Flow Quick Start Guide - SevOne NMS 5.7

Flexible NetFlow (FNF) - Cisco IOS Router

Traditional NetFlow (TNF) - Cisco IOS Router

1. First, we need to enable Cisco Express Forwarding (CEF), which is required for flow in most recent IOS releases. In global configuration mode, enter the following command to enable CEF.

   ip cef

   Global configuration mode is indicated by the host name followed by (config)#. For example, if your router is named Router-2, the command prompt in global configuration mode would be Router-2(config)#.

2. Next, enter the following commands to start the NetFlow Data Export (NDE).
   

   1. Specify your SevOne NMS appliance as the destination (that is, the flow collector) for your router and specify a port. Replace <SevOne-IP> with the IP address of your SevOne NMS appliance.
      

      ip flow-export destination <SevOne-IP> 9996

      SevOne NMS collects flow data on port 9996 by default. To confirm the specified port, look at the FlowFalcon settings. From the navigation bar click Administration > Cluster Manager > Cluster Settings. Then click the FlowFalcon subtab and look at the Incoming Port field.

   2. Specify the interface that NetFlow will derive the source IP address from.
      

      ip flow-export source loopback 0

   3. Specify the export version format. In the following command, replace <version-number> with the appropriate version (for example, 5 or 9).
      

      ip flow-export version <version-number>

3. By specifying parameters for the NetFlow accounting flow cache, you can prevent flows from staying in the cache longer than necessary. Perform the following actions to configure the timeout for active and inactive flows.
   

   Note that the active timeout is specified in minutes, while the inactive timeout is specified in seconds.

   1. Specify the number of minutes to leave active flows in the cache. Breaking flows into shorter segments prevents sending too many flows to your collector (the SevOne NMS appliance). The following command allows active flows to stay in the cache for 1 minute. In other words, it breaks the flows into one-minute segments.
      

      ip flow-cache timeout active 1

   2. Specify the number of seconds to leave inactive flows in the cache. This will cause finished flows to be expired and removed from the cache. The following command allows inactive flows to stay in the cache for 15 seconds.
      

      ip flow-cache timeout inactive 15

4. Now you'll need to enable NetFlow on each physical interface that you'd like to collect a flow from. This is normally an Ethernet or WAN interface. You may need to set the speed of the interface in kilobits per second, especially for frame relay or ATM virtual circuits.

   You don't need to do this for VLANs or tunnels, because they're automatically included.

   1. Specify the interface with the following command. Replace <interface> with the name of the physical interface (for example, Ethernet0/0) that you'd like to enable NetFlow on.
      

      interface <interface>

   2. Enter one of the following commands to enable the physical interface specified above.

      • To enable flows on individual sub-interfaces rather than all of the sub-interfaces.

        ip flow ingress

      • To enable flows on the physical interface along with all the sub-interfaces associated with it.
        

        ip route-cache flow

5. You'll need to save your configuration changes. To do so, enter the following command.
   

   copy run start

6. Let's verify that the router is generating flow statistics. First, you'll need to switch to enable mode. Then enter the following commands to view current NetFlow configuration and state.

   Enable mode, also known as privileged mode, is indicated by the host name followed by #. For example, if your router is named Router-2, the command prompt in enable mode would be Router-2#.

   1. Enter the following command to display the status and statistics of the data export.
      

      show ip flow export

   2. Enter the following commands to display summaries of the active flows and the amount of NetFlow data exported from the router.
      To display a summary of the data export statistics:
      

      show ip cache flow

      To display a detailed summary of the data export statistics:
      

      show ip cache verbose flow

7. Enable the the ifIndex SNMP setting. This tells the router to remember ifIndexes so that they don't change during device configuration or reboot.
   

   snmp-server ifIndex persist

   This is an important step and is required by SevOne NMS.

Cisco Switches Running CatOS (Hybrid Mode) - Non-4000 Series Catalyst Switches

Switches Running IOS (Native Mode)

First, make sure that you're in privileged/enable mode. Enter the following global commands (all commands are entered in the router <enable> config option).

1. Specify the interface that NetFlow will derive the source IP address from.
   

   ip flow-export source <interface>

2. Specify the export version format.
   

   ip flow-export version 9

3. Specify your SevOne NMS appliance as the destination (that is, the flow collector) for your switch and specify a port. Replace <SevOne-IP> with the IP address of your SevOne NMS appliance.
   

   ip flow-export destination <SevOne-IP> 9996

4. Enable NDE from the PFC and configure the NDE version.
   

   mls nde sender version 9

5. Perform the following actions to specify how long active and inactive flows stay in the cache.

   1. Specify the number of seconds to leave active flows in the cache. The following command allows active flows to stay in the cache for one minute. In other words, it breaks the flows into one-minute segments.
      

      set mls agingtime long 60

   2. Specify the number of seconds to leave inactive flows in the cache. The following command allows active flows to stay in the cache for fifteen seconds.
      

      set mls agingtime 15

6. If you have a Supervisor Engine 2 or 720 with IOS version 12.1.13(E) or higher, you'll need to enter the following two commands to put interface and routing information into the NetFlow exports.
   

   mls flow ip interface-full

   mls nde interface

7. Enter the following commands for each physical interface. Replace <interface> with the name of the interface.
   

   interface <interface>

   ip route-cache flow

4000 Series Catalyst Switches Running in Hybrid or Native Mode

1. In the configuration terminal on the router, enter the following commands to start NetFlow export. Replace <SevOne-IP> with the IP address of your SevOne NMS appliance.
   

   ip flow-export version 9

   ip flow-export destination <SevOne-IP> 9996

2. Enter the following commands to enable NetFlow on each physical interface. Replace <interface> with the name of the interface.
   

   interface <interface>

   ip route-cache flow infer-fields

Configure sFlow Features from the CLI

1. Specify the IP address of the collector. Replace <SevOne-IP> with the IP address of your SevOne NMS appliance.

   [edit protocols sflow]
   

   user@switch# set collector <SevOne-IP>

2. Specify the UDP port for the collector. The default UDP port on the SevOne NMS appliance is 6343.

   [edit protocols sflow]
   

   user@switch# set collector udp-port 6343

3. Enable sFlow technology on a specific interface. Replace <interface-name> with the name of an interface (for example, ge-0/0/3) that you'd like to enable sFlow on.

   [edit protocols sflow]
   

   user@switch# set interfaces <interface-name>

   You can't enable sFlow technology on a Layer 3 VLAN-tagged interface. You can't enable sFlow on a LAG interface either, but it can be enabled on the member interfaces of the LAG.

4. Specify how frequently the sFlow agent polls the interface. Replace <seconds> with the number of seconds. If you don't want to poll the interface, specify 0 here.
   

