NetFlow was developed by Cisco, and has been the most widely used standard for data statistics, in addition to monitoring and recording all traffic that passes to or from an interface. It is, analyze flow data, which it collects to provide visibility into traffic volume.
Secondly, it also monitors where this traffic is coming from and where it is going, and how much flow is being generated. This information is recorded and can be used to monitor usage., detect anomalies or perform any type of network management task.
- How NetFlow works?
It is composed of:
- IP Flow: group of packages with a specific set of attributes for each package. They are found inside switches or routers that contain information such as the source and destination IP, the ports, class of service, etc.
- Hidden from NetFlow: information base derived from data generated after monitoring and grouping IP packets.
- Compiler: flows are bundled and exported with the User Datagram Protocol.
Advantages of using NetFlow:
- Monitoring of network and incoming and outgoing traffic.
- Capacity planning to assess future bandwidth requirements.
- Security analysis to detect changes in network behavior and put a solution.
- Troubleshooting such as network slowdowns, bandwidth hogging and traffic spikes.
- Validation of QoS parameters in order to guarantee an appropriate allocation of resources.
At Loops we decided to implement it in order to examine network traffic flows in a MacroLAN and be able to carry out analyzes either Online or Offline..
Our main objectives were:
- Obtain information on the traffic that passes between 2-3 headquarters
- Get a traffic x-ray of 1 team at those locations
- Carry out a sizing of the necessary bandwidth for one of these locations
All these points have been achieved thanks to a series of implemented techniques which have allowed us to monitor the traffic flows and their corresponding destinations of one or several specific clients.. The main purpose is based on having an exhaustive control of the actions, avoid a possible "breakdown" of traffic and subsequently prepare reports that include all this series of data.
