Plixer’s Product Manager, Michael Patterson, recently blogged about its features, explaining how the NFlite samples are sent to the nProbe, sending one sample per NetFlow datagram.  He also included a screen capture of their Scrutinizer NetFlow collector demonstrating the integrated view of NetFlow data from N7k and NetFlow-lite from the 4948E.

Plixer was able to work directly with Cisco and with Luca Deri to ensure Scrutinizer’s compatibility with the new NetFlow exports.  Ravica offers nProbe as a versatile and powerful software solution to help you retrieve these NetFlow exports.  When installed on a PC, nProbe turns it into a Network-aware monitoring appliance.

Ravica offers nProbe as part of the nBox hardware solution to help you monitor your network.  nBox is an economical solution which is easily implemented.

If you would like more information about monitoring your network traffic with an nBox, give us a call.

~Angela
207-324-8173
Follow us on Twitter!
Find us on Facebook!

Latency from the nProbe comes in the following formats:

·       APPL_LATENCY  (Application Latency)
·       CLIENT_NW_DELAY  (Client Network Delay)
·       SERVER_NW_DELAY  (Server Network Delay)

Application Latency and Client Network Delay are determined when the NetFlow probe observes the TCP flags in a transaction.  Below we captured the TCP packets in a connection initiated by client (10.1.15.20) to web server (10.1.7.18).

Here is a simplified look at the above 3 packet transaction:

TIME STAMP                                                PORTS                       TCP FLAGS

[pkt  1] 16:12:29.013422                     52525 -> 80                         SYN
[pkt  2] 16:12:29.013923                     52525 <- 80                        SYN/ACK
[pkt  3] 16:12:29.013945                     52525 -> 80                        ACK

Notice the time stamps in the flows above.  We used them to calculate latency below:

Client Network Delay = (16:12:29.013923 – 16:12:29.013422) / 2 = 0.501 msec / 2 = 0.25 msec
Server Network Delay = (16:12: 29.013945 – 16:12:29.013923) / 2 = 0.022 msec / 2 = 0.01msec

Above, we divided the time delta by two because we wanted to compute the network latency that we assume is half the round trip time.

Loaded with the above information, the nProbe exports the above millisecond values (.25 msec and .01 msec) as seconds and microseconds.  The seconds column is often rounded off to zero.  Below the values are displayed as collected by FlowView in Scrutinizer in a CSV export:

Notice above that the ACK and PSH flags are not seen because we only saved the packets relevant to our current topic.  The other packets that included the ACK and PSH flags were filtered out of the saved capture.

NetFlow logically ‘ands’ these flags together when exporting a flow.  The 209 packets involved with the first flow are seen below.

The reason the three flows above weren’t all part of one flow is because we are also exporting the URL (which will be the topic of another blog).  The short answer is that when you specify in the template that you want to see the URL, nProbe has to split HTTP/1.1 connections into various http requests.

Application latency is computed as the time needed by an application to react to a client request.  For TCP connections, application latency is computed on the first packet after three-way-handshake.

As with network latency, application latency is location dependent.  In theory, application latency is supposed to measure the time depicted in pink in the chart, but in practice it also measures the time depicted in green.  For this reason, latency measurements depend on where the probe is placed.  For accuracy reasons, it should be located as close as possible to the server in order to minimize the green time.  For certain protocols (e.g. ftp file transfer or video-over-ip), application latency cannot be computed because they are one way without client->server and server->client communications.

The nProbe has a Command Line Interface (CLI) for setting it up.  To configure our nProbe to export the data needed for this purpose, we configured it as follows:

nprobe -n 66.186.184.202:2055 -n 66.186.184.204:2055 -i eth1-t 60 -d 15 -u 3 -Q 4 -L 24.39.1.172/32 -r -V 9 -T”%IPV4_SRC_ADDR  %IPV4_DST_ADDR %IPV4_NEXT_HOP %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS  %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED %L4_DST_PORT %L4_SRC_PORT  %TCP_FLAGS %PROTOCOL %HTTP_URL%SRC_TOS %SRC_MASK %DST_MASK %CLIENT_NW_DELAY_SEC  %CLIENT_NW_DELAY_USEC %SERVER_NW_DELAY_SEC %SERVER_NW_DELAY_USEC”

For further details on the open source NetFlow probe, visit Luca Deri’s NTOP’s website.  For nProbe pricing, visit our Online Store.