   You have the option of configuring this setting (polling interval) and the next setting (sample rate) at the interface level. If you prefer to do so, jump ahead two steps.

   [edit protocols sflow]
   

   user@switch# set polling-interval <seconds>

5. Specify the rate at which you want to sample packets. Replace <number> with your desired sample rate. For example, if you specify 6 here, one out of every six packets will be sampled.

   [edit protocols sflow]
   

   user@switch# set sample-rate <number>

6. This step is optional. If you prefer, you can set the polling interval and sample rate at the interface level. To do this, use the following command, replacing <interface-name> with the name of the interface, <seconds> with the polling interval in seconds, and <number> with the sample rate number.
   [edit protocols sflow intefaces]
   

   user@switch# set interfaces <interface-name> polling-interval <seconds>

   The interface-level configuration overrides the global configuration for the interface.

Specify Cflowd Options on an IP Interface

The following is the CLI syntax for configuring cflowd on an interface.

Depending on the option you select, either acl or interface, cflowd extracts traffic flow samples from an IP filter or an interface for analysis. All packets forwarded by the interface are analyzed according to the cflowd configuration.

Select the acl option to enable traffic sampling on an IP filter. You'll need to enable cflowd (filter-sample) in at least one IP filter entry.

Select the interface option to enable traffic sampling on an interface. If cflowd isn't enabled (no cflowd), then traffic sampling won't occur on the interface.

Enable Cflowd on Service Interfaces

The following is the CLI Syntax for enabling cflowd on service interfaces.

Configure Cflowd for Collectors

The following is the CLI syntax for configuring cflowd.

The following is an example of a basic cflowd configuration .

About Cluster-level Flow Settings

In this section, we'll look at the Cluster Manager > Cluster Settings tab > FlowFalcon subtab, where you define how to collect and process raw flow data and aggregated flow data.

Drop Long Flows Option

The settings below include a Drop Long Flows option, which enables you to define a time limit for what you consider to be a long flow. When you use the Drop Long Flows option, SevOne NMS hides traffic from routers that send flows exceeding the specified Max Flow Duration. When flows exceed the Max Flow Duration, an administrative message appears at logon informing administrators that flows from a specific router have been dropped. The Drop Long Flows feature is useful when you set the router cache timeout to be shorter than the Max Flow Duration, because long flows would indicate that a router is misconfigured.

Write Interval Option

You'll also see a Write Interval option, which lets you adjust the interval at which SevOne NMS writes flow data to the database. The Write Interval sets the time window for aggregating raw data into the minimal aggregation. This should be set to 1 minute. In the rare case that you decide to change this setting, keep in mind that every hour SevOne NMS takes flow data and creates 15 minute aggregations for the top <n> flows for each interface and view. This means that you'll want your Write Interval setting to be evenly divisible by 15 when you plan to use aggregated flow data.

Configure Cluster-level Flow Settings

Perform the following steps to configure cluster-level flow settings.

1. On the right side of the page, select the Cluster Settings tab.

   

2. On the Cluster Settings tab, click the FlowFalcon subtab.

   

3. * Select the Store Raw Flow check box to collect and store raw flow data. Most FlowFalcon views use raw data. This provides more specificity in the result set but with the trade-off of longer report execution times and less historical data.

4. * Select the Store Aggregated Flow check box to collect and store the most relevant flow data in an aggregated format. FlowFalcon views use this format for faster report execution times.

5. * In the Raw Flow Duration field, enter the number of days to keep raw flow data. Keep in mind that gigabytes of flow data can accumulate quickly.

6. * In the Raw Flow Data Size field, enter the maximum amount of disk space to allocate for raw flow data.

7. * In the Write Interval field, enter the number of seconds to collect flow data before creating a flat file and writing the data to the disk. We recommend 60 seconds. A longer write interval results in fewer–but larger–flat files for raw data and smaller tables for aggregated data. See the example below.

8. Select the Drop Long Flows check box. Then, in the Max Flow Duration field, enter the maximum number of seconds to consider flow data "long".
   

   This drops flows when their duration exceeds the write interval. Long flows are usually due to improper router configuration. This setting triggers an administrative message that appears upon logon to inform you to review the router configuration. Suggested Max Flow Duration is ~2x the Write Interval (from the previous step).

9. Select the Enable MPLS Attribute Mapping check box. Then, in the MPLS Attribute Mapping Refresh Interval field, enter the number of seconds indicating how frequently to read the map files and to refresh the mapping. This enables you to map v9 NetFlow template data from core "P" routers for reports that use the following fields in FlowFalcon views listed below.

   This step is necessary for mapping MPLS flow files, which we'll discuss in the MPLS Flow Mapping section.

10. * In the Aggregation TopN field, enter the number of results (50-1000) to store for each aggregation per write interval. The default value is 100. The value you specify represents the maximum number of individual results that an aggregated FlowFalcon view can display. Keep in mind that this consumes disk space.

    Warning: Setting a value greater than the default may result in data loss.

11. In the Hide Inactive field, enter the number of days to display data for an inactive device or interface. The default is 14 days. Once the specified amount of time has passed, the device or interface is considered inactive and its information is hidden. An inactive device or interface is one that doesn't send data to SevOne NMS.
    

12. In the Purge Inactive field, enter the number of days to store data for an inactive device or interface. Enter 0 (zero) to never purge data.
    

13. In the Incoming Port field, enter the port number for SevOne NMS to use to listen for flow traffic. The default port is 9996.

14. Click the Raw Data Compression drop-down and select a method for compressing raw data files. Greater compression requires less storage but results in higher CPU usage.
    

15. Select the Display Flow Sample Rates check box to display the sampled flow rate on FlowFalcon reports that contain split interfaces and to display an additional column on the Flow Interface Manager for sampled data. FlowFalcon reports with sampled data display a message. Interfaces that aren't sampled use a sample rate of 1X.
    

16. Select the Create Egress Records When Not Available check box to automatically create egress records for ingress interfaces that aren't receiving egress records.

17. Select the Create Ingress Records When Not Available check box to automatically create ingress records for egress interfaces that aren't receiving ingress records.

18. Select the NAT Support check box to enable support for routers behind network address translation (NAT).

19. Click Save.

Configure Peer-level Flow Settings

The Peer Settings FlowFalcon subtab enables you to define the retention of aggregated flow data on the peer for use in FlowFalcon reports. The following diagram provides an explanation of Aggregated Flow Data Retention.

Perform the following steps to configure peer-level flow settings.

1. In the hierarchy on the left side of the Cluster Manager, select a peer.
   
   

2. Click the Peer Settings tab. The FlowFalcon subtab is selected by default.
   
   

3. In the Write Interval field, enter the number of days to store <write interval> aggregated flow data for calculations. You define the write interval on the Cluster Manager > Cluster Settings > FlowFalcon subtab, which we discussed above.
   

