OLD - what we're working on

In addition to top-talkers monitoring, I use (or want to use) Netflow for security monitoring and forensic traffic analysis. Firewall and IDS logs generally only give you information about trigger packets, or the initial packet in a session. Netflow makes it easy to take an IDS alert or a firewall log entry and get more useful information about the bigger picture--or at least it should. One of my frustrations with NTA is that it lacks an easy to use interface to quickly get information about arbitrary small-volume flows.

do something with WaaS to really annoy Fluke....

One of my frustrations with NTA is that it lacks an easy to use interface to quickly get information about arbitrary small-volume flows.

I'd like to understand this better.   Would the ability to search for a specific conversation (source/endpoint) solve this use-case?

basuically, be able to do the clever stuff NTA already does, but inside optimised traffic streams...  don;'t know a lot about it, but i knwo one of my customers is signing up to a massive expenditure to implement the Fluke offering...

if u understand it, you have a network link, you place 2 cisco network optimisers at either end, but you still want to look at the traffic in terms oif top talkers etc, inside that optimised stream, where NAT woudl probably currently see it as a specific application and not be able to look inside it...

Item #4 would be very useful for us.

Our first database performance priority is Network alarms - Netflow data collection which impacts upon the database performance has always hindered our deployment. We would be more than happy to drop some of the low level detail to increase our Netflow collection (and improve application Network visibility).

Typically for us the Netflow data is of most use when trying to identify high bandwidth usage (withon QOS classes) - so this possible enhancement would suit us.

Dave.

Thanks for the feedback Dave.  This feature is actually already available in NTA 3.5 SP1, but just not publicly exposed.   We're doing some customer testing right now to ensure it has the expected results.  If you're amenable to trying this out, please send me a private message. 

Yes, I'd like to be able to search by source and destination IP address and source/destination port number at minimum, and be able to pair them. Right now I can only search for one end of the conversation; I need to be able to put all four items together in combination with AND/OR logic. The ability to track TCP flags and search on flag combinations would be great too--all that info is in NetFlow version 5.

item #2 is very important for us, any ETA on the release

We can't give exact timelines for release.   However, if you're an existing customer, I can give you a preview of this functionality.   If you're interested, send me a PM with your SWID and your availability for next week.

How about number 5??????????

5) Find a way to cache database updates so netflow does not beat a SQL DB like a rented mule.....