NetFlow
Setting Flow Table Sizes on Juniper Routers
We often get support tickets from users saying that the amount of data shown in NFA does not correlate with SNMP or is simply...
Source ID and Observation Domain ID fields meaning & configuration details
This article highlights the importance of the Source ID and Observation Domain ID fields when several metering processes are running on the exporter observation...
Interface Names and Descriptions Best Practices and Configuration
The name of a network interface is a string that is generated based on the interface attributes. This is a predictable naming scheme used...
BGP Flow Specification Version 2
BGP Flowspec technology provides a more granular approach to Denial of Service (DoS) attacks mitigation when compared to old-school methods, such as Remotely Triggered...
Free and Open Source NetFlow analyzers. When Free isn’t really Free.
Have you ever found that a network usage reported by your commercial NetFlow analyzer does not match the actual values or that software contains bugs? ...
Introducing NFA Custom Groups
Network professionals count on NFA when monitoring and analyzing traffic, controlling bandwidth utilization, gaining insights into potential security issues, and reviewing BGP peering relationships....
Getting Started With Noction Flow Analyzer
Noction Flow Analyzer is a flow-based monitoring and reporting software tool that collects, stores, and presents traffic data across an entire network. NFA enables...
Cisco Catalyst 9200 / 9300 / 9400 / 9500 NetFlow Configuration
NetFlow is a great way to gather traffic statistics from your network. With Noction Flow Analyzer, you can view all your NetFlow data in...
The Evolution of Network Flow Monitoring, from NetFlow to IPFIX
Network flow monitoring is an essential tool for a lot of network administrators. Flow monitoring allows you to collect and record all IP traffic...
So, what exactly is NFA?
When you’re managing a network, there’s so much to think about — from monitoring bandwidth, discovering traffic patterns to performing threat analysis and providing...
Usage-based billing with NetFlow and sFlow
Usage-based billing enables customers to pay only for data that they have used. In order to charge customers based on data usage, a company...
Insider Threat Detection with NetFlow
When it comes to major security concerns, one of the most serious ones are the data breaches and security exploits caused by insider incidents....
Multicast Traffic Monitoring and NetFlow
With the increasing popularity of multicast media applications, the monitoring of multicast traffic becomes more and more important. When it comes to NetFlow, it...
One Way Delay Measurements and NetFlow
Role of RTT and OWD for TCP
RTT stands for Round Trip Time and it is a length of time that a packet takes from...
Questions to ask a NetFlow Vendor Before you Buy
Network visibility is crucial because we cannot manage and secure what we cannot see. NetFlow plays a critical role in traffic visibility by helping...
NetFlow and BGP
Border Gateway Protocol (BGP) is a core routing protocol used by most of the Internet Service Providers (ISPs). BGP’s role is to exchange routing...
Network Traffic Analysis and Alerting based on NetFlow
This article gives some insights on how to set up a network traffic analysis and alerting system based on NetFlow. NetFlow is an advanced...
SD-WAN and NetFlow
Software-Defined Networking (SDN) in a Wide Area Network (WAN) - SD-WAN is a technology that simplifies management of WAN by decoupling control plane from...
Identifying, monitoring and securing BYOD traffic with NetFlow
Bring Your Own Device (BYOD) is a practice that allows users to bring their personal devices such as tablets or smartphones to the workplace...
Finding MAC addresses using Flexible NetFlow
So far, we have discussed NetFlow configuration for network devices from various vendors such as Cisco, Juniper, Huawei, VyOS. We have collected layer 3...
Web Applications compromise detection using Flow Data
Our previous article discusses flow-based SSH compromise detection. A force attack against SSH hosts consists of scan, brute-force and compromise phases that can be...
SSH Compromise Detection Using Flow Data
Secure Shell (SSH) provides a secure channel over an unsecured network in a client-server model. SSH is typically used to log into a remote...
DNS Amplification Attacks Detection with NetFlow or sFlow
The Internet we know nowadays cannot properly operate without using the Domain Name System (DNS). DNS syncs up domain names with IP addresses so...
The Difference between SNMP and NetFlow. Why should I use both?
Simple Network Management Protocol (SNMP) is a well-known standardized application layer protocol, originally developed for network management but mostly used for network monitoring. SNMP...
Automatic versus Manual NetFlow Deduplication
Duplication of NetFlow occurs when the NetFlow records about the same flow are exported multiple times to a NetFlow collector. In turn, the volume...
Exporting Flow to multiple servers (Flow Samplicators)
In our previous article we have discussed the alternative way to get flow statistics using a NetFlow generator. One of the fundamental features of...
NetFlow Generators explained
What is a NetFlow Generator?
A NetFlow generator is a dedicated network appliance or software running on a PC and listening on a single or...
Configuring NetFlow on VyOS and Huawei Network Devices
This is the second part of the post dedicated to NetFlow configuration. In the first part, we’ve discussed the configuration of Flexible NetFlow on...
Configuring Cisco Flexible NetFlow and Juniper j-Flow v8
One of our recent blog posts dedicated to NetFlow technology provides the necessary knowledge needed to understand NetFlow principles and what it is used...
The accuracy and overhead of flow sampling. To use or not to use flow sampling?
Flow-based (NetFlow, IPFIX, NetStream) and packet-based (sFlow) network monitoring technologies enable network administrators to gain insight into traffic traversing a network. They provide various...
NetFlow vs. sFlow vs. IPFIX vs. NetStream. Network Traffic Analysis and Network Traffic Monitoring.
Network monitoring is a systematic effort to monitor parameters of a computer network in order to detect issues that degrade network performance. Network Traffic...