4. In the Fifteen Minutes field, enter the number of days’ worth of fifteen minute aggregation data to store for calculations.
   

5. In the One Hour field, enter the number of days’ worth of one hour aggregation data to store for calculations.
   

6. In the One Day field, enter the number of days’ worth of one day aggregation data to store for calculations.

7. Click Save.

Add or Edit Flow Rules

Perform the following steps to add (or edit) flow rules.

1. From the navigation bar, click Administration and select Flow Configuration, then Flow Rules.

   

2. Click Add Rule to display the Add New Flow Rule pop-up. If you'd like to edit an existing rule, select the rule and click under Actions.

   

3. Click the Peer drop-down and select the peer that you want the device to send flow data to.

4. Click the Device drop-down and select the device whose flows you want to define a rule for. If you select Specify..., an IP Address field will appear. Enter the IP address here.

5. Click the Interface drop-down and select the interface that you want to apply the rule to. If you select Specify..., an Interface Number field will appear. Enter the interface number here.

6. Click the Direction drop-down and select one of the following:

   • New - to apply the rule to any applicable new flow, incoming or outgoing.

   • Incoming - to apply the rule to data that comes into the device. Older versions of NetFlow are ingress only, meaning they can report on data coming in to the interface but not on data going out from the interface.
     

   • Outgoing - to apply the rule to data that goes out from the interface. For older versions of NetFlow, SevOne NMS uses data from other flows to create an estimation of outgoing flows.

7. For Permission select one of the following options:

   • Allow - to process the flow data across the interface.

   • Deny - to not process the flow data across the interface.

8. Click Save.

Manage Flow Rules

Perform the following steps to manage existing flow rules.

1. Select the check box for the flow rule that you want to manage. You can select more than one at a time.

2. Click and select one of the following options.

   • Allow Selected Flows - to process the flow data across the interface.

   • Deny Selected Flows - to not process the flow data across the interface.

   • Delete Selected Rules - to delete the rules you select.

Manage FlowFalcon Views

Perform the following steps to create (or edit) a FlowFalcon view.

1. From the navigation bar, click Administration and select Flow Configuration , then FlowFalcon View Editor .
   

2. The FlowFalcon Views tab is selected by default.

3. On the left side of the page, click Add. A view named New View will appear in the list. The properties for your new view appear on the right side of the page, under View Properties.
   

4. Under View Properties, in the View Name field, provide a name for the view.

5. Click the Category drop-down and select a category. To select a category that's not in the list, select New Category.

6. In the Category Name field, perform one of the following actions:

   • If you selected New Category in the previous step, provide a name for the new category.

   • If you selected an existing category in the previous step, there's no need to provide input here. However, if you do provide a different name here, it will appear as an additional category in the Category drop-down selection.

7. For Default Sort, select one of the following options:

   • Descending - to sort results in descending order (high to low).
     

   • Ascending - to sort data in ascending order (low to high).

8. Select the Aggregated Data check box to create a view based on aggregated flow data. To create a view using raw flow data, leave the check box clear. There is a limit to the number of aggregated views your appliance can support.

   For an existing FlowFalcon view, if you previously selected the Aggregated Data check box and later clear it, you will lose all aggregated data for the view.

9. Select the Enabled check box to enable the use of the view in FlowFalcon reports.

10. The Flow Fields section allows you to specify which fields to include in the view. Perform the following actions to configure the Flow Fields settings.

    1. Click the Device Filter drop-down and select a device to display flow fields from.

    2. Click the Template Filter drop-down and select one of the templates for the device that you selected.

    3. Click the Keys and Metrics drop-down and select one of the following options:

       • Keys and Metrics - to display both keys and metrics.

       • Keys - to display only keys.

       • Metrics - to display only metrics.

    4. The Available Fields column provides a list of fields that you can include in your view. Click on fields to select them. Once you've made your selection, click to move the fields to the Fields In View column.

    5. The fields display in the report in the same order that they're listed in the Fields In View column. Also, the report sorts on the first metric type listed in the field. To change the order, click on the fields and use the green up/down arrow buttons to move them to the desired location.

11. Click one of the following:

    • Save As New - to save a new view. If you're editing an existing view, you can make a copy of the view by clicking Save As New. This is useful if you previously configured the view to use aggregated data but are now changing from aggregated data to raw data. When you save the view as new in this case, you can keep the aggregated data from the original view.

    • Save - this option appears if you're editing an existing (previously saved) view. Clicking Save will overwrite the view with any changes that you make. This can result in losing any aggregated data if you're working with an aggregated view.

    • Reset - to reset the settings to what they were before you started editing the view.

    • Delete - to delete the view along with any associated aggregated data.

Devices & Templates Tab

Click on the Devices & Templates tab to view template information for the devices that you enable to send flow data. On the left side of the page, the Flow Devices section lists all of the flow-enabled devices along with their IP addresses. The Source Templates tab and the Option Templates tab appear on the right side of the page. We'll be taking a closer look at both of these tabs in the steps that follow.

Source Templates Tab

Perform the following steps to view source templates and source template fields for devices.

1. On the left side of the page, under Flow Devices, select the device that you would like to see template information for.

2. Under Templates: Source & Options, the Source Templates tab is selected by default.

3. Under Source Templates from the selected flow device, you'll see a list of the available source templates for the device. The following information is available for each source template:

   • ID - displays the field identifier sent from the device with the flow template.

   • Source Port - displays the port on the device that the flow template was sent from.

   • Version - displays the flow version.

   • Last Seen - displays the last time the template was received from the device.

4. Select one of the source templates to view the fields for it.
   

5. To the right, under Source Template Fields, are all of the available fields for use in FlowFalcon views for FlowFalcon reports. The following information is available:

   • Flags:

     • - indicates that the flow field is a key.

     • - indicates that the flow field is a metric.

     • - indicates that you can edit the field.

     • - indicates that you can't edit the field.

   • Enterprise (ID) - displays the identification of the enterprise (typically the manufacturer) that creates the field identifier.

   • Field ID - displays the flow template field identifier.

   • Field - displays the field name.

   • Order - displays the sequence location of the field within the flow template.

   • Length - displays the size of the field in bytes.

Edit Template Fields

Perform the following steps to edit template fields.

1. Select a field and click under Actions to display a pop-up where you can edit the field settings.

2. Under Name and Type, in the Name field, edit the field name.

3. Select one of the following:

   1. Select Key to define the field as a key.

      Example

      

      • Click the Field Type drop-down. Select the appropriate field type from the drop-down. The drop-down options depend on the key length.

