Flow Publisher’s unique ability to capture and process raw traffic information from non-flow enabled devices or host systems, combined with the powerful analysis capabilities of Flow Monitor deliver the following features:
Flow Publisher Basics
- Simple, software only solution that can be deployed on any current Windows operating system
- Capture of raw traffic flows from any of the following:
- Port mirroring (SPAN or RAP)
- Network Test Access Points (TAP)
- Directly on Windows server platforms
- Creates NetFlow v1, v5 or v9 compliant records from raw traffic
- Maps device MAC addresses to reported interfaces
- Provides options to log flows and commands
- ACL’s for access to administration and configuration
- Flow Publisher Management Console:
- Configuration and management of single or multiple agents
- Interface(s) from which to capture network traffic
- Mode and status for each interface in the probe (promiscuous or normal)
- Collector IP address to forward NetFlow records
- NetFlow version of flow data to send to a collector
- Local IP and port of the probe to forward flow records
- Active and Inactive timeout for flow record management
- SNMP index for the default input/output reported interface MAC Addresses to Interface indices mapping
Traffic Analysis and Monitoring / Troubleshooting Capabilities (in conjunction with Flow Monitor)
- Automatic classification of traffic by type and protocol in real-time
- Real-time identification of traffic flow patterns through the network
- Identification of traffic sources (top talkers) and destinations
- Identification of traffic destination by group, domain, top level domain (TLD), and country
- Pinpointing of internal and external traffic sources and destinations
- Conducting traffic identification and analysis for Quality of Service using ToS or DSCP
- Grouping of flow data based on common parameters, including IP addresses by domain, TLD or country
- Automatic identification of high traffic flows to un-monitored ports and highlighting of those ports as candidates for monitoring
- Uncovers unauthorized applications, including file and music sharing
- Detection of failed connections
Reporting (in conjunction with Flow Monitor)
- Access to over 40 flow management reports via WhatsUp Gold web and mobile access
- Automated rollup of flow data with hourly, daily, weekly, monthly and yearly views
- Displays flow information in custom formats
- Sorts and displays filtered reports by protocol, application, host, domain, TLD, country, groups or type of service
- Integration of flow reports with WhatsUp Gold workspace reports
- Access to WHOIS information for sender and receiver reports
- Display traffic information by bytes, packets or flows
Configuration and Management (in conjunction with Flow Monitor)
- Configuration of thresholds on multiple flow metrics via the Alert Center
- Configuration and management of flow data retention policies
- Configuration of flow logging levels
- Configurable support for non-standard ports and proprietary protocols
- Starting and stopping of flow services
- Setting of address resolution levels
- Access to flow database and service status, providing instant views of database parameters and running flow services
- Backup and restoration of flow database
- Apply custom names to flow interfaces
- Notification of database status
Flow Publisher = Complete Network Visibility
WhatsUp Gold’s new Flow Publisher extends flow monitoring visibility and analytics to non-flow supporting devices and Windows host systems.
Direct Benefits of Flow Publisher
- Extends standardized network traffic analysis and application flow visibility across the entire network
- Supports any switch, router or network device with Port Mirroring (SPAN/RAP ); network Test Access Point (TAP); or direct installation on Windows servers (standard or virtualized)
- Converts raw traffic into standardized NetFlow v1, v5 or v9 compliant records
- Cost-effective installation and low overhead operation
- As a small footprint, software-only solution it uses minimal CPU and memory resources
- Installs on any Windows based operating system and hardware
- Simple and flexible deployment model
- Agents can be located anywhere in the network enabling both broad and pinpoint traffic analysis
- Flow Publisher’s deployment doesn't require infrastructure upgrades or downtime
- Better insight and higher investment returns compared to legacy flow monitoring technologies
- More information, improved manageability and lower costs compared to RMON or packet analysis solutions
- With 100% raw traffic capture and processing it provides deeper visibility and insight compared to sampled sFlow and J-Flow
- Seamless integration with Flow Monitor and WhatsUp Gold
- Access to over 40+ configurable Flow Monitor web and mobile reports
- Configuration of thresholds and alerting on typical flow monitoring parameters via the Alert Center
What is a Flow?
A flow is a series of packets with a set of common characteristics sent between devices. As packets traverse a device, seven parameters are analyzed, if they all match exactly, then this sequence of packets is determined to be a flow. Flows are comprised of one of the IP protocols (usually TCP or UDP) depending on the end system being accessed. For more general information on flows and flow management, refer to our Flow Monitor Frequently Asked Questions.
What does Flow Publisher do?
Flow Publisher collects raw traffic information from the network devices that are not natively flow-enabled and converts them into NetFlow v1, v5 or v9 compliant records. Flow Publisher then forwards the NetFlow records to the WhatsUp Gold Flow Monitor collector for both real time and historical reporting and alerting.
Does Flow Publisher have any prerequisites?
Flow Publisher requires both the Flow Monitor plug-in and the WhatsUp Gold core product to provide network traffic analysis, reporting and threshold monitoring and alerting. Depending on how Flow Publisher is deployed, a Windows PC and available network interfaces may also be required.
How is Flow Publisher different from Flow Monitor?
