EV Observe - Use NetworkAnalysis-NetFlow Service Template
The NetworkAnalysis-NetFlow service template analyzes nfcapd export files stored on the NetFlow collector in order to establish statistics on bandwidth usage of network interfaces monitored by NetFlow.
- It is used to monitor and analyze bandwidth consumption by focusing on a given service, e.g. application, user or protocol, over a given period.
- It collects performance data such as bandwidth consumption in both absolute values and percentages, average peak usage, etc.
- It is used to generate charts and alerts if the specified thresholds are exceeded for each service deployed.
See NetFlow network traffic monitoring: Operating principle
NetworkTrafficMonitoringChallenges
Challenges in network traffic monitoring
- Identify the users, applications and protocols with the highest bandwidth consumption in order to optimize the performance of the infrastructure and Internet access costs, and improve the quality of service.
- Anticipate the risk of incidents and adopt measures to prevent technical network failure.
- Define bandwidth consumption strategies, implement the required corrective measures and anticipate bandwidth upgrades.
- Identify the causes of bandwidth bottlenecks rapidly to ensure a return to normal operations as quickly as possible.
Notes
- One service must be deployed for each application, source IP and destination IP to be monitored by NetFlow.
- NetFlow flow exports are identified as a combination of the following key fields: source IP address, destination IP address, source port number, destination port number, IP protocol, input logical interface and type of IP service. These are used to collect bandwidth usage statistics.
- This information must be specified in the Availability and checks tab each time the service template is deployed for a given service, e.g. application, server, router, etc.
- Any information other than this in this tab is optional. It is used to fine-tune surveillance of bandwidth usage for the monitored service.
Best Practice
- Link the NetworkAnalysis-NetFlow service template and a NetFlow exporter, i.e. the switch or router exporting NetFlow data.
- Give a meaningful name to each service linked to the service template so users can identify it easily.
example
- Analysis of FTP bandwidth usage ==> FTP_bandwidth service
- Analysis of CRM bandwidth usage ==> CRM_bandwidth service
- Use the NetworkAnalysis-NetFlow-TOPList and NetworkAnalysis-NetFlow-TOPList_CONNECTIONS service templates in addition to the NetworkAnalysis-NetFlow service template to collect the source IP addresses, connections and protocols with the highest bandwidth consumption.
Procedure: How to use the NetworkAnalysis-NetFlow service template
Prerequisites
See the detailed procedure Configure NetFlow Monitoring Prerequisites
Step 1: Create the new service
SelectCompanyInCompanyTree_Procedure
1. Go to the Web app.
2. Select the company from the company tree structure.
Notes:
- The selected company must be associated with a Box.
- You can create a new company.
See the procedure
3. Create a new service.
- Select Configuration > Services > List in the menu.
- Click + Add in the Mode: Box tab.
4. Specify the information below.
General information tab
- Service template: Select the NetworkAnalysis-NetFlow service template.
- Name: Enter the name of the new service to be created. Its name should correspond to the event to be captured.
Availability and checks tab
- Collector Storage: IP address of the NetFlow collector.
- Protocol:
- Destination IP: IP address of the network interface monitored by NetFlow.
- Destination port: Listening port of the network interface monitored by NetFlow.
- Source IP:
- Source port:
- Destination network:
- Source network:
- Allocated bandwidth: Value allocated to the bandwidth in the specified output unit.
- The allocated value will be used in calculating usage ratios.
- Units: Output unit (Kbps, Mbps, Gbps).
- Warning threshold: Warning threshold for bandwidth consumption, expressed as a percentage.
- Critical threshold: Critical threshold for bandwidth consumption, expressed as a percentage.
- Directory name: Destination folder for network interface flow exports.
- Absence status: Status indicated if there is no export data.
example
- Value 0 indicates that the status is normal (OK)
- Value 1 indicates that the status is critical (NOK)
5. Click Apply.
Use cases
UseCases
- Detect non-business traffic, e.g. YouTube videos, Spotify, etc.
- Monitor the peak loads of replication services such as backups.
- Monitor the throughput generated by the email server.
- Display performance data in both absolute values and percentages, and the average peak usage.
- Display the overall bandwidth consumption for the LAN network and its breakdown by service, e.g. Web, phone systems, CRM, etc.