        Key Length	Field Types
        1	Direction, Protocol, String, Number
        2	Port, Interface, String, Number
        4	AS Path, IP, MPLS Tag, String, Number
        6	MAC, String
        8	String, Number
        16	IP Hybrid, IPv6, String
        32	String
        128	AS Path, String If field is a variable-length field, then String is the only option available. And, there is no drop-down available for this scenario.
        256	String

      • Select one of the following if field type String or Number is chosen.

        • Select Without Lookup to not use a lookup table for the field.

        • Select Lookup Table to use a lookup table for the field. If you select this option perform the following steps.

          1. Click the Lookup Table drop-down.

             • Select the lookup table for the field to use.

             • Select New Lookup Table and enter the lookup table name in the Name field to define a new lookup table.

          2. Click Add Code or click

             

             to add or edit a code in the lookup table.

          3. In the Code field, enter the lookup table code.

          4. In the Value field, enter the code value.

          5. Click Update to save the code.

          6. Repeat to add additional codes to the lookup table.

      If an editable field has a length of 1, 2, 4, or 8, it can also be configured as a Metric.

   2. Select Metric to define the field as a metric.

      Example

      

      • Click Measured as drop-down to choose how to measure the metrics.

      • Click Display as drop-down to choose how to display the metrics.

      • Click the Default Aggregation drop-down and select the aggregation to use by default.

4. Click Save.

Options Templates Tab

Devices sometimes send metadata via NetFlow using a feature known as "Options Templates". On the Options Templates tab, you can view options templates and options template fields. You can can also create synthetic key fields by combining existing options template fields. Once you create a synthetic key field, it will appear in the Source Template Fields, which we looked at earlier (see Source Templates Tab). This means that the new synthetic key field will be available for use in FlowFalcon views and FlowFalcon reports.

Perform the following steps to view options templates for devices and to create a synthetic key field.

1. On the left side of the page, under Flow Devices, select the device that you would like to see template information for.

2. Select the Options Templates tab.

   

3. Under Options Templates from the selected flow device, select an options template to view the fields for it under Options Template Fields.

   All fields have to be configured before you continue. For any fields that display Not Configured, see the steps in the Edit Template Fields section above.

4. Again under Options Templates from the selected flow device, select an options template that you want to create a synthetic key field for. Under Actions, click to display the Synthetic Key Field Editor pop-up.

   

   About Synthetic Key Fields

   A Synthetic Key Field is used to create an association between a field in the source template and the metadata supplied by the Options Template. Without this association, there would be no way to see the metadata in FlowFalcon reports. In the image below, we see a source template for our device. Within the source template, there's a field called Ingress Interface. Looking at the Options Template image above, we also see a field called Ingress Interface. Because the field exists in both the source and options template, we can use it as a reference point to link the metadata from the Options Template to the tuple containing the Ingress Interface field.

5. Perform the following actions to configure the synthetic key field.

   1. In the Display Name field, enter a name to display in FlowFalcon Reports.

   2. Click the Delimiter drop-down and select a delimiter to display between the fields that you plan to add here.

   3. In the Resolve Key field, you're going to specify the key field to resolve on. On the right side, under Available Fields, select a field and drag it to the Resolve Key field.

      The field you select here has to exist in the source template. It also has to be a string field type.

   4. In the Expression field, you'll combine the available fields into a single synthetic field, which will display in reports. On the right side, under Available Fields, select fields to add to the expression and drag them to the Expression field.

      The Expression field accepts fields that have generic storage type or string storage ty pe. You can see the storage type for each of the available fields under Storage Type.

   5. Select the Enabled check box to make the field available for inclusion in FlowFalcon views and FlowFalcon reports.

   6. Click Save.

   

6. Once you've created your Synthetic Key Field, you can now add it to a View and then see it in reports:

   

MPLS Flow Mapping

The MPLS Flow Mapping page lets you upload your network's MPLS flow map files. These files map MPLS attributes to flow data so that MPLS data can appear in FlowFalcon reports. You'll need to understand MPLS well enough to know which MPLS attributes correspond to your network's VPN 2nd Top Layer ID, PE Egress Address, Customer VRF, Source IP Address, and PE Ingress Address. Use any application to create two .csv files that map MPLS attributes to flow data. Then use this page to upload the map files into SevOne NMS. The .csv files must be encoded in UTF-8.

SevOne NMS requires the following three actions to map MPLS attributes to flow data for FlowFalcon reports:

• On the Cluster Manager > Cluster Settings tab > FlowFalcon subtab, select the Enable MPLS Attribute Mapping check box and enter the MPLS Attribute Mapping Refresh Interval. (We discussed these settings in the Configure Cluster-level Flow Settings section.)

• On the MPLS Flow Mapping page, upload two MPLS mapping files. The steps for this are below.

• On the FlowFalcon View Editor, create FlowFalcon views that include at least one of the following fields. (We discussed creating FlowFalcon Views in the Manage FlowFalcon Views section.)

  • 45050: Customer Client IP

  • 45051: Customer Client Subnet

  • 45052: Customer VRF Name

  • 45053: Customer Application IP

  • 45054: Customer Application Subnet

  • 45055: PE Ingress IP

  • 45056: PE Egress IP

Upload Map Files to DNC

The map files must be uploaded to a single SevOne Dedicated NetFlow Collector (DNC) that uses the file. Because each DNC may be responsible for different mappings, it is necessary to upload a mapping file to each DNC that performs mapping. In order to direct the mapping file to a DNC, first navigate to the IP of the DNC, then upload the file.

Upload Map Files in SevOne NMS

Perform the following steps to upload the two files that map MPLS attributes. The first map file maps the VPN 2nd Top Label ID, PE Egress Address, and Customer VRF. The second one maps the Customer VRF, Source IP Address, and PE Ingress Address.

1. From the navigation bar, click Administration and select FlowConfiguration, then MPLS Flow Mapping.

   

2. In the Mapping 1 section, click to display the file upload pop-up.

3. Navigate the file structure to locate and select the file that maps the VPN 2nd Top Label ID, PE Egress Address, and Customer VRF.

4. Click Open on the pop-up to save the file locally.

5. Click Upload to move the file to the correct location and to complete the upload of the first map file.

6. Click Download Mapping 1 File to display the content of the first map file in a .csv format.

7. In the Mapping 2 section, click to display the file upload pop-up.

8. Navigate the file structure to locate and select the file that maps the Customer VRF, Source IP Address, and PE Ingress Address.

9. Click Upload to move the file to the correct location and to complete the upload of the first map file.

10. Click Download Mapping 2 File to display the content of the second map file in a .csv format.

Add Object Mapping

Perform the following steps to add (or edit) an object mapping.

1. From the navigation bar, click Administration and select Flow Configuration, then Object Mapping.

2. Click Add Object Mapping to display the Add Object Mapping pop-up.

   To edit an existing object mapping, select it and click to display the Edit Object Mapping pop-up. Continue with the steps below.