Flow Monitor collects, processes and reports on application traffic flows from devices in the network that natively support one or more industry standard formats. Supported flow formats in Flow Monitor include NetFlow v1, v5 and v9 (developed by Cisco); J-Flow (developed by Juniper Networks); and sFlow (RFC 3176 standard). The vast majority of hardware manufacturers support one of the flow formats.
Flow Publisher complements Flow Monitor capabilities by extending application traffic monitoring to devices and Windows servers that do not have any native flow capability. Together Flow Monitor and Flow Publisher provide deep and homogeneous insight into application and user traffic and behavior analysis across all devices and segments in the network.
How will Flow Publisher data help me manage the network?
The combined solution of Flow Publisher, Flow Monitor, and WhatsUp Gold analyze, report, and send alerts based on the performance of specific flow parameters for all network devices and host systems – whether they are flow enabled or not. Thresholds used for alerting are configured through the Alert Center capability in WhatsUp Gold. Flow information helps uncover which users, applications, or source/destination pairs are consuming your network bandwidth.
What components are included with Flow Publisher?
The WhatsUp Gold Flow Publisher includes two primary components – the Flow Publisher Agent and the Flow Publisher Configuration and Agent Management Console.
The Flow Publisher agent is comprised of a number of sub-components – to process raw network traffic from non-flow capable devices into NetFlow compliant records, and to forward them to the WhatsUp Gold Flow Monitor collector. The agent is installed on a Windows based computer and can be configured to support up to 4 interfaces. It can also be deployed directly on a server to track top talkers (users) and application traffic volumes.
The Flow Publisher configuration and management interface is a Windows based program that is used to dynamically configure a single or multiple probes either locally or remotely. The configuration and management interface needs the following information to be set:
- Interface(s) from which to capture network traffic
- Mode and status for each interface in the probe (promiscuous or normal)
- Flow Monitor collector IP address to forward NetFlow records
- NetFlow version of flow data to send to a collector
- Local IP and port of the probe to forward flow records
- Active and inactive timeout for flow record management
- SNMP index for the default input/output reported interface
- MAC Addresses to interface indices mapping
- A configurable Access Control List for administration
What flow data does Flow Publisher provide?
WhatsUp Gold Flow Publisher provides the same information into Flow Monitor for analysis and reporting as other NetFlow sources. This includes the following:
- Protocol
- Application (port number)
- Conversations
- Sender host
- Receiver host
- Sender domain
- Receiver domain
- Sender top level domain (TLD)
- Receiver TLD
- Top sender country
- Top receiver country
- Type of service (ToS)
How is Flow Publisher licensed?
The WhatsUp Gold Flow Publisher is licensed for each separate instance of software product installation on a Windows Server.
What kind of devices can be monitored by Flow Publisher?
Flow Publisher can capture traffic information from any router, switch, or any other network device that supports port mirroring (e.g. Cisco SPAN ports or 3Com RAP ports). It can also receive traffic information from Network TAPs (Test Access Points). Flow Publisher can also be installed on a Windows server and monitor application and user traffic originating or being received by the server.
Can I use Flow Publisher with my existing flow-enabled devices?
Flow Publisher works with your existing flow-enabled devices as well. In fact, popular formats like sFlow only provide sampled flow data that may fail to accurately capture and diagnose intermittent network issues arising from unauthorized application usage or even malicious virus activity. Using Flow Publisher, you would get complete traffic capture and analysis that can help you rapidly track down and resolve intermittent network issues as they happen.
Flow Publisher software requirements
Flow Publisher hardware requirements
The following are the hardware requirements for the Flow Publisher:
|
Recommended |
Required |
| Processor(s) |
Dual-core |
Single-core |
| Processor speed |
2 GHz or more |
2 GHz |
| RAM |
1 GB |
< 100 KB |
| Network interface cards (NIC) |
1 Gbps (1+n) NICs, where n is the number of Flow Publisher capture devices. |
100 Mbps Minimum of 1 NIC when capturing local traffic on a server. Minimum of 2 NICs when capturing traffic copied from a network device. |
| Video display resolution |
800 x 600 or higher |
800 x 600 |
Traffic Analysis How-To webinar series
Are you continually asked why your network and applications are slow? Is it a constant struggle for you to monitor the bandwidth utilization and keep unauthorized traffic out to ensure the performance of business critical applications? Armed with the knowledge you’ll gain from the Traffic Analysis How-To webinar series, you can ensure that you’ll maintain control over your network’s performance at all times.
Recorded webinar series
Traffic Analysis for Non-Flow Enabled Networks (Part 1)
Recorded Tuesday January 12th, 2010
- Understand single or multi-segment traffic patterns
- Pinpoint origins of slow network performance in real-time
Traffic Analysis for Non-Flow Enabled Networks (Part 2)
Recorded Tuesday January 19th, 2010
- Increase defense against internal and external threats
- Provide cost effective traffic analysis without upgrades or downtime
Traffic Analysis Techniques for Flow and Non-Flow Networks
Recorded Tuesday January 26th, 2010
- Optimize the power of flow-based traffic analysis in networks
- Create valuable strategies to ensure future network stability and security
Traffic Analysis on Windows Servers
Recorded Thursday December 10th, 2009
- Access and view granular data on user and application traffic to and from servers
- Understand and troubleshoot issues for both non-virtualized and virtualized systems and applications
WUGspace