Flowmon Overview for MAMI Management and Measurement Summit

Customer references is an international vendor devoted to innovative network traffic & performance &

How was Flowmon Started? 2005 § First 10 GE Net. Flow monitoring Probe §

Flow Monitoring Principle Flow Export Start Duration Proto 9: 35: 24. 8 0. 1

Flow vs. Packet Analysis Strong aspects Weak aspects Flow data • • Works in

Flowmon Probes § Versatile and flexible network appliances § § § Monitoring ports convert

NPM Principles Client TCP handshake Syn Ack Client request Server response Req Probe Server

CLOUD APPs PERFORMANCE NPM metrics (RTT, SRT, Jitter) In time visualizations per application Get

Architecture Flow data export + L 7 monitoring Flow export from already deployed devices

Thank you Performance monitoring, visibility and security with a single solution Pavel Minarik pavel.

Slides: 10

Download presentation

Flowmon Overview for MAMI Management and Measurement Summit Pavel Minarik, Chief Technology Officer

Customer references is an international vendor devoted to innovative network traffic & performance & security monitoring 700+ customers 30+ countries First 100 G probes in the world Strong R&D background European origin

How was Flowmon Started? 2005 § First 10 GE Net. Flow monitoring Probe § § 2007 § Company started under INVEA-TECH name § 2010 University/CESNET spin-off § Network Behavior Analysis introduce § § 2015 NIC of own design using FPGA Non-sampled flow data on 10 Gbps speed Security & anomaly detection use-cases Doing business outside of Czech Republic § Strong focus on performance monitoring § Network/Application Performance

Flow Monitoring Principle Flow Export Start Duration Proto 9: 35: 24. 8 0. 1 0 TCP 9: 35: 25. 0 0 0. 9 0. 7 0. 5 0. 3 TCP Src IP: Port 192. 168. 1. 1: 10111 10. 10. 10: 80 Dst IP: Port Packets -> 10. 10. 10: 80 2 1 -> 192. 168. 1. 1: 10111 1 5 4 3 2 Bytes 80 40 … … 40 1231 862 362 …… 156

Flow vs. Packet Analysis Strong aspects Weak aspects Flow data • • Works in high-speed networks Resistant to encrypted traffic Visibility and reporting Network behavior analysis • No application layer data • Sometimes not enough details • Sampling (routers, switches) Packet analysis • • Full network traffic Enough details for troubleshooting Supports forensic analysis Signature based detection • Useless for encrypted traffic • Usually too much details • Very resource consuming § Solution? § § Take advantage of strong aspects in one solution Versatile and flexible Probes for visibility into all network layers – Flowmon long-term strategy

Flowmon Probes § Versatile and flexible network appliances § § § Monitoring ports convert packets to flows Un-sampled export in Net. Flow v 5/v 9 or IPFIX Wire-speed, L 2 -L 7 visibility, PCAPs when needed L 2 • • • MAC VLAN MPLS GRE tunnel OTV L 3/L 4 • Standard items • NPM metrics • RTT, SRT, … • TTL, SYN size, … • Vx. LAN • ASN (BGP) • Geolocation L 7 • • • NBAR 2 HTTP SNI DNS DHCP • • SMB/CIFS Vo. IP (SIP) Email SQL

NPM Principles Client TCP handshake Syn Ack Client request Server response Req Probe Server Syn, Ack RTT Ack Data SRT Round Trip Time – delay introduced by network Server Response Time – delay introduced by server/application Delay (min, max, avg, deviation) – delays between packets Jitter (min, max, avg, deviation) – variance of delays between packets Data Delay Data

CLOUD APPs PERFORMANCE NPM metrics (RTT, SRT, Jitter) In time visualizations per application Get quick insight, understand deviations Time axis on the right side of traffic chart Selection of current view/application

Architecture Flow data export + L 7 monitoring Flow export from already deployed devices Flow data collection, reporting, analysis Flowmon modules for advanced flow data analysis

Thank you Performance monitoring, visibility and security with a single solution Pavel Minarik pavel. minarik@flowmon. com Flowmon Networks a. s. Sochorova 3232/34 616 00 Brno, Czech Republic www. flowmon. com