   

3. In the SevOne Device section, perform the following actions:

   1. Click the Device drop-down and sele ct the device that contains the indicator that you want to map to a flow interface .
      

   2. Click the Object drop-down and select the object that contains the indicator that you want to map to a flow interface .

   3. Click the Indicator drop-down and select the indicator that you want to map to a flow interface .

4. In the Flow Device section, perform the following actions:

   1. Click the Device drop-down and select the flow device that contains the interface that sends flow data to SevOne NMS.

   2. Click the Interface drop-down and select the flow interface to map the indicator to .

   3. Click the Direction drop-down and select the direction of the interface mapping.

5. Under FlowFalcon View, click the View drop-down and select the view for the FlowFalcon Reports page to display for the indicator's interface data.

6. To add a filter that limits the results from the object mapping, select the Filter check box and perform the following actions:
   
   

   1. To create a new filter, select New Filter.
      

      To use an existing filter, click the Filter drop-down and select the filter.

   2. In the Filter Name field, enter the filter name.

   3. Under Filter Rules, click Add Filter Rule to add a new filter rule. Continue with the actions below to provide input for the fields that appear.
      

   4. Click the Field drop-down and select the field to apply the rule to. The fields that appear first are from the view that you selected under FlowFalcon View. After that, all known fields from flow data appear.

   5. Click the Boolean drop-down and select one of the following options:

      • Is - to define the rule with an Is Boolean operator.

      • Is Not - to define the rule with an Is Not Boolean operator.

   6. Click the Operator drop-down and select a comparison operator.
      

      Depending on the field you selected for Field, the Operator options may include Mask and Subnet (in addition to Equal To, Greater Than, Less Than, and Between). Select Mask to report on flow data that needs to match in the manner of IP address subnet masking. Select Subnet to report on flow data that needs to be from the subnet you select from the Network Segment drop-down. The Network Segment drop-down becomes available when you select Subnet as the operator. For information about defining network segments, please see the section Network Segment Manager.

   7. In the First Value field, enter the first value to filter data data on.

   8. In the Second Value field, enter the second value in a value range if applicable (for example, when you select Between as an Operator).

   9. Click Update to save the rule.

7. Click Save to save the object mapping.

Add a Protocol

Perform the following steps to create a new flow protocol or edit an existing one.

1. From the navigation bar, click Administration and select Flow Configuration, then Protocols and Services.

   

2. On the Protocols tab, click Add Protocol to display the Add Protocol pop-up. To edit an existing protocol, select the protocol and click to display the Edit Protocol pop-up.

   

3. In the Number field, enter a unique number for the protocol.

4. In the Protocol Name field, enter the protocol name.

5. In the Description field, enter a description of the protocol.

6. Click Save.

Add a Service

Perform the following steps to add a new flow service or edit an existing one.

1. Select the Services tab.

   

2. Click Add Service to display the Add Service pop-up. To edit an existing service, select the service and click to display the Edit Service pop-up.

   

3. In the Source field, enter the IP address of the service coupled with the subnet. To poll for the service from any device, enter 0.0.0.0/0. To poll a specific device for the service, enter an IP address and a subnet.

4. In the Port field, enter the port number that the service uses.

5. Click the Protocol drop-down and select the protocol that the service uses.

6. In the Service Name field, enter the name of the service as it should appear in reports.

7. In the Description field, enter a description of the service.

8. Click Save.

Sources

1. From the navigation bar, click Reports and select Create Report.

   

2. Under Sources, select FlowFalcon.

3. Continue to the next subsection, Resources.

Resources

1. Click the Type drop-down and select one of the following options.

   • Interface - to graph flow data from the interfaces you allow on the Flow Interface Manager. After selecting this option, perform the following actions.

     

     1. Click the Device drop-down and select a device that flow data originates from. Select All Devices to graph flow data from all devices.

     2. Click the Interface drop-down and select the interface that flow data originates from. Select All Interfaces to graph flow data from all interfaces on the device you select in the previous step.

     3. Click the Direction drop-down and select whether to graph flow data that is Incoming, Outgoing, or for All Directions. Some flow sources provide only incoming data.

   • Device Group - to graph flow data for a device group or device type. Click the Device Group drop-down and specify the device type(s) and/or device group(s).

     

   • Object Group - to graph flow data for an object group. Click the Object Group drop-down and specify the object group(s).

     

2. Click Next and continue to the next subsection, Time.

Time

Perform the following steps to configure time settings for the report attachment.

1. Click the Time Span drop-down and select one of the following options. The first three options below are customizable.

   • Specific - to display fields to enable you to define a specific time span.

   • Relative - to display a text field where you can enter a relative time span, such as past 4 hours, last week, this month, today, etc.

   • Week - to display a pop-up where you can designate a specific week in the year by number (for example, week 23), to change when the year begins. You can also specify which day and month should be considered the first (for example, Monday as the first day of the week instead of Sunday).

   • Past <X> Hours, Days, Weeks, Months - to display data from <X> hours, days, weeks, or months ago until now.

   • Today - to display data from 12:00am today until now.

   • Yesterday - to display data from 12:00am yesterday until 12:00am today.

   • This Week, Month, Quarter - to display data from 12:00am on the first day of the week, month, or quarter until now.

   • Last Week, Month, Quarter - to display data from 12:00am on the first day of the last completed week, month, or quarter to 11:59pm on the last day of the last completed week, month, or quarter.
     

2. Click the Time Zone drop-down and select a time zone.

3. Click Next and continue to the next subsection, Settings.

Settings

Perform the following steps to define attachment settings.

Settings Tab

1. On the Settings tab, select the Aggregated Data check box to populate the View drop-down list with FlowFalcon views that use aggregated flow data (faster and less specific). Leave it clear to populate the View list with views that use raw flow data (slower and more specific).

   When you create a TopN flow report (e.g., Top Talkers) based on aggregated data, the report will not be entirely precise. You can increase the value for the Aggregation TopN setting (go to Cluster Manager > Cluster Settings tab > FlowFalcon subtab) for greater precision. However, any value greater than 100 will increase the system load, which may eventually lead to data loss.

2. Click the View drop-down and select a view.

3. Click the Network Segment drop-down and select a network segment. This enables you to resolve IP addresses into segments and to roll up results from the same segment into a single result.

4. If you select the Graph Other check box, SevOne NMS will display the flow for the top <n> results individually in the Pie Visualization and the Stacked Line visualization. It will also display a Remaining Traffic graph item that groups the flow for the remaining flow sources that meet the filter criteria. You'll define the <n> results in the next step.

   If you leave the check box clear, SevOne NMS will display only the top <n> results in the Pie visualization and the Stacked Line visualization. Remaining Traffic will still display in the Table visualization.

