Most data rooms are kept between 68-72.  Did you know that data center managers could save 4 percent in energy costs for every degree of upward change in the set point? This is according to Mark Monroe of Sun Microsystems.

Data Room Airflow
The data center airflow had also better be kept in check.  Many IT centers have air conditioners for the data rooms but, what about the cabinet temperature of each rack?

A single humidity sensor can provide decent ambient temperature for the entire room.  The same is not true for temperature and especially not airflow. Placing a temperature and air flow sensor in each computer cabinet will help ensure proper data cabinet ventilation.

With proper airflow design, air moves evenly through the data center.  If you are using our data room security solution, you can consider adding a few cameras as well.

If you have questions or would like a demonstration, contact our data room and environmental monitoring  specialists.

Cold temperatures means freezing temperatures and with that usually comes snow which is needed for one of my favorite winter activities: snowmobiling!

I picked up my iPhone and checked out how the office was doing.

Isn’t technology today with smart phones amazing.  Above you can see our cameras, zoom in, check the humidity sensors, water detectors, outstanding alarms and more all with one thumb.

We of course setup the above system to give customer demonstrations.  Call us to check out our security monitoring solution.

Server Room Monitoring

If you have a need to monitor the environment of your server room, our server room environmental monitoring solution could be the solution you have been looking for. See the screen capture below.  We can also add web cameras.

Reach out to our team if you would like a demonstration
of our data room temperature, humidity, smoke, camera, motion, etc. monitoring solution.

• sudo apt-get install libpcap-dev
• sudo apt-get install softflowd

After softflowd is installed you can run it on an interface. In the example below eth0 is attached to a mirrored port (uplink) on a core switch and the NetFlow is being sent to 10.1.10.1 on UDP 2055. This will allow you to see all of the flows on the switch.

• sudo softflowd –v 9 –n10.1.10.1:2055 –i eth0 –m 100000 –t general=60s

Use a free NetFlow monitoring tool such as Scrutinizer.  Scrutinizer NetFlow Analyzer will treat this as a new exporter, but will only report using a single interface, 0. All of the flows are tagged with a source interface of 0 and a destination interface of 0.

What is the ambient temperature?  This is a tricky question that when answered correctly involves several answers!

Different things can impact the ideal ambient temperature.  Who or what is inside the room that could be impacting temperature (people, an oven, a light, etc.). The seals around windows, the temperature outside and other influencers such as air flow can all be a factor when trying to determining ambient temperature. If you are painting a car, the ideal temperature depends on the type of paint and on the material being painted.

The ideal temperature obviously depends on the individual or on the application involved. For most, 22 °C (71.6 °F) is the recommended living room temperature, and 18 °C (64.4 °F) is a good bedroom temperature.

Don’t forget about humidity detection.  Although moisture in the room can help make it feel warmer, it generally does not impact the ambient temperature. If it is, we have humidity sensors for humidity monitoring!

We got ours setup and attached a few cameras that we had laying around the office.  The web dashboard allowed me the select the most important cameras as well as view the log of environmental events that may end up triggering notifications.  All of this functionality in a single appliance.

One securityProbe can be used to connect several different cameras and at the same time provide ports for environmental sensors such as water leaks, temperature, humidity, smoke, power outages and more. This hardware provides one of the best low cost environmental, power and security monitoring solutions available on the net.

Notice below I filed on the domain ‘last.fm’.

Network traffic monitoring of audio streams is best done by looking at the traffic coming from different domains.

I filtered on the last.fm domain by running a host to host report.  It made me realize that it can be tough to monitor radio streaming by looking for a specific host because each time you listen to a new song, the stream comes from a new unique host.

If you don’t have NetFlow or IPFIX capable router or switch, consider contacting a nprobe reseller. The nProbe or nBox is generally placed off of a spanned or mirrored port of the switch.

Although the 2nd trend looks like the 1st, notice the colors don’t change in the 1st trend.  Make sure your NetFlow and IPFIX reporting tool has a domain report.

Nationally, the USA is not seeing a big increase in crime, however this is best measured locally according to the Bureau of Justice.  Is crime on the increase in your area?

What is interesting about this solution is that it doesn’t involve multiple monitor spread out over a wall with 1-2 people watching for problems (or sleeping).

Our solution is a dashboard that allows you to have cameras from different vendors in the same web interface.  You can place a gadget using any 3rd party URL into the mashup. I should be able to put some NetFlow probes  in here as well.

I can’t wait to start testing the playback features:

I should be able to post some details over the coming months.  I’ll even have some night vision cameras with inferred technology to tinker with.  I can’t wait!

