It probably depends on the network. Colleges and universities, for example, will likely be one of the areas where iCloud traffic will show up the most in network traffic monitoring practices. Although I’m not familiar yet with the transport layer port(s) that this technology will use, I’m sure we will be monitoring iCloud traffic with NetFlow or IPFIX by running reports on top domains. With our NetFlow traffic analyzer we can set global thresholds on individual iCloud data streams and trigger events for hosts transmitting excessive traffic to iCloud.com. We can then throttle iCloud traffic.

With iPhone market share currently at 25% and growing, other vendors like Blackberry could follow suit with their own ‘Blackcloud’ service. Who knows, but should this become a trend, iCloud network traffic volumes may become a serious concern. What can be done?

Beyond monitoring iCloud traffic, many hardware implementations export URL information with IPFIX, which may give us deeper insight into the nature of iCloud data. Even if connections use HTTPS, our NetFlow and IPFIX reporting tool will likely provide detail on the volume of iTouch Vs. iPhone traffic and allow administrators to disseminate deeper NetFlow details, such as MAC addresses and user names.

~ Jon Mills
Follow Me on Twitter

Luckily for the rest of us, the NetFlow data that gets exported from the nBox is a little bit different. In addition to what NetFlow normally provides in network traffic details, nBox exports include email addresses, HTTP URLs, Latency, VoIP Jitter and more. There is one caveat; at this time, Scrutinizer NetFlow & sFlow Analyzer is the only NetFlow reporting tool that can properly display these extra data fields. So you will want to make sure to look into Plixer’s product offering to take advantage of these advanced features.

Michael Patterson of Plixer International and Luca Deri of nTop.org have devised an excellent whitepaper describing, in detail, the methods behind determining network latency using NetFlow from your nBox.

So, whether your slowness issues are caused by Application Latency, Client Delay or Server Delay, the combination of Scrutinizer and nBox can be a valuable suite for network administrators that need the extra visibility into application and network performance. In addition, these details can also be quite helpful when monitoring cloud services. Just ask any marketing or sales rep how frustrating it can be when their connection to Salesforce.com is crawling right along. Why waste hours troubleshooting a network issue that isn’t an issue with the network? Conversely, why should an application be blamed when it’s clearly database transactions are being poorly routed?

Let us know if you’ve had success with using nBox data to pinpoint slowdowns. We’d love to hear your stories!

~ Jon Mills
Follow Me On Twitter

nProbe creator, Luca Deri, says in a recent blog post, “nProbe 6.3.x has been successfully tested against all the available implementations including Vermont, SiLK, nfdump/IPFIX (Cesnet). nProbe has passed all the IPFIX interoperability tests as both probe (over SCTP, UDP, and TCP) and collector (UDP), dissecting both IPv4 and IPv6 traffic, and also converting NetFlow-Lite flows into IPFIX flows.”

Above is a picture of Luca at the event. That’s him just right from the middle, between Benoit Claise from Cisco (a joint creator of NetFlow / IPFIX) and Jiri Novotni of Invea-Tech.

This news speaks volumes about the level of commitment that Luca and the rest of the nProbe team have made to complying with the various network performance monitoring standards in the industry.

Jon Mills
Follow Me On Twitter

That’s not to say you can’t still use the existing method of powering the device as the BS2 will retain the internal 7.5 VDC power supply and is a “Powered Device” so the power to the unit can be supplied from either the PoE or from the 7.5 VDC power adapter, acting as backup power in case of a PoE power supply failure.

Surely such a notable addition to the product must increase the price substantially. Not true. While the powered BitSight2 (without any included sensors) currently runs $250, the new PoE model sees a modest cost increase of $45, bringing the cost to $295.

In addition to the new PoE option, the Ethernet interface is now a standard full duplex 100mHz port that replaces the old half duplex Ethernet port. This new functionality comes with the same reliability Ravica users expect from their environmental monitoring equipment at no additional cost.

As always, we continue to improve our existing product line by adding features and technologies that our customers need most. We hope many of you find these new sensorProbe options to be as exciting as we do.

Oh, and a little birdie recently told me that we can expect to see a PoE BitSight8 sometime in the near future as well. Stay tuned here for more developments in our line of data center monitoring hardware.

Jon Mills
Follow Me On Twitter

Once you’ve completed the video, make sure to visit our friends at Plixer to learn more about configuring the Windows nProbe to send NetFlow.

Jon Mills
Follow Me on Twitter

In the prior NetFlow Domain Reporting blog, I outlined how to view URLs using a NetFlow Probe called nProbe. In this post I’ll explain why 174.123.133.232 doesn’t show up for theplanet.com.

Answer
The server that hosts theplanet.com is not hosted on 174.123.133.232, but 70.87.6.117, as we can see in the above command window below.

Additional Details:

• e8.85.7bae.static.theplanet.com is a server on theplanet.com domain – but doesn’t host theplanet.com website.
• e8.85.7bae.static.theplanet.com does not resolve to anything – there is no forward DNS entry for this name.
• 174.123.133.232 resolves to e8.85.7bae.static.theplanet.com – there is a reverse DNS entry, also known as PTR record, for this IP address.

Trashminer.com Details:

• Trashminer.com is a website hosted on 174.123.133.232 who’s reverse DNS entry is: e8.85.7bae.static.theplanet.com.
• Trashminer.com will need a forward DNS entry of 174.123.133.232 so that users will be able to find the server that hosts the website.

DNS Overview
A forward DNS lookup (uses an A record) is using an Internet domain name to obtain the hosting server’s IP address. An A record gives you the IP address of a domain. That way, users that try to go to www.example.com will get to the right IP address.

