X
    Categories Network Performance Management

Welcome to FlowVember: Alerting

This is the first post of Flowvember – AppNeta’s celebration of really awesome, application-aware traffic analysis technology. And in the spirit of Movember and FlowVember, we challenge you to join us in growing out your mustache and checking out your network traffic. Get AppNeta’s FlowView free trial here.

And, if you like what you see and decide to buy, we are donating 10% of all FlowView proceeds in November to the national Movember charities.

I have been following the netflow analysis space for over a dozen years and I have always been underwhelmed by the implementation of products in this space. Understanding how and where your network capacity is being used is critical to running a high performance network. The tools had the worst of both worlds, overly technical in their User Experience and not telling me enough about what users were actually doing on the network. When the opportunity came up a year and a half ago to build modern, hosted network usage analysis service I was really excited and with this series of blog posts I hope to share a bit of why we built what we built and why that matters.

You will notice that I didn’t call the service that we built, FlowView, a netflow analysis tool. Because its not. We don’t collect netflow from devices on the network. We don’t do this because there is dramatically more insight to be gained from analyzing the traffic directly to identify the applications in use, with the side benefit of performing packet captures if needed, but more on that in a later post.

First World Problems

With this direct access to the network traffic we can identify the applications in use at a much more granular level than traditional netflow tools, identifying the specific web sites and smartphone apps in use. This level of insight is a revelation for the majority of customers we show it to, but in one way it’s an embarrassment of riches.

The sales floor of our Boston headquarters is a pretty lively place, there are one or more music streaming services playing all the time (spy on what our sales reps are doing on the internet now in our live demo – its our actual internet traffic). A pretty logical alert we wanted to create was “Alert me if Streaming Media services used more than 10% of our download bandwidth”, not to be big brother but as part of monitoring to ensure that critical applications have the resources they require.

The challenge there is that there are many streaming services, using different technologies and there are new ones being introduced all the time. During the month of October there were 27 different streaming media services using a little over 100Gb of download traffic volume. Thats a lot of Kayne and inappropriate ads on Pandora.

So we can do 27 individual alert profiles about each of services, which FlowView can do quite well, but I don’t want to have to set specific usage thresholds on each, and what about tomorrow when the next, cool new streaming service comes out?

This being our service, we wanted to take a smarter approach to solving this problem, so we leveraged some meta data we maintain about these applications. Every application we identify is categorized a few ways, and in this case we create a very straight forward rule: If the Application Classification of Streaming Media exceeds 10Mbps inbound, I will know about it.

This results in us having a very straight forward alert analyzing all traffic on our network, and when any combination of streaming media services consume more that 10Mbps we will be notified, and as the latest Pandora-killing streaming service website or smartphone app is released the rule stays up to date.

This is the first post of Flowvember – AppNeta’s celebration of really awesome, application-aware traffic analysis technology. And in the spirit of Movember and FlowVember, we challenge you to join us in growing out your mustache and checking out your network traffic. Get AppNeta’s FlowView free trial here.

And, if you like what you see and decide to buy, we are donating 10% of all FlowView proceeds in November to the national Movember charities.