~Angela
207-324-8173
Follow us on Twitter!
Find us on Facebook!

Assign those tasks to Ravica’s SensorProbe so you can focus on other facets of your job, like playing with your new email reporting software, Mailinizer Email Log Analyzer from Plixer International. 

While you’re running Mailinizer reports to determine your top email users, Ravica’s environmental monitoring solutions can monitor your data center for humidity, temperature, voltage surges, water leaks, smoke, and security so you don’t have to.  The sensors aren’t just fancy smoke detectors.  They are versatile and reliable devices that can prevent total damage by sending instant alerts about potential threats.  They are designed to keep you in control.  They can be placed virtually any location that you want to protect from environmental hazards.

So while you’re busy saving the IT world by putting out figurative fires, our sensors will notify you of any potential real fires or other hazards. 

Set your notification parameters, then elect to receive notifications in a variety of ways including an audible alarm, Skype, email, a strobe light, text messages, Twitter, and on the web-based interface.  Be instantly notified of potential problems. 

Need more hours in the day?  Then set your data center monitoring thresholds, and let our sensors do the work for you.

~Angela
207-324-8173 
Follow us on Twitter!
Find us on Facebook!

Aside from recently being blasted with swirling vortexes of terror in the form of tornoados (in New England?!), things here are going well.  We recently mentioned that we have entered the NetFlow probe arena by offering nProbes and nBoxes for your business needs.

But it did occur to me that we should at least offer a brief overview of what NetFlow is.

To put it in perspective, IT administrators could see how much traffic was on a network prior to NetFlow creation, but they couldn’t see what kind of traffic it was.  Cisco Systems created NetFlow and changed the world of technology.  NetFlow allows extremely detailed collection and measurements of network traffic.  This depth of data collection provides near limitless opportunities for business and network management, including the ability to monitor source and destination IP addresses, troubleshoot performance errors, and detect security threats.

In order to access NetFlow, you must have NetFlow capable routers or switches, or you can simply obtain Ravica’s nProbe or nBox to export the data you need.  You can add them to your existing network without the requirement of migrating data or traffic to new devices.  They are very easy to install directly to your existing setup, and they easily capture the network information and put it into a usable format.  You’ll be managing your network traffic in no time.

Some NetFlow collectors and reporting tools have even turned into virtual technological art forms, like Plixer International’s Scrutinizer tool which offers incredibly in-depth traffic reporting and presents it in clear, concise graphical formats.

If you have more questions about NetFlow, there are some network monitoring blogs available on Systrax.com.  You are also welcome to contact us with any questions about NetFlow, nProbes, or our environmental monitor probes.  Just like NetFlow, and unlike swirling vortexes of terror, we are here to help your business.

~Angela
Follow us on Twitter!
Find us on Facebook!

“Mount Wilson is in danger from the Station fire burning near L.A. Their servers have gone offline, but there’s a temporary mirror cam. It doesn’t look good. Picture twenty-four on the L.A. Times photo gallery shows the observatory from the air. If anyone has any inside news on the condition of the facility, I’m sure there are lots of people on Slashdot that would love to hear it.”

It got me wondering about what type of SensorProbes they have. Most companies will never see this size of fire, but even a tiny fire can put a server room out of commission. That is why it is so important to use sensor probe technology to monitor our environment and alert us when something is wrong.

Anyway, I don’t want to use this as a sales pitch. So, let’s use the fire in California to remind us to check our home and office fire detection systems.

My prayers go out to all of the fire fighters, the people who have lost their homes and the people who’s homes are in danger.

