The LiveNX Flow technology module for the LiveNX software provides an innovative network topology view with end-to-end NetFlow, sFlow, and J-Flow visualizations of live traffic across the network. This enables you to quickly drill down to individual devices or interfaces for more detail on flow characteristics such as IP addresses, DSCP values, byte rates and count. In addition, the LiveNX Flow technology provides historical and real-time reporting, filtering, flexible support for different templates and many other features, which makes it easy identify trouble spots on the network and gain a better understanding of traffic patterns.
Supported Flow Technologies
The LiveNX Flow technology module supports the flow technologies from the following vendors:
- Cisco NetFlow (version 5 and version 9)
- Cisco AVC (Application Visibility and Control)
- Cisco Medianet Performance Monitor
- Cisco NSEL (NetFlow Secure Event Logging)
- Cisco PfR (Performance Routing)
- Cisco Sampled NetFlows
- Cisco AnyConnect
- Juniper J-Flow
- Hewlett-Packard sFlow
- Alcatel-Lucent sFlow
- 3Com sFlow
- Provide faster troubleshooting of the network.
- View flows across the network from source to destination.
- Pinpoint entry and exit of flows.
- Acquire a deeper understanding of flow paths.
- Observe the effects of routing and PBR settings, such as route updates and asymmetric rout
- Effortlessly enable the flow capabilities of your device without using the command line.
- A dashboard aggregation of the flows in your network.
- A system level view of the flows in your network that provides end-to-end graphical topology visualizations and tabular aggregations of flows across the system.
- A device level view of the flows from a specific device that provides a topology visualization and table representation.
- An interface view of input and output flows from a particular interface.
- Various reports that allow that provide forensic capabilities to find specific historical flows; playback, time series charts, aggregation charts, drill down to raw flows, etc.
- Filter traffic based on specific parameters such as DSCP, port, source address, and destination address for more focused viewing.
- A search field in the system view, flow dashboard and flow reports to provide user-defined filtered results for system and flow entities.
- Support most of the major flow technologies (NetFlow, sFlow, J-Flow, IPFIX) from a variety of vendors.
- View Cisco Medianet Performance Monitor, AVC, NSEL, PfR.
- Store all flow information for historical analysis and forensics.
- Provide the ability to start and stop flow data gathering on a per-device basis.
- Resolve addresses to hostnames.
- Allow data to be stored as CSV files and image captures
LiveNX Flow Visualizations
The LiveNX Flow technology module for the LiveNX software provides five different levels of visualizations of flow information. They are the Dashboard, System View, Device View, Interface View, and Reports. This section describes each of them in detail.
The system view provides the ability to visualize flows from each device on the system topology. LiveNX connects flows with the same 5 Tuple (Protocol, Source IP Address, Source Port, Destination IP Address, Destination Port, and DSCP) from different devices to represent the device flows as a single flow across the system network. This provides an end-to-end visualization of the traffic path. The controls of the system flow visualization are located on the tool bar of the Flow Tab.
- Dashboard (button): launches the flow dashboard which contains quick summary of flow related statistics. • Reports (button): launches the flow reporting window which provides top analysis, time series and aggregation reports of different types.
- Table (button): launches the System Flow Table window which contains an aggregation of the flows from each device.
- Refresh (button): refreshes the flows currently drawn on the system topology and in the system flow table. The following options dictate what flows that are retrieved from the LiveNX Server:
– Flow Technology Type Selector: this provides a mechanism to restrict the types of flows that are retrieved. All Flow Types will retrieve all types. Selecting any of the following will restrict the retrieval to just the
selected type: Application (AVC), Basic Flow, Medianet, NSEL, PfR and Unknown.
– Current Time Selector: provides a mechanism to retrieve historical flows or the current traffic flowing throw the system.
– Polling Interval Selector: provides a mechanism to specify the duration to query for the flows. For example, setting the selector to Last 30 Minutes will provide the top 200 flows for the last 30 minutes per device.
– Filter Selector: provides the ability to filter the flows retrieved during the refresh.
– Top/Bottom Flows Selector: provides the ability to set the number of flows per device to retrieve during the refresh process.
– Color Mapping Selector: provides the ability to color match the flows retrieved during the refresh by a certain algorithm.
- A Color Mapping legend is overlaid on the topology to indicate flow coloring and the number of bytes and flows that match each of the color mapping. The legend can be toggled on and off by opening the View menu and selecting Show Legends.
- Flows can be drawn on the system topology as merged or unmerged. This can be changed by going to the Flow menu and selecting Show Merged Flows.
- Mousing over a flow provides bit rate, total bytes, and source and destination information.
- Clicking on a flow, highlights each segment, so you can quickly trace the path of the flow across the network topology.
- Double clicking on a device in the system topology navigates to the device view for that device.
- Double clicking on a flow in the system topology opens the system flow table; highlighted rows in the table correspond to the flow of interest.