WhatsUp Gold Flow Monitor

Overview:

Managing a company network is a bit like performing in a high wire act. To do it right takes a great deal of balance. On one hand you have the availability, service level, and performance needs of your company and users. And on the other hand you have a tight IT budget to deliver on their expectations. In a perfect world, you could walk the high wire with ease perfectly balanced and the company network would hum along effortlessly delivering exactly the level of service required.  Unfortunately, something always throws a wrench into the picture - bringing the company network to a bumpy crawl and some rough weather for you on the wire.

Who or what is the top offender? Possibly an over-utilized network.
But how did this happen?

You know that the bandwidth from your ISP should be plenty for your organization. You’d even planned for network spikes and have a safety margin built in. All device monitors seem to be green. Yet your users complain your network is slow. Maybe you can afford to add more bandwidth - but there is perhaps one more step for you to take before you do that.  You can know how your network is being used.

Flow Monitor Helps Ensure Network Performance and QoS

Our solution to your balancing act - is the new WhatsUp Gold Flow Monitor. Available as a fully integrated plug-in to WhatsUp Gold, Flow Monitor provides detailed insight into exactly how your network bandwidth and capacity are utilized. Flow Monitor not only highlights the overall utilization of the LAN, WAN, specific device, or interface, it also indicates which users, applications and protocols are consuming the bandwidth. And for business critical applications, Flow Monitor enables you to easily conduct traffic identification and analysis, as well as verify Quality of Service (QoS) through ToS, or DSCP for the LAN/WAN.

With WhatsUp Gold Flow Monitor, you can ensure application performance and save money, by eliminating costly bandwidth utilization issues.

With WhatsUp Gold Flow Monitor you can:

• Determine exactly which users, applications or hosts are consuming network bandwidth
• Track and resolve network traffic or congestion problems
• Monitor the network for unauthorized application usage; easily detect streaming audio, video, or file sharing applications
• Ensure critical business applications get the bandwidth they need
• Detect DOS attacks and other rogue activity directed at your network
• Do it all with you existing hardware, no upgrade required*

Key capabilities of the WhatsUp Gold Flow Monitor include:

*Support for Popular Flow Formats

In a single plug-in, Flow Monitor offers support for all the popular flow management formats, including NetFlow, sFlow and J-Flow. With such extensive flow format support, you can utilize Flow Monitor using your existing infrastructure – no need to upgrade. Flow Monitor works with an extensive list of switches and routers from vendors such as Cisco, Extreme, Juniper, HP, and many more.

Visibility into Network Bandwidth Utilization

Attempting to diagnose a slow network without visibility into QoS and exactly what traffic is causing the problem, is really only seeing a tiny part of the picture. With WhatsUp Gold’s Flow Monitor, you have the complete real-time visibility you need to manage bandwidth utilization and ensure optimal network performance.

Comprehensive Reporting

Flow Monitor takes raw network traffic data from routers and switches and converts it into useful reports which track real-time usage as well as historical trends. The Flow Monitor reports can be integrated with WhatsUp Gold’s core reporting to present a consolidated view of network performance.  Flow Monitor V2 features several new reports including the Interface Usage Report, ICMP Type Report, and the Packet Size Distribution Report.

Threshold Based Alerting

In conjunction with the new Alert Center, Flow Monitor makes it easy to find out exactly where and when problems may develop.  You can now set up multiple configurable thresholds tracking the volume of traffic between conversation pairs, failed connections per host, top senders and receivers, and specific interfaces over time. Custom configurable thresholds provide even more granular tracking of network traffic. With the combined Flow Monitor and WhatsUp Gold solution, alerts are sent when key thresholds are breached, enabling network managers to proactively troubleshoot and resolve performance bottlenecks and eliminate malicious network behavior.

Features:

 

Flow Monitoring Basics

• Support for Cisco’s NetFlow v1, v5, v9; sFlow v5; Juniper Network’s J-Flow format
• Dedicated SQL Server database
• Extensive support for switches and routers from Cisco, Juniper, Foundry, Extreme, Enterasys and Packeteer
• Choice of either integrated install with WhatsUp Gold as a plug-in or separate Flow Monitor package installation
• Complete integration with WhatsUp Gold Alert Center

Monitoring/Troubleshooting Capabilities

• Automatic classification of traffic by type and protocol in real-time
• Identification of traffic flow patterns through the network in real-time
• Identification of traffic sources (top talkers) and destinations
• Identification of traffic destination by group, domain, top level domain (TLD), and country
• Pinpointing of internal and external traffic sources and destinations
• Conducting traffic identification and analysis for LAN and WAN for Quality of Service through ToS or DSCP
• Grouping of flow data based on common parameters, including IP addresses by domain, TLD or country
• Automatic identification of high traffic flows to un-monitored ports and highlighting of those ports as candidates for monitoring
• Exposure of unauthorized applications, including file and music sharing
• Detection of failed connections

