Netflow...How To Use? :)

cboberwin

Let me preface that I haven't used Netflow before. I understand the basics of what it does but not how to utilize the information it provides.Right now, I was asked to analyze network traffic between 4 load balanced servers. Not knowing what devices it's attached to, I'm wondering how I can use Netflow to do this.

Thanks in advance!

nnettrouer

I would start with setting up a Netpath route.  That will help give you some insight into how the traffic flows through.  This should also give you some insight to what IP's to start looking at to get more information from.  If your not familiar with Netpath, below i have a quick example of one of mine. 

Netpath:

You just need to have a starting and ending point.  Starting point can be a desktop or server that you can leave on, and the end point is what is on the other side of the load balances (ie: website). 

This one is fun because it goes over to Australia.  You can see a couple of load balancers in the path.  The darker & heavier the line, the more likely the path.  In the first split, 55% of the traffic takes the top

path, 44% takes the bottom path.  On the second split 67% takes the bottom while 33% takes the top.  For this, i have a starting point (one of my servers) and and end point (a website). 

One of the things i use this a lot for is to see which ports are being used for the traffic on our switches and routers.  This way i can see exactly which path its taking.