5. In the Result Limit field, enter the number of individual results to display in the report attachment. Filters enable you to narrow the scope of the request (see the Filters subsection below). You can also modify the Current Resources list (on the Resources page) to limit the number of resources.

6. Click the Preferred Units drop-down and select either Bits for network-oriented data or Bytes for server-oriented data.

FlowFalcon Tab

1. Select the FlowFalcon tab.
   
   

2. Click the Split drop-down and select one of the following options.

   • Groups - to separate flow data by device group/device type or object group, depending on the resource you select. This option only appears when you select Device Group or Object Group on the Resources page.

   • Interfaces - to separate flow data into individual interfaces.

   • Nothing - to combine all results from the same direction across the same interface in order to allow for greater detail in the result set.

3. Select the Display as Rate check box to display the results as bits or bytes per second. Leave it clear to display the total number of either bits or bytes.

4. Click the Granularity drop-down and select the interval between data points in the results. Select either a predefined interval or Auto. Auto uses the highest applicable granularity for the best display and fastest load time based on the time span you select on the Time page.

   SevOne NMS is optimized to receive flows every one minute. If you configure the router to send flows at a different interval, this setting enables you to view the report at the granularity that matches the router flow timeout setting. Again, we recommend against using anything other than one minute for the router flow cache timeout.

FlowFalcon Resolution Tab

1. Select the FlowFalcon Resolution tab.
   

2. Click the Display DNS drop-down and select one of the following options.
   

   • Display IP - to display raw IP addresses.

   • Display DNS - to display resolved domain names when possible.

   • Display Both - to display IP addresses and resolved domain names.

3. Click the Display Protocol drop-down and select one of the following:
   

   • Display Number - to display raw protocol numbers.

   • Display Name - to display resolved protocol names.

   • Display Both - to display both numbers and resolved names.
     

4. Click the Display Port drop-down and select one of the following options.

   • Display Number - to display raw port numbers.

   • Display Name - to display resolved port names.

   • Display Both - to display both numbers and resolved names.
     

5. Click the Display DSCP drop-down and select one of the following options.

   • Display Number - to display DSCP port numbers.

   • Display Name - to display DSCP port names.

   • Display Both - to display both numbers and resolved names.
     

6. Click the Display AS drop-down and select one of the following options.

   • Display Number - to display AS port numbers.

   • Display AS - to display AS port names.

   • Display Both - to display both numbers and resolved names.

7. Click Next and continue to the next subsection, Filters.

Filters

The Filters wizard page lets you limit the results that appear in the attachment. Each filter contains one or more rules. Each filter rule applies to a specific flow field. A filter rule for a field not in the view is ignored. This enables you to define filters independently from views.

When you apply filters to an attachment that uses an aggregated view, the Remaining Traffic and Total Traffic numbers may appear inaccurate due to how the data is aggregated and stored in pre-calculated buckets. If you don't receive the expected number of results after you apply a filter to an aggregated view, increase the number of aggregated results to store for each write interval on the Cluster Manager.

Perform the following steps to configure filters.

1. Under Filters Selection, click the drop-down on the left and select the field that you want to define the filter on. Fields that are in the view you select appear first, followed by every other known field from flow data.

2. Click the second drop-down and select a comparison operator.
   

   The Operator options include Mask and Subnet (as well as Not Mask and Not Subnet ). Selecting Mask means that flow data has to match in the manner of IP address subnet mask. Selecting Subnet means that flow data has to be from the network segment that you specify in the drop-down to the right (the drop-down will appear when you select Subnet). For information about defining network segments, please see the section Network Segment Manager.

3. In the Enter Value field, enter the value to base the filter on.

4. Click Add Filter to display the rule in the Current Filters list.

5. Click Next and continue to the next subsection, Visualizations.

Visualizations

The Visualizations page lets you define how you want to display your data. Perform the following steps to configure visualization settings.

Pie

1. Click to expand the section.
   
   

2. Select the Display Logo check box to display a logo in the attachment.

3. The Display Minimum check box is selected by default. This indicates that the minimum data point will display in the legend.
   

Stacked Line

1. Click to expand the section.
   
   

2. Select the Display Logo check box to display a logo in the attachment.

3. Select the Display Legend check box to display a legend in the attachment.

4. The Display Minimum check box becomes available when you select the check box for Display Legend (previous step). Select this check box to display the minimum data point in the legend.

5. Select the Display Time Span check box to display the time span in the attachment.

6. Select the CSV When Mailed check box to email the attachment in a .csv format to the recipients you define on the Report Properties Delivery tab . Leave it clear to email the table as a .pdf in the format that displays in the report.

Table

1. Click to expand the section.
   
   

2. Next to Columns, under Available, select fields to display in the report attachment.

3. Click to move the fields to Using.
   

   The column with the red number one ( 1 ) is the primary sort column. Data from this column displays in the Pie visualization and the Stacked Line visualization.

4. Select the User Friendly Times check box to use human-readable dates when you extract the report attachment data to .csv format. Leave it clear to use a UNIX time stamp in the .csv file. The UNIX time stamp allows for greater manipulation of the data.

5. Select the Abbreviate Numbers check box to abbreviate large numbers. If you leave the check box clear, the Precision field will appear, where you can enter the number of decimals to round the report results to.

6. Select the CSV When Mailed check box to email the report attachment as a .csv file to the recipients you specify on th e Report Properties Delivery ta b . Selecting this check box enables you to select the check box for PDF/CSV When Mailed. Select this check box to include the attachment as a .pdf file and convert it to a .csv file when it is emailed.

7. Select the Wrap Cells check box to wrap long text in a data row so that all text displays. Leave clear to display as much text as fits into the cell.

8. Click Next and continue to the next subsection, Summary.

Summary

The Summary page lets you view a summary of the report attachment definition. To make changes to any of the items in the Summary, click on the item. This will take you to the appropriate Report Attachment Wizard page, where you can change settings.

Report Results

If you don't need to make further changes to the Report Attachment Wizard settings, click Finish to display the report.

Resources

1. Click the Resource Type drop-down and select one of the following options:

   • Interfaces - to graph flow data from the interfaces you allow on the Flow Interface Manager. After selecting this option, perform the following actions.

     

     1. Click the Device drop-down and select a device that flow data originates from. Select All Devices to graph flow data from all devices.

     2. Click the Interface drop-down and select the interface that flow data originates from. Select All Interfaces to graph flow data from all interfaces on the device you select in the previous step.

     3. Click the Direction drop-down and select whether to graph flow data that is Incoming, Outgoing, or for All Directions. Some flow sources provide only incoming data.

     
     

   • Device Groups - to graph flow data for a device group or device type. Click the Device Group drop-down and specify the device type(s) and/or device group(s).

     

     
     

   • Object Groups - to graph flow data for an object group. Click the Object Group drop-down and specify the object group(s).