- JimmyD

Like I said, today is hot. So to help deal with the heat, I decided to write about a light subject, something easy to swallow. Today’s blog is about my peeps and their SmartPhones.

Jon has an iPhone. I nag Jon everyday for being an Apple lemming. My issue with Apple goes back a long time and is purely personal. I was a eight years old and I really wanted a Macintosh. My parents couldn’t afford a Mac, it was only for the better off people. This divide made me bitter.

As far as a phone goes, it is one of the best. The double touch screen is slick, over all he doesn’t seem to have any complaints. The software selection is good but regulated. If Apple doesn’t want you to build a program for their phone, then you can’t sell it. Again, I’m kinda bitter about this.

I have the AT&T Tilt. This is a Windows Mobile phone that has its good and bad points. The best thing about my phone is that it is NOT an iPhone.

Since the Windows Mobile environment stretches across multiple platforms and has been around for quite a while, the software selection is abundant. In general it is an open environment and has a vibrant community.

The screen isn’t as responsive as I would like and sometimes you can really mess up your phone if you install the wrong piece of untested software. Can you say “Bricked!”?

Dale just got a Google phone. Dale was one of those people who always said, “I don’t need a phone like yours. I only make calls.”  It has been a few days, and he has clearly changed his song. He is now a disciple of the goodness that is SmartPhone technology. Dale is installing apps, using GPS, texting and making calls. He is a happy camper.

So why am I telling you about my peeps and their different phones? Simply put, we  have three different camps of people, with three different ways of thinking.

You have your iPhone people, who want their provider to make sure every app works on your phone, protects you from any bad application and distributes their apps via one common provider. You get a good, safe and friendly phone.

You have the Windows Mobile camp, who believe that any app, no matter how bad or untested it is, should be available. They want choice, multiple phones, multiple options and freedom. The Windows Mobile world has its ups and downs. If you are not careful, you can get more then you bargained for.

The GPhone has a large community. Their software is built on an open source environment. They are safe, regulated by the users, tested by the users and over all crunchy.

Even though all of these phones are different, they still can easily communicate with each other. Maybe our politicians should learn a lesson from the ups and downs of the SmartPhone market? Maybe they could learn to communicate with each other in one common protocol and have the luxury of error checking?

What a wonderful world we live in? I wonder what technology my daughter will use when she is my age?

- JimmyD

I was in a planning meeting with my manager and my AT&T Tilt started to vibrate. I find this very annoying. Of all things to happen during this super exciting meeting, this had to take the cake. Yes, I am being sarcastic and a bit over dramatic. The issue is still the same, I hate being annoyed.

The real point to this rant is to point out the subject of the alert. It was a SMS page from my Ravica tempature probe. It had been violated.

This issue raised multiple questions. The first, and most  important, would be how to politely excuse myself from the meeting. In general, this wouldn’t be a hard thing to do, but my manager was excited about the new data room expansion project. By excited, I mean elated, and by elated, I mean that he expected everyone to have the same level of passion or face the most harsh punishment executed on mere mortals.

Knowing that I could lose my admin privileges, I forged on. I told Jon that something is happening in the sever room and had to leave. He said “ok” and went on with his conversation.

Puzzled, I quickly went into the server room and found the issue. Brandon, our new, green intern had placed his super hot cup of coffee next to the temp sensor. He was in the process of cleaning up cables and listening to the Ramones on his headset.

The heat from his coffee cup quickly raised the temp around the sensor.

From this I have learned two things. The first is that you should never leave your interns unattended. They can cause way too much damage. The second is to not locate your temperature sensor where someone can obstruct it in any way.

Now I have to explain this to my boss. Wish me luck.

- JimmyD

They don’t have the budget or can’t get the budget to update their aging equipment. So, what can these admins do to extend the life of their equipment?

Just like an older automobile, maintenance and proper care of the equipment can easily extend your equipment’s life. Constant monitoring of your system inside and out can save you from loosing mission critical servers. Environmental monitors like the temperature and humidity, airflow, smoke and water sensors can be used to make sure that the environment that your systems operate in are the best they can be.