A reverse DNS lookup (uses a PTR record) is using an Internet IP address to find a domain name. In short, a user has an IP address and wants to know what the host/domain is.

Scrutinizer NetFlow Analyzer is performing reverse DNS lookups; therefore, a single domain name, typically the server hostname, will be returned.

There can be many A records for the same server. One reason for this would be web hosting. This will allow many different domains to reply with the server IP for which their site is hosted on; however, there can only be 1 PTR record for that server.

You might be wondering if you could do the same thing with sFlow reporting. Yes, but not if the switch didn’t sample the packet. In my experience, most of the time it doesn’t capture the one I wanted.

So, I hope this 2 part series helped you understand more about the nProbe, URLs via NetFlow and something about DNS entries.

Jon Mills
Follow Me on Twitter

I didn’t remember browsing to some of the domains listed, so I clicked on View Raw Flows to look at the URLs I had hit in a 3 minute period. One of the URLs started with ‘trashminer.com’ and I was surprised, because I didn’t see this host in the top domains report above.

Hmmm… what is going on? I noticed that the IP address of ‘trashminer.com’ was 174.123.133.232. I wanted to get to the bottom of this. Is this a bug???

I went back to the NetFlow analyzer and changed my NetFlow filter to include all traffic between 10.1.7.8 to 174.123.133.232. I was determined to figure this out!

Notice above that 174.123.133.232 resolves to e8.85.7bae.static.theplanet.com. You might ask, how could an IP address be two different domains? Well, this happens all the time. Service providers sometimes host hundreds domains on a single server with a single IP address. When Scrutinizer resolved the IP address of 174.123.133.232, the DNS reported back e8.85.7bae.static.theplanet.com (aka ‘theplanet.com’), however, the nProbe performs deep packet inspection to get the actual URL, which was to ‘trashminer.com’.

Here is something else I found interesting; both theplanet.com and trashminer.com host web content on 174.123.133.232. I should note that both of these domains could also be using other IP addresses. I brought up a command prompt, did an nslookup on theplanet.com and it didn’t resolve to 174.123.133.232, as I expected. I then tried trashminer.com and it did resolve to the IP address I expected.

Hmm… What is going on? How come 174.123.133.232 doesn’t show up for theplanet.com? I’ll explain in NetFlow Domain Reporting: Part 2!

Jon Mills
Follow Me On Twitter

Voltage monitoring should be a concern. Why? Because your battery backup will only last so long and you need to know when / if they are being used. Below is a rough outline of a conversation I had recently with our network engineer during an ice storm:

Mike: Hello Tom, does the office have power?
Tom: I don’t know, let me check.
<60 seconds>
Tom: I can ping the server at the office so we must have power.
Mike: Ya but, is it on battery backup or does the office have power?
Tom: Ah, good question.

Thankfully, we had the voltage detector configured in our server room. Think of this sensor as sort of like those handy voltage sensors you keep in the house to see if you are getting power from an outlet.

Monitoring power consumption is a smart idea. If your data center goes down, even if it is only a couple of servers, a router and a switch, it could cost you serious money.

A good environmental monitoring solution should include power monitoring when it comes to the data center.

- Mike

Less staff means more remote monitoring for many organizations. Having a remote monitoring system, like the SecurityProbe, can help lighten the load of working with less. With a price point that usually falls below $2,000 for a complete system, it can mean a considerable savings over staffing each location, or even worse, not monitoring it all. In this scenario, one person can monitor the well-being of several locations.

Event monitoring is more than just security though. This means integrating a system that will account for fire prevention, temperature and humidity monitoring, as well as the more standard door and window security or even motion detection. This gives the end user a more hands on approach without actually having to be on site.

So in the midst of downsizing corporations, there are ways to maintain eyes and ears in places that house expensive equipment, but may not necessarily need to house live employees.

~ Jon Mills
Follow me on Twitter

However, a web-based system that can monitor for changes in temperature, humidity, airflow, as well as the presence of water, smoke and motion, can be extremely valuable. To demonstrate just how valuable, I thought I would put together a list of the top three reason why a web-based system is more convenient and cost effect for many home and business applications.

1. Remote system management
For many of our customers, the BitSight and SecurityProbe line of monitors are perfect for collocation centers or off site installations, where they may house valuable equipment, like servers and networking hardware, away from their place of daily operations. It is not always convenient for a network administrator to visit a location that might be hours away (or perhaps even on the other side of the country). With a web-based system, monitoring temperature and humidity readings becomes as easy as visiting a web page.

2. SNMP support
Regardless of what network monitoring applications you use, SNMP is one of the most universally supported protocols available. With complete SNMP support, the Ravica line of intelligent sensors can be monitored using the same tools that you already use to monitor the health of your servers and other networking hardware. With enough expertise, configuration commands can even be issued manually via SNMP or using other SNMP configuration tools.

3. Many sensors on a single user interface
With traditional temperature sensors, and the like, there is nothing to report back to. You have your sensor, with the reading, maybe displayed on an attached gauge or screen. If you have multiple sensors that means physically visiting each one to take your measurements. However, with a web-based approach, we provide several sensors readings all displayed in a central interface. There is no longer a need to visit each sensors. Even though they may be physically placed in five separate locations, the readings can all be found from your desk chair.

Summary
So when considering any form of environmental monitoring system, whether you are monitoring temperature, humidity, airflow or smoke, make sure to decide well in advance if a web-based system is necessary. If so, make sure to take a look at Ravica’s environmental monitoring solutions and our line of intelligent sensors. You won’t be disappointed!

~ Jon Mills
Follow me on Twitter