Reporting

• Access to 21 flow management reports via WhatsUp Gold web console
• Automated rollup of flow data with hourly, daily, weekly, monthly and yearly views
• User configuration of all reports to display flow information in custom formats
• Sorts and displays filtered reports by protocol, application, host, domain, TLD, country, groups or type of service
• Integration of flow reports with WhatsUp Gold workspace reports
• Access to WHOIS information for sender and receiver reports
• Display traffic information by bytes, packets or flows

Configuration and Management

• Configuration of flow sources
• Configuration of role based management for user access to configuration and reports
• Configuration and management of flow data retention policies
• Configuration of flow logging levels
• Configurable support for non-standard ports and proprietary protocols
• Starting and stopping of flow services
• Setting of address resolution levels
• Access to flow database and service status, providing instant views of database parameters and running flow services
• Backup and restoration of flow database
• Apply custom names to flow interfaces
• Notification of database status

Benefits:
 

How Flow Monitor Helps Ensure Network Performance

The WhatsUp Gold Flow Monitor Plug-in enables you to rapidly identify and resolve performance issues related to network bandwidth utilization. With Flow Monitor, you can:

• Display top talkers (by IP address), so you can determine exactly which hosts (authorized or unauthorized) are consuming critical bandwidth. For example, YouTube™ video streaming by multiple users may cause network congestion and slow down other critical business applications
• Track the number of failed interface connections, which can indicate external attacks on your network
• Verify network QoS policies required to support applications like VoIP using TOS reports
• Track and resolve network traffic or congestion problems using automatic classification of traffic by type and protocol in real-time
• Detect the use of unauthorized applications, enabling you to ensure your network’s security compliance and legal liability
• Track traffic anomalies to quickly detect the introduction of viruses and worms into the corporate network

FAQ:
 

What is flow?

A flow is a series of packets with a set of common characteristics sent between devices. As packets traverse a device, seven parameters are analyzed, if they all match exactly, then this sequence of packets is determined to be a flow. Flows are comprised of one of the IP protocols (usually TCP or UDP) depending on the end system being accessed.

What is flow management?

Flow management is the analysis of the different types of traffic traversing the network (as compared to simply looking at bandwidth utilization) to ensure the network is able to support key business applications. The practice of flow management began with the implementation of NetFlow, a technology developed by Cisco, which is part of the device IOS (internal operating system). In addition to the NetFlow format, other popular formats include J-Flow (developed by Juniper Networks), and sFlow (RFC 3176 standard). The vast majority of hardware manufacturers support one or more flow formats.

Why is flow management important?

The practice of flow management enables you to efficiently characterize the IP traffic on a network, which is critical to identifying the cause of link/network congestion, facilitating effective network capacity planning, and ensuring network resources are used to support organizational goals, including the support of key business applications.

What can flow management data be used for?

Flow data can be used for many applications such as:

• Traffic and bandwidth utilization analysis
• Application monitoring
• User monitoring
• Network performance monitoring
• Network capacity planning
• Security analysis
• Traffic engineering
• Peering agreement
• Usage-based billing
• Destination sensitive billing

How does it work?

Each flow enabled router or switch (source) collects and aggregates information about traffic passing through it, and when configured to do so, transmits the information to a flow enabled network management and monitoring system such as WhatsUp Gold.  WhatsUp Gold then converts the flow data into actionable reports (or something to that nature).

How does WhatsUp Gold support flow management?

Flow management support is provided through a Flow Monitor plug-in that fully integrates into the WhatsUp Gold web console. It supports multiple popular formats including NetFlow, J-Flow and sFlow.

What components are included?

The WhatsUp Gold Flow Monitor includes all the required components to enable flow data collection and reporting including; dedicated flow SQL database, flow collector, management and configuration interface and reporting.

What type of information does it provide?

WhatsUp Gold Flow Monitor provides comprehensive information to network managers allowing them to identify, view and report on the following types of data about their network and its usage.

• Protocol
• Application (port number)
• Conversations
• Sender host
• Receiver host
• Sender domain
• Receiver domain
• Sender top level domain (TLD)
• Receiver TLD
• Top sender country
• Top receiver country
• Type of service (ToS)

How is it licensed?

The WhatsUp Gold Flow Monitor is licensed by flow source. A flow source is a device that collects network traffic data and forwards flow compliant records to a designated collector. A source can have any number of configured interfaces.

Which manufacturers support flow management?

In addition to Cisco, a number of OEM manufacturers support NetFlow. Specific information for the manufacturers is provided below.

