NetFlow Optimizer enables you to process massive volumes of NetFlow (IPFIX, sFlow, Cloud VPC Flow Logs, etc) data, optimizing and enriching it in real time - ensuring that you get data where you need it in right formats.
Data Volume Reduction
Data Volume Reduction (DVR) is a process of reducing the amount of data that needs to be stored and processed. This can be done by consolidating, deduplicating, or filtering data.
- Consolidation: Consolidation is the process of combining multiple data records into a single record. Bytes and packets from communicating peers are aggregated over a short configurable period of time by source, destination, protocol, and ports. Consolidation can reduce the amount of data that needs to be stored and processed, without losing any accuracy.
- Deduplication: Each flow is reported only once, even if it passes through multiple network devices. This further reduces the volume of data without losing accuracy.
- Top traffic: Top traffic is a technique for reducing the amount of data that needs to be stored and processed by only reporting the top N consolidated flows. Top traffic can significantly reduce the amount of data that needs to be stored, while still maintaining a high level of accuracy.
Flow Data Enrichment
NetFlow records only contain a limited amount of information about network traffic. Flow data enrichment is the process of adding additional information to NetFlow records, such as:
- DNS names: The domain names of the hosts involved in the flow.
- VM names: The names of the virtual machines involved in the flow.
- Applications: The names of the applications that are being used.
- User identity: The identity of the users who are using the applications.
- Cloud instance names, services, regions: The names, services, and regions of the cloud instances involved in the flow.
- SNMP polling data: Data that is collected from network devices using SNMP.
- GeoIP: The geographic location of the hosts involved in the flow.
- Reputation based on threat lists: The reputation of the hosts involved in the flow, based on threat lists.
Flow stitching is the process of combining client-server request-reply flows into a single flow record. Here are some of the specific benefits of flow stitching:
- Improved accuracy in traffic analysis: By stitching together request-reply flows, it is possible to get a more complete picture of the traffic between two hosts. This can be helpful in identifying malicious activity, such as port scans or denial-of-service attacks.
- Improved visibility into network behavior: By stitching together request-reply flows, it is possible to get a better understanding of how applications are using the network. This can be helpful in troubleshooting performance problems or identifying security vulnerabilities.
- Improved efficiency in security operations: By stitching together request-reply flows, it is possible to automate some of the tasks involved in security operations. This can free up security analysts to focus on more complex tasks.