Latency Measuring with nBox and NetFlow
While Cisco’s NetFlow technology can be extremely helpful in identifying top talkers and applications on the network, it can sometimes lack the fine details often found in a standard packet capture. For instance, let’s take a look at application responsiveness. To determine why an application is slow to respond we often look to the amount of traffic on the link, as well as the latency of the transaction itself. Was there congestion in the pipe? Was the end-system slow to respond? Was the application itself responsible for the sluggishness? These are certainly all possibilities.
Luckily for the rest of us, the NetFlow data that gets exported from the nBox is a little bit different. In addition to what NetFlow normally provides in network traffic details, nBox exports include email addresses, HTTP URLs, Latency, VoIP Jitter and more. There is one caveat; at this time, Scrutinizer NetFlow & sFlow Analyzer is the only NetFlow reporting tool that can properly display these extra data fields. So you will want to make sure to look into Plixer’s product offering to take advantage of these advanced features.
IPFIX specification passed by nProbe software
Just last week, DEMONS, a European project designed for addressing the largest obstacles of “cooperative network monitoring,” held a successful IPFIX Interoperability Event in Prague. It was at this event that the nProbe software, available here at Ravica.com, was certified as compliant with the IPFIX verification testing.
nProbe and nBox IPFIX Reporting
Looking for more resources to help you get the most out of your new nBox NetFlow probe? Watch the video below to see Scrutinizer NetFlow and sFlow Analyzer Product Manager, Mike Patterson, explain how to report on IPFIX data exported from the nProbe and nBox to get application and server latency, URL information and more!
Once you’ve completed the video, make sure to visit our friends at Plixer to learn more about configuring the Windows nProbe to send NetFlow.
Jon Mills
Follow Me on Twitter
NetFlow-Lite (NFlite) Exports Using the nProbe and a NetFlow Collector
This month’s Cisco Live show in London allowed for some great opportunities. We mentioned that we met up with Luca Deri, developer of the nProbe. Our friends at Plixer International also attended the show where Cisco demonstrated the abilities of their new Catalyst 4948E NetFlow-Lite (NFlite) exports using Plixer’s Scrutinizer NetFlow Analyzer with the nProbe. NFlite is a sampling technology using NetFlow v9.
Plixer’s Product Manager, Michael Patterson, recently blogged about its features, explaining how the NFlite samples are sent to the nProbe, sending one sample per NetFlow datagram. He also included a screen capture of their Scrutinizer NetFlow collector demonstrating the integrated view of NetFlow data from N7k and NetFlow-lite from the 4948E.
Cisco Live- London with nProbe Developer Luca Deri
I went to Cisco Live Europe 2011 recently and met up with Luca Deri, the developer of the nProbe (a.k.a. NetFlow Probe). It was great to finally meet this industry icon for NetFlow and IPFIX. I just had to have my picture taken with him. Luca is on the right in the photo below:
Latency using NetFlow from the nProbe- Part 2
As we discussed in our recent blog about the benefits of using a NetFlow probe, the nProbe is an open source network software application developed by Luca Deri which allows admins to get latency from flows on networks. Through Luca’s partnership with Plixer International, Plixer has also been offering insight on how to get latency from network flows through their collector called Scrutinizer NetFlow Analyzer.
Latency from the nProbe comes in the following formats:
· APPL_LATENCY (Application Latency)
· CLIENT_NW_DELAY (Client Network Delay)
· SERVER_NW_DELAY (Server Network Delay)
Application Latency and Client Network Delay are determined when the NetFlow probe observes the TCP flags in a transaction. Below we captured the TCP packets in a connection initiated by client (10.1.15.20) to web server (10.1.7.18).
Latency using NetFlow from the nProbe- Part 1
Determining the causes of application slowness has long been a study of both traffic volume and latency within the transaction. Administrators had to determine if there was too much traffic on the connection which caused the slowness, or if there was sluggishness caused by the response time of an involved end system. Perhaps it was even the application itself causing the slowness.
If you have an nProbe, you can get latency from network flows captured by the probe. Read more
Use the nProbe and NetFlow to Monitor Network Latency
Are you looking to monitor latency with NetFlow? The nProbe is the first product to export latency readings of flow traffic using NetFlow or, as shown below, IPFIX exports. IPFIX is the proposed standard for Cisco NetFlow.
The problem with reporting on NetFlow latency details is that most IPFIX Analyzers (NetFlow Analyzer) ignore this new information from the nProbe. Scrutinizer NetFlow Analyzer from Plixer is making use of this new export. Read more
Catch Network Traffic to Hand Helds with NetFlow Analysis
We have our Cisco wireless access point plugged into our Enterasys N series NetFlow capable switch. This allows us to look at the volume of traffic coming from the wireless devices.
The above is useful, but I wanted to narrow in on the hand held devices. Specifically, I wanted to find out how much traffic is placed on the network when a person streams a NetFlix movie to their hand held. Read more
Monitor your Network with nProbe and nBox
It seems that today’s Network Managers are continually putting out fires while conquering challenges of modern technology. Networks have become more complex than ever before, requiring Network Managers to become even more proactive and efficient. 
Effectively monitoring and maintaining a network has become a requirement, and NetFlow allows that to happen successfully.
Luca Deri founded ntop in 1998 because he wanted to solve his employer’s network monitoring problems but had no tool to provide simple and efficient answers. Through ntop, he offers nProbe and nBox to serve as visual insight into network utilization. Read more