Cisco Device Support

The following IOS versions and hardware platforms fully support flow record export for NetFlow v1, v5 and v9.

Cisco IOS Software Release Version	Supported Cisco Hardware Platforms
11.1CA, 11.1CC	Cisco 7200 and 7500 series, RSP 7200 series
12.0	Cisco 1720, 2600, 3600, 4500, 4700, AS5800 RSP 7000 and 7200 series uBR 7200 and 7500 series RSM series
12.0T, 12.0S	Cisco 1720, 2600, 3600, 4500, 4700, AS5800 RSP 7000 and 7200 series uBR 7200 and 7500 series RSM series, MGX8800RPM series, and BPx8600 series
12.0(3)T, 12.0(3)S	Cisco 1720, 2600, 3600, 4500, 4700, AS5300, AS5800 RSP 7000 and 7200 series uBR 7200 and 7500 series RSM series, MGX8800RPM series, and BPx8650
12.0(4)T	Cisco 1400, 1600, 1720, 2500, 2600, 3600, 4500, 4700, AS5300, AS5800 RSP 7000 and 7200 series uBR 7200 and 7500 series RSM series, MGX8800RPM series, and BPx8650 series
12.0(4)XE	Cisco 7100 series
12.0(6)S	Cisco 12000 series

It should be noted that the following Cisco devices do not support NetFlow: Cisco 2900, 3500, 3660, 3750.

Other Vendor Support for Cisco’s NetFlow Format

• 3Com - 8800 Series Switches
• Adtran - NetVanta 3200, 3305, 4305, 5305, 1524, 1624, 3430, 3448, 3130, 340, and 344 (Supports NetFlow version 9)
• Riverbed
• Enterasys Networks
• Extreme Networks - Does not support input/output interface, octets, or first and last times
• Foundry Networks
• Packeteer
• VMware – ESX Server v3.5 based upon virtual switch

sFlow and J-Flow Device Support

WhatsUp Gold Flow Monitor device support includes the following manufacturers and devices:

3Com

• 4800G Family

AlaxalA Networks

• AX7800R
• AX7800S
• AX7700R
• AX5400S

Alcatel-Lucent

• OmniSwitch 6850
• OmniSwitch 9000 series

Allied Telesis

• SwitchBlade 7800R series
• SwitchBlade 7800S series
• SwitchBlade 5400S series

Brocade

• BigIron series
• FastIron series
• IronPoint series
• NetIron series
• SecureIron series
• ServerIron series

Comtec Systems

• Rex 16Gi
• 24Gi
• 24Gi-Combo

D-Link

• DGS-3600 series

Extreme Networks

• Alpine 3800 series
• BlackDiamond 6800 series
• BlackDiamond 8800 series
• BlackDiamond 10808
• BlackDiamond 12804C
• BlackDiamond 12800R Series
• Summit X150 Series
• Summit_X250e Series
• Summit X450 Series
• Summit i series

Force10 Networks

• C series
• E series

H3C

• H3C S7500E Series Switches
• H3C MSR 20-1X Series Routers

Hewlett-Packard

• ProCurve 2610 series
• ProCurve 2800 series
• ProCurve 2900 series
• ProCurve 3400cl series
• ProCurve 3500yl series
• ProCurve 4200vl series
• ProCurve 5300xl series
• ProCurve 5400zl series
• ProCurve 6200yl series
• ProCurve 6400cl series
• ProCurve 6600 series
• ProCurve 8212zl
• ProCurve 9300m series
• ProCurve Routing Switch 9408sl
• ProCurve Wireless Edge Services xl Module
• ProCurve Wireless Edge Services zl Module
• ProCurve Access Point 530

Hitachi

• GR4000
• GS4000
• GS3000

Juniper Networks

• EX series

NEC

• IP8800/R400 series
• IP8800/S400 series
• IP8800/S300 series

System Requirements :

WhatsUp Gold Flow Monitor 2.0 has the same base system requirements as WhatsUp Gold v12.4. In addition, WhatsUp Gold Flow Monitor requires:

• WhatsUp Gold v14 Premium Edition, Distributed Edition, Standard Edition or MSP Edition
• At least one networking device that support flow monitoring
• SQL Server 2005 Standard or Enterprise Edition (recommended)

Note: WhatsUp Gold Flow Monitor is more demanding on the database than WhatsUp Gold. While WhatsUp Gold Flow Monitor can successfully use SQL Server 2005 Express, we recommend either MS SQL Server 2005 Standard or Enterprise Edition for best performance.

• An additional 2 to 4 GB RAM recommended
• 16 GB (required) to 22 GB (recommended) hard disk space for the databases
• Note: If using Microsoft® SQL Server® 2005, the database size is limited by available hard disk space.