1. If you’re not Cisco and you want to export something unique, you take a chance on using an element ID that may not be in use by Cisco.  I’ve seen 4 companies do this and later decide to convert to IPFIX. The other two companies have conflicts with Cisco.
2. Variable length fields: If you want to export URLs with NetFlow (e.g. Citrix, nProbe, SonicWALL) you should use IPFIX as NetFlow makes no provisions for variable length fields.

RFC 5610
While you’re at it, you should consider exporting a “RFC 5610″ template. It would basically list the PEN (Private Enterprise Number), each enterprise element ID, the type, description and other informative fields.

This option template would reduce the amount of communication necessary between the exporting and reporting parties. Without this information, we are facing the same paradigm that exists in the packet analysis field where a decode library is needed before we can look at a new packet format. It is also an issue within SNMP technology where we need a MIB file before we can understand new OIDs.

Implementing RFC 5610 would help IPFIX collector developers a great deal. It is amazing the reports with can think of on our own when we know what the fields are before the meeting with the hardware vendor.

RFC 5473
Taking it a step further: if RFC 5473′s commonPropertiesID were exported then developers could figure out a lot more on their own. For example, If we have GroupID in one template and then we find GroupID in another template along with GroupName, we can put some pieces together without contacting the hardware vendor.

A good example is the interface names option template that we can export with Cisco IOS. Since the flows template contains the ingress/egress interface, I can use the interface names option template to label interfaces.

The relationship between the two templates was very obvious. This also reduced our dependency on SNMP.

SNMP via IPFIX is on the Horizon
If Cisco eventually allows us to export SNMP with IPFIX (i.e. selected OIDs), implementing these RFCs will become more important.  Certainly we will still need some communication between the companies to discuss what reports to produce but, there will be less discussion around how to decode the datagrams.

Need help with IPFIX setup on your corporate network? We recommend the professional services of Plixer International.

One of the biggest things we encourage companies to do is to avoid NetFlow v9 for anything that isn’t EXACTLY like Cisco.  If the vendor wants to export URLs or something unique that Cisco doesn’t export in NetFlow yet, we recommend using IPFIX.

Here are the IPFIX standard info elements. IPFIX RFC 5102 specifies a range of identifiers from 1 to 32767.  Within this range, Information Element identifier values in the sub-range of 1-127 are compatible with field types used by NetFlow version 9 RFC 3954.

If you see RESERVED in the IPFIX IANA list we may still decode the value. These values are typically all UPPERCASE with underscores between words as this is the style Cisco uses.  You will see this in Scrutinizer FlowView:

When conflicts arise between NetFlow and IPFIX, we use the IPFIX field names to save data.  This allows our IPFIX reporting to deal with inconsistencies in the naming conventions. When there is a conflict we use the names from the IANA IPFIX standard rather than the Cisco NetFlow field names.  We only use NF_* or other Cisco names when no standard name exists.

For example, the observationTimeMilliseconds column is the same as the Cisco ASA NF_F_EVENT_TIME_MSEC value. Our NetFlow Collector labels it observationTimeMilliseconds because of what I stated above (i.e. IPFIX is the standard).

In addition to the range 1 – 127 values, greater than > 32767 values are sometimes used by Cisco and others in order to add non standard elements to NetFlow v9. This works because values above 32767 have no special meaning for v9, but are reserved for vendor extensions in IPFIX. NetFlow version 9 has no option for vendor extensions so if you need v9 and nonstandard fields you sort of enter the wild west when your exporter uses NetFlow v9 values above 32767.  Why? Your work could get trumped by Cisco or another vendor. This is why we encourage vendors such as Sonicwall, Juniper, nProbe and others to make the switch to IPFIX.

Similar to Public and Enterprise SNMP OIDs, vendors can use the same values because their Vendor OID makes the element unique. For example, Exchange Log Analyzer ‘Mailinizer’ exports Microsoft Exchange Event Logs in IPFIX datagrams.  Plixer’s Enterprise ID is 13745.  If they used an element ID of 32785, nProbe could use the same element ID because their Enterprise ID is 35632.
To be clear! The problem with the NetFlow v9 and Flexible NetFlow extensions above 32767 is that there is no governing body to allocate identifiers.  If two vendors (or even two groups at the same company) happen to pick the same ID for different types then all bets are off.  Look at the extensions Cisco is already using above 32767:

Cisco uses at least the following in NetFlow v9:
(0,37000,’unsigned64′,’deltaCounter’,'CNT_PKTS_DROP’),
(0,37001,’unsigned64′,’totalCounter’,'CNT_PKTS_DROP_PERM’),
(0,37002,’unsigned64′,’quantity’,'CNT_PKTS_RATE’), — rate
(0,37003,’unsigned64′,’quantity’,'CNT_BITS_RATE’), — rate
(0,37004,’unsigned64′,’deltaCounter’,'MEDIA_CNT_BYTES’),
(0,37005,’unsigned64′,’totalCounter’,'MEDIA_CNT_BYTES_PERM’),
(0,37006,’unsigned64′,’quantity’,'MEDIA_BIT_RATE’), — rate
(0,37007,’unsigned64′,’deltaCounter’,'MEDIA_CNT_PKTS’),
(0,37008,’unsigned64′,’totalCounter’,'MEDIA_CNT_PKTS_PERM’),
(0,37009,’unsigned32′,’quantity’,'MEDIA_PKTS_RATE’), — rate
(0,37010,’unsigned32′,’quantity’,'MEDIA_PKTS_RATE_VAR’), — rate
(0,37011,’unsigned8′,’flags’,'MEDIA_EVENT_ERROR’),
(0,37012,’unsigned8′,’flags’,'MEDIA_EVENT_STOP’),
(0,37013,’unsigned8′,’flags’,'MONITOR_EVENT_ERROR’),
(0,37014,’unsigned32′,’quantity’,'TIMESTAMP_INTERVAL’),
(0,37015,’unsigned64′,’deltaCounter’,'TRANS_PKTS_EXPECT’),
(0,37016,’unsigned64′,’totalCounter’,'TRANS_PKTS_EXPECT_PERM’),
(0,37017,’unsigned32′,’quantity’,'TRANS_RTT’),
(0,37018,’unsigned8′,’flags’,'TRANS_EVENT_PKT_LOST’),
(0,37019,’unsigned64′,’deltaCounter’,'TRANS_PKTS_LOST’),
(0,37020,’unsigned64′,’totalCounter’,'TRANS_PKTS_LOST_PERM’),
(0,37021,’unsigned32′,’quantity’,'TRANS_PKTS_LOST_RATE’), — rate
(0,37022,’unsigned32′,’identifier’,'RTP_SSRC’),
(0,37023,’unsigned32′,’quantity’,'RTP_JITTER’),
(0,37024,’unsigned32′,’quantity’,'RTP_JITTER_MIN’),
(0,37025,’unsigned32′,’quantity’,'RTP_JITTER_MAX’),
If we look at the Cisco ASA NetFlow exports we find:
/* AAA Fields */
(0,40000,’string’,'identifier’,'NF_F_USERNAME’), /* 20 bytes || 65 bytes */
/* Mapped Flow ID Fields */
(0,40001,’ipv4Address’,'identifier’,'NF_F_XLATE_SRC_ADDR_IPV4′),
(0,40002,’ipv4Address’,'identifier’,'NF_F_XLATE_DST_ADDR_IPV4′),
(0,40003,’unsigned16′,’identifier’,'NF_F_SLATE_SRC_PORT’),
(0,40004,’unsigned16′,’identifier’,'NF_F_XLATE_DST_PORT’),
/* Status or Event Fields */
(0,40005,’unsigned8′,’identifier’,'NF_F_FW_EVENT’),
(0,33002,’unsigned16′,’identifier’,'NF_F_FW_EXT_EVENT’),
/* ACL Fields */
(0,33000,’octetArray’,'identifier’,'NF_F_INGRESS_ACL_ID’),
(0,33001,’octetArray’,'identifier’,'NF_F_EGRESS_ACL_ID’)

The nProbe NetFlow probe  supports NetFlow v9 however they also support IPFIX.  Below is a partial list:
[NFv9 57552][IPFIX 35632.80] %FRAGMENTS               Number of fragmented flow packets
[NFv9 57554][IPFIX 35632.82] %CLIENT_NW_DELAY_SEC     Network latency client <-> nprobe (sec)
[NFv9 57555][IPFIX 35632.83] %CLIENT_NW_DELAY_USEC    Network latency client <-> nprobe (usec)
[NFv9 57556][IPFIX 35632.84] %SERVER_NW_DELAY_SEC     Network latency nprobe <-> server (sec)
[NFv9 57557][IPFIX 35632.85] %SERVER_NW_DELAY_USEC    Network latency nprobe <-> server (usec)
[NFv9 57558][IPFIX 35632.86] %APPL_LATENCY_SEC        Application latency (sec)
[NFv9 57559][IPFIX 35632.87] %APPL_LATENCY_USEC       Application latency (usec)

Contact us if your company is looking for IPFIX consulting. I’m sure we can help. The above is just one of the many pit falls your company wants to avoid.