Skip to main content
Version: Next

What is NetFlow Optimizer?

NetFlow Optimizer™ (NFO) is a software-only processing engine for network flow and infrastructure data. It provides a unified platform for Flow Analysis and Infrastructure Monitoring, transforming raw data from physical, virtual, and cloud environments into actionable intelligence.

  • Flow Analysis: NFO accepts NetFlow, IPFIX, sFlow, and J-Flow from network devices, and Cloud Flow Logs (AWS VPC, Microsoft Azure, Oracle OCI, and Google VPC).
  • Infrastructure Monitoring: NFO enhances visibility by actively polling via SNMP, receiving SNMP Traps, and subscribing to modern Model-Driven Telemetry (MDT).

This combination of flow and infrastructure data provides comprehensive real-time network monitoring, enabling advanced operational intelligence and security for both virtual and physical networks.

Key Benefits:​

Efficient Flow Volume Reduction​

Address the challenge of overwhelming data volumes by intelligently reducing data without sacrificing critical insights. NFO applies advanced techniques like deduplication, intelligent aggregation, Top N, and flow stitching to minimize storage requirements and prioritize significant traffic patterns.

  • The Volume Challenge – Taming the Tsunami: In high-traffic environments, every flow generates a record, resulting in massive volumes that overwhelm storage. Simply collecting everything is often unsustainable. NFO tackles this with:
  • Deduplication: Removes redundant records from overlapping collection points.
  • Intelligent Aggregation: Summarizes flows based on shared attributes. By excluding ephemeral client ports, NFO typically achieves a 80–90% volume reduction.
  • Top N: Focuses on the most significant traffic (e.g., top talkers by bandwidth) to provide critical insights without needing to analyze every single record.
  • Flow Stitching: Reconstructs bi-directional conversations, providing a complete picture while reducing record counts by up to 50%.

Automated Infrastructure Monitoring​

NFO eliminates the manual labor of infrastructure management through its Autonomous Classification Engine.

  • Multi-Group Inheritance: Unlike traditional systems that lock a device into one folder, NFO supports Multi-Group Membership. A device intelligently inherits a "layered" monitoring profile—aggregating OID sets and Telemetry subscriptions from Vendor, Role, and Feature groups simultaneously.
  • Zero-Touch Discovery: Automatically maps your network and identifies device capabilities.
  • MDT & SNMP Versatility: Supports traditional SNMP polling alongside modern, subscription-based Model-Driven Telemetry for high-performance streaming.

The Importance of Enrichment​

While raw flow data provides a foundation, it lacks the context needed for advanced analysis, especially for Machine Learning (ML) and Artificial Intelligence (AI). NetFlow enrichment transforms data into a high-quality source by correlating records with:

  • User Identities: Linking flows to specific users via Active Directory, LDAP, or Okta.
  • Application & VM Details: Identifying the specific applications and Virtual Machine names generating traffic.
  • Contextual Data: Correlating with Geolocation databases and Threat Intelligence feeds to flag communication with known malicious actors.

Enriched data transforms a simple IP address from just a number into a rich tapestry of context: it becomes a server hosting a critical application or a user accessing a specific service. Without this enrichment, “naked” IP addresses are largely useless for sophisticated AI/ML analysis, which thrives on the "who, what, where, and why" that NFO provides.

Leveraging Existing Investments​

NFO integrates enriched data into your existing SIEM (Splunk, Sentinel) and IT Ops platforms, offering several advantages:

  • Capitalize on Prior Investments: Extend the capabilities of your existing platforms without a complete overhaul.
  • Enhanced Correlation: Cross-reference network traffic with server logs and security events for a holistic understanding of incidents.
  • Unified Visibility: A centralized view simplifies investigation and accelerates root cause analysis.

Why These Benefits Matter:​

  • Proactive Security: Deeper visibility enabling faster detection of security threats.
  • Optimized Performance: Reduced monitoring overhead and improved tool efficiency.
  • Rapid Troubleshooting: "Self-healing" visibility that accelerates issue resolution.
  • Contextual Awareness: Transform raw flow data into actionable intelligence, allowing for proactive network management and strategic planning.