     

2. Click Add Resource to add the specified resources to the Current Resources list.

3. Continue to the next subsection, Report Settings.

Report Settings

1. Click the Aggregated Data drop-down and select one of the following options.

   • Yes - to populate the View drop-down list with views that use aggregated flow data, which stores the most relevant flow data for faster report creation.

   • No - to populate the View drop-down list with views that use raw flow data to allow for more specificity in the result set. This option results in longer report execution times and less historical data availability.

2. Click the View drop-down and select a view. The selection of views is based on your input for the previous step.

   Clicking on the View link will take you to the FlowFalcon View Editor. For information on creating/editing views using the FlowFalcon View Editor, see the section Manage FlowFalcon Views.

3. Click the Time Span drop-down and select one of the following options. The first three options below are customizable.

   • Past <X> Hours, Days, Weeks - to display data from <X> hours, days, or weeks ago until now.

   • Today - to display data from 12:00am today until now.

   • Yesterday - to display data from 12:00am yesterday until 12:00am today.

   • This Week, Month, Quarter - to display data from 12:00am on the first day of the week, month, or quarter until now.

   • Last Week, Month, Quarter - to display data from 12:00am on the first day of the last completed week, month, or quarter to 11:59pm on the last day of the last completed week, month, or quarter.

   • Custom - to display the Specify a Range pop-up, where you can define a custom time span.

4. Click the Time Zone drop-down and select a time zone.

5. Click the Split drop-down and select one of the following options.

   • Groups - to separate flow data by device group/device type or object group, depending on the resource you select. This option only appears when you select Device Groups or Object Groups in the Resources section.

   • Interfaces - to separate flow data into individual interfaces.

   • Nothing - to combine all results from the same direction across the same interface in order to allow for greater detail in the result set.

6. Click the Network Segment drop-down and select a network segment. The subnets for the segment you select are listed below it. This enables you to resolve IP addresses into segments and to roll up results from the same segment into a single result.

   Clicking on the Network Segment link will take you to the Network Segment Manager. For information on managing network segments and subnets, see the Network Segment Manager section.

7. Click the Graph Other drop-down and select one of the following options.

   • Yes - to display the flow for the top <n> results individually in the pie chart and the stacked line graph. This also displays a Remaining Traffic graph item that groups the flow for the remaining flow sources that meet the filter criteria. You'll define the <n> results in the next step.

   • No - to display only the top <n> results in the in the pie chart and the stacked line graph. Remaining Traffic will still display in the table.

8. In the Results Limit field, enter the number of individual results to display in the table. The display includes the first 200 results to optimize browser performance. Export the report to a .csv format or to a .pdf format to view the full result set of more than 200 results. Filters enable you to narrow the scope of the request . You can also modify the Current Resources list (in the Resources section above) to limit the number of resources.

Advanced Report Settings

1. Click Advanced Report Settings to expand the section.

   

2. In the Data Columns field, select the check box for each data column to include in the report table. You'll need to select the check box for at least one data column. See the Table Columns section for a description of all columns.
   

3. Click the Sort Column drop-down and select the data column on which to sort the table in the FlowFalcon report. This drop-down list displays the data columns you select in the previous step. The data column you select in this step determines the data to display in the pie chart and the stacked line graph in the FlowFalcon report.

4. Click the Sort Order drop-down and select to sort data in either Ascending or Descending order.

Resolution Settings

1. Click Resolution Settings to expand the section.

   

2. Click the DNS drop-down and select one of the following options.
   

   • Display IP - to display raw IP addresses.

   • Display DNS - to display resolved domain names when possible.

   • Display Both - to display IP addresses and resolved domain names.

3. Click the Protocols drop-down and select one of the following:
   

   • Display Number - to display raw protocol numbers.

   • Display Name - to display resolved protocol names.

   • Display Both - to display both numbers and resolved names.
     

4. Click the Ports drop-down and select one of the following options.

   • Display Number - to display raw port numbers.

   • Display Name - to display resolved port names.

   • Display Both - to display both numbers and resolved names.
     

5. Click the DSCP drop-down and select one of the following options.

   • Display Number - to display DSCP port numbers.

   • Display Name - to display DSCP port names.

   • Display Both - to display both numbers and resolved names.
     

6. Click the AS drop-down and select one of the following options.

   • Display Number - to display AS port numbers.

   • Display AS - to display AS port names.

   • Display Both - to display both numbers and resolved names.

Display Settings

1. Click Display Settings to expand the section.

   

2. Click the Granularity drop-down and select one of the following options to specify the interval between data points in the results:

   SevOne NMS is optimized to receive flows every one minute. If you configure the router to send flows at a different interval, this setting enables you to view the report at the granularity that matches the router flow timeout setting. Again, we recommend against using anything other than one minute for the router flow cache timeout.

   • Auto - to use the highest applicable granularity for the best display and fastest load time based on the time span you select in the Report Settings section.

   • A predefined interval - to select one of the predefined intervals, such as 1 minute, 5 minutes, 10 minutes, etc.

   • Custom - to specify a custom granularity. There's no limit as to what you enter here. However, if the granularity is too small for the time span, SevOne NMS will adjust the granularity.

3. Click the Preferred Units drop-down and select either Bits for network-oriented data or Bytes for server-oriented data.

4. Click the Display as Rates drop-down and select one of the following options:

   • Yes - to display the results as bits or bytes per second.

   • No - to display the total number of bits or bytes.

Filters

1. Click the Filter drop-down and select a filter to copy. To create a new filter, select New Filter.

2. Just below that, click Add Rule to Filter to display the Add a new rule to the filter pop-up. Perform the following actions to configure the rule.

   

   1. Click the Field drop-down and select the field to apply the rule to. The fields from the view you select (under Report Settings) appear first in the list, followed by every known field from the flow data.

   2. Click the Boolean drop-down and select Is to define the rule with an Is Boolean operator or select Is Not to define the rule with an Is Not Boolean operator.

   3. Click the Operator drop-down and select a comparison operator.
      

      Depending on the field you selected for Field, the Operator options may include Mask and Subnet (in addition to Equal To, Greater Than, Less Than, and Between). Select Mask to report on flow data that needs to match in the manner of IP address subnet masking. Select Subnet to report on flow data that needs to be from the subnet you select from the Network Segment drop-down. The Network Segment drop-down becomes available when you select Subnet as the operator. For information about defining network segments, please see the section Network Segment Manager.

   4. In the Value field, enter the value to filter data data on.

   5. In the AND field, enter the second value in a value range if applicable.

   6. If applicable, click the Subnet drop-down and select a subnet.

   7. Click Save to save the rule.

3. Perform one of the following actions:

   • Click Save to save changes to an existing filter.