Now, I know what you are saying, “Jim’s just a salesman and wants you to buy something.” Although I might get excited about a product and preach its goodness, I am not a sales person . I might dream of being the star of a Shamtastic infomercial, but trust me, I’m not. What I do want you to know, is that there are some simple things that you can to to help save your hardware.

• Your server room is not a storage area! If it is, it really shouldn’t be. Extra stuff in the room can cause heat issues and possibly be a fire hazard. Keep the area clean and free of obstacles.
• Manage your cables properly. I had a boss who had a hang up on making sure the all cables were organized correctly. You guessed it, I didn’t think it was all that important. In hindsight, I was wrong. Keeping them organized is great for physical management, but more importantly, it makes it easier to manage airflow. Be it a cable tunnel or just pulling them together with a zip tie, making sure your servers get the correct ventilation is important.
• Have a physical maintenance window for your machines. It might bring you back to youthful A+ days, but making sure the servers are dust free  and cables are in the correct place can help immensely.
• Monitor the servers health with an SNMP Trending app. Most servers can give you CPU, Server Temp, Fan Info and other valuable information, via a simple SNMP walk. A SNMP trending application, like Denika,  will allow you to gather historical information on this data and alert on it.
• Monitor your environment.  As I mentioned before, monitoring the room temp, humidity and airflow will make your admin life a lot easier.  If you have some room in your budget, this might be the best way to spend it.

So there it is.  I guess the old saying, “An ounce of prevention is worth a pound of cure,” is correct. Even in today’s super digital world!

- Jimmy D

• “On Monday June 29, Rackspace Hosting (RAX) experienced a power outage at its Dallas data center that left several areas of the facility without power for about 45 minutes, knocking many popular customer web sites offline.
• “Early Thursday Equinix Inc. (EQIX) data centers in Sydney, Australia and Paris each experienced power failures. While the power outages were brief – Equinix said the Sydney event lasted 12 minutes while power was restored in Paris in just one minute – many key customer sites took considerably longer to recover their systems. The Sydney event led to disruptions for VoIP service in parts of Australia, while the Paris outage caused downtime for the popular video site DailyMotion and the French portal for hosting firm ClaraNet.
• “Google App Engine, the company’s cloud computing platform, had lengthy performance problems on Thursday, experiencing high latency and data loss.
• “A fire at Fisher Plaza in Seattle late Thursday night left many of the building’s data centers without power. The fire in an basement-level electrical room triggered sprinklers and caused extensive damage to generators and electrical equipment. The damage left tenants with backup plans offline for hours, and those without backup sites down until temporary generators restored power early Saturday morning. The biggest impact was at payment gateway Authorize.net, which was offline for more than 12 hours, leaving its merchant customers unable to process credit card sales. Other sites experiencing lengthy downtime included AdHost, GeoCaching and Microsoft’s Bing Travel.
• “Early Sunday, July 5, a fire at 151 Front Street, the major carrier hotel in Toronto, knocked out power on several floors of the facility used by Peer 1 networks. Power was restored in about 3 hours, after a damaged UPS unit was bypassed.”

The author, Rich Miller then goes on to point out some tough questions and the lessons learned from these outages.

Although it is surprising that data centers of this size can experience an outage like this, what is even more surprising is that it all happened in a week’s span. I wonder, is the National Security Agency going to look into this?

The equipment used to monitor this size data center is monumental, but even the smallest IT department can obtain economically priced sensor equipment, like the Bitsight8, combined with Intelligent Sensors, like the AC Voltage Detector and the Digital Voltometer.

The process is easy. Browse to TwitterMail, insert your twitter username and password to get your TwitterMail address instantly. Then go to your SensorProbe and create an email alert. Alert goes off, email is sent and Twitter is fed.  Make sure that everyone that is supposed to recive these messages  are followers of your Twitter account.