating.
Expanding Domains provides an inclusive graph of all the
domains on which traffic is being detected.
- Endpoints
- Allows you to select specific IP addresses (hosts) and view all the data
transmitted and received by that host. Expanding Endpoints
provides an inclusive graph. This view does not separate data by
application (port) or protocol, but provides an overview of your highest
traffic producers.
- Protocols
- Allows you to see all the traffic that matches a specific protocol, for
example, TCP or UDP. Clicking a specific protocol provides a view of the
individual applications used by the protocol to traverse the specified interface.
Expanding Protocols provides an inclusive graph of all traffic
produced split into protocols.
Analyzing AppFlow Data
Real-time AppFlow Analyzer displays a summary of the top AppFlow applications, grouped by the number of HTTP requests.
- Applications
- Allows you to see a summary view of the top services/servers by number of requests with which the application is communicating. Expanding Applications displays an inclusive graph of all inbound traffic being detected.
- Clients
- Expanding the client listed allows you to see a summary of the Top Clients and Top User Agents. Top Clients are the clients who have generated the most number of HTTP requests. Top User Agents are the top browsers who have generated web requests. For example, it will show the number of times that FireFox sent a request.
- Services
- Top URLs by Latency shows the requests to resources that took the longest to complete. Displays both latency between the client and the NetScaler device, and between the NetScaler device and the services. HTTP Status Codes displays the list of HTTP Response Codes returned by the services and how many times they appeared. HTTP Methods displays the top HTTP Request Methods and the amount of times they have occurred.
Viewing Data
To view the data collected in easily analyzed graphs:
- Click the interface through which NetFlow data is flowing and you want to
analyze, and then click Start Flow Capture.
- Review the information displayed in the analysis graphs.
Notes:
- The tree view can be expanded to reveal individual applications,
conversations, domains, endpoints, and protocols. The tree views
are dynamic and change based on time period and the value selected in the Display list.
- The refresh rate is in seconds.
Defining Applications and Modifying Port Definitions
Real-time NetFlow Analyzer uses the port utilized by an application to define the application.
To modify the definition of a port or define an unknown port:
- Click the interface through which NetFlow data is flowing and you want to
analyze, and then click Start Flow Capture.
- Click Tools > Application Mappings.
- To add a new Application definition:
- Click the Add New Mapping (
) icon.
- Provide the appropriate information on the Add New Mapping window, and then click OK.
- Ensure the spreadsheet of applications, protocols, and ports is correct, and then click OK.
- To edit the definition of a port or Application:
- Click the Edit Selected Entry (
) icon.
- Modify the appropriate fields on the Edit Mapping window, and then click OK.
- Ensure the spreadsheet of applications, protocols, and ports is
correct, and then click OK.
Legal
Copyright 1995-2011 SolarWinds, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of SolarWinds. All right, title and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its licensors. SolarWinds Orion™, SolarWinds Exchange Monitor™, and SolarWinds Toolset™ are trademarks of SolarWinds. SolarWinds® and the SolarWinds logo are registered trademarks of SolarWinds. Microsoft Exchange Server, Windows Server, Windows Vista, and Windows XP are registered trademarks or trademarks of Microsoft Corporation in the United States and other countries. All other trademarks contained in this document and in the Software are the property of their respective owners.
SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.