   • Click Save Filter as New to save a new filter. A pop-up will prompt you to name the new filter. After providing a filter name, click Save on the pop-up.

The FlowFalcon Report - Getting Results

Once you have configured settings for each setting of the FlowFalcon Reports page, click Get Results to view the FlowFalcon report.

Flow Direction Explanation

Depending on the view that you select, you may see and in the report table. These appear if the selected view provides flow direction. The source port and the destination port are evaluated. The low port (non-zero) is considered the Application and the high port is considered the Client. The IP addresses follow the port numbers.

Detach FlowFalcon Reports

When you create a report, the FlowFalcon Reports title bar at the top of the page displays four icons. By clicking on any of these icons, you can export a FlowFalcon report.

The following are options for exporting a FlowFalcon report.

• - exports all granular data points in the graph to a .csv format.

• - exports the data summary data from the table to a .csv format.

• - exports the report to a .pdf format.

• - adds the FlowFalcon report as an attachment in a report on a new browser tab. You can modify reports to add other attachments and you can save reports to the Report Manager.

Navigate FlowFalcon Reports

Perform the actions below in any order to specify the data that you want the FlowFalcon report to display.

View

Click the View drop-down under the Get Results button. The following categories of views appear when applicable.

• Drill Down - includes views that contain the exact same fields in the same sequence as the view you used to create the report as well as additional fields. This enables you to drill down to display additional information in the subsequent report.

• Fan Out - includes views that share at least one field with the view you used to create the report. This enables you to fan out to display related information in the subsequent report.

Refresh Rate

Click the Refresh Rate drop-down and select a refresh rate to update the report data at the frequency you select. We recommend that you don't set the refresh rate to less than the write interval. The default write interval writes flow data to the disk every 60 seconds. The Cluster Manager > Cluster Settings tab enables you to adjust the write interval (see the Configure Cluster-level Flow Settings section).

Graph Updated View

Click Graph Updated View to create a new FlowFalcon report with the drill down or fan out view and the same settings you previously defined in the FlowFalcon Reports page sections.

Graph Selected Rows

Perform the following steps to use all of the settings from above to create a new graph for the data in the rows you select in the report table.

1. In the FlowFalcon report table, click and select Select None to clear the check boxes for all rows in the table.

2. Select the check box for one or more rows in the table.

3. Click Graph Selected Rows.

Display a Line Graph for an Item

To display a line graph item for a specific item in a table, click on the item. For example, from our screenshot above, we'll click on the first row, right under Bandwidth. In the screenshot below, we can see a graph specifically for the item we just clicked on.

Remaining Traffic and Total Traffic

At the bottom of the the FlowFalcon report table, you'll see the rows for Remaining Traffic and Total Traffic.

• The Remaining Traffic row displays the total of all interfaces that aren't part of the top <n> results (where <n> is the number you enter in the Results Limit field in the Report Settings section). If there are fewer results than the number you enter in the Report Settings section, the Remaining Traffic row won't appear.

• The Total Traffic row displays the total of all interfaces in the report, regardless of whether the sources appear listed individually.

The Graph Other setting in the Report Settings section enables you to include the remaining traffic in the pie chart and stacked line graph. Click the Graph Other drop-down and select Yes to display a grey slice in the pie graph and a grey line in the stacked line chart to represent remaining traffic.

Working with v5 NetFlow

FlowFalcon reports depict the total rate of flows for each device/interface/direction after duplicating flows that lack directional information. NetFlow v5 only exports information about the incoming interface, so SevOne NMS duplicates the flow statistics for v5 NetFlow to enable you to run reports for outgoing flows on devices that use v5 NetFlow. If your network only uses v5 NetFlow, the FlowFalcon report flow rate should be double the actual rate of flows that arrive at the collector. Cluster Manager > Cluster Settings enable you to simulate missing egress and missing ingress flows for other flow technologies. The flow rate in FlowFalcon reports is different from the flow rate that displays on the Flow Interface Manager that uses a different calculation for flow data.

Table Columns

When you select Nothing for the Split field (in the Report Settings section), some column definitions change. The following table provides a rundown of those changes.

Benefits

Some of the benefits of flow alerting include:

• You can configure alerting policies on flow data using any of the Aggregated View templates.

• You can be alerted proactively based on information gleaned from flow data.

• It doesn't require RTAGx or any additional object licenses.

Required Information

Application port(s) that network backup systems use.

For our example, we let's say that our application port is 2222.

Alerting Strategy

1. Create a FlowFalcon filter using the legacy FlowFalcon interface that identifies the information you're interested in.

2. Create a flow alerting policy for all interfaces/directions.

   1. Define your general settings.

      • Select device or object group containing your flow interfaces.

      • Select Aggregated View that contains application port information, such as Top Applications or Top Applications with Protocol.

      • Select the FlowFalcon filter you created earlier (for example, Backup Traffic).

      • Select Direction = Any (this will create thresholds for both Ingress and Egress traffic on the interface).

      • Configure Schedule to only include Business Hours, Monday - Friday.

   2. Define your alert conditions.

      • Raise an alert when average Network Backup application port traffic is greater than 1 MB for a duration of 1 minute.

      • Clear an alert when average Network Backup application port traffic is less than 1 MB for a duration of 5 minutes.

Step-By-Step Instructions

1. Create a FlowFalcon filter using the legacy FlowFalcon interface that identifies the information you're interested in (Applications -> FlowFalcon Reports -> Filters section).

2. Create a flow alerting policy for all interfaces/directions, as described above.

   1. Define your general settings.

      

   2. Configure Schedule to only include the hours of 9 to 5 (09:00 to 17:00), Monday - Friday.

      

3. Define your alert conditions.

   1. Raise an alert when average network backup application port traffic is greater than 1 MB for a duration of 1 minute.

      

   2. Clear an alert when average Network Backup application port traffic is less than 1 MB for a duration of 5 minutes.

      

   3. Click Save As New to save your policy.

4. Go to Events -> Alerts and check to see if you have an alert.

   

5. When you click on the object, it will bring provide the context of FlowFalcon interface to show you the data that caused your alert to trigger.

Step-By-Step Instructions

1. Run an aggregated view report using the view Top Talkers (Bandwidth, Packets, Flows) to identify hosts of interest. Then select one of the hosts.

2. Run a non-aggregated view report using the view Top Conversations with Application and ToS and Direction. Use the following settings:

1. 1. Aggregated Data = No

   2. View = Top Conversations with Application and ToS and Direction

   3. Time Span = Custom. Then configure the time span to show you the last 15 minutes.
      

   4. Create a filter with the Application IP configured to your host IP from the Top Hosts report that you ran in step 1.
      

   5. Click Get Results to run the report.
      

2. The screenshot below shows the resulting report. It contains conversations that occurred with our host. This report displays the top 10, but we can configure the system to display all results in the table.