Michael Patterson : Advanced NetFlow Traffic Analysis
Michael Patterson
Founder and Product manager for Plixer's Scrutinizer NetFlow and sFlow Analyzer as well as Flow Analytics.

As we Predicted in 2015, VW Managers are Being Indicted

On Thursday, a federal grand jury in Detroit, Michigan, indicted four Audi executives for playing a role in the diesel cheating scandals...

Full Story »

D.C., Virginia, Most Concerned About Phishing Attacks

Phishing is a global scourge. Just today, Danny Palmer at ZDNET writes an excellent piece about how cybercrime is a $600...

Full Story »

What's Big This Year in Telecom? Vote Now!

TMCnet and Andy Abramson and his company Comunicano are asking in the first annual VoIPWatch Poll.. The results will be revealed at...

Full Story »

PHISH360 Helps Solve The $12.5B Phishing Problem

The FBI says email attacks cost business $12.5 billion!This is in-part because hacking into a person's account could be as easy as...

Full Story »

Can't Miss at ITEXPO Jan 29-Feb 1st in Florida

Thanks to your feedback, we have been building ITEXPO into the most comprehensive business tech event around focusing on communications and IT.First...

Full Story »

At IoT Evolution See Cisco, Google, Nokia and What Matters

IoT Evolution Expo returns to Fort Lauderdale, Florida, Jan 29-Feb 1st, 2019 with an amazing agenda.Attendees tell us they love this event...

Full Story »

The Apple Stroke of Genius You Missed

If you listened to the financial experts after the news broke that Apple guided lower last night, phones are now commodities, Apple...

Full Story »

Log Management Solutons

October 14, 2012

Here is some good news for the log management software industry: appliance vendors exporting machine messages (e.g. syslog, SNMP Traps, Event Logs, NetFlow, etc.) can now export everything in one common format using IPFIX.  This technology has been around for years and allows vendors to export machine messages in a structured format. Unlike traditional logs which are unstructured, IPFIX messages are much easier to save to a database and query.  Experienced system admins know that the problem they face when trying to manage logs or analyze logs is often the sheer volume.  Most log analyzer tools start to choke under a massive volume.  IPFIX is a technology break through that solves scalability issues for most consumers.  Cisco ASA syslog reporting can be improved by exporting the messages as IPFIX as shown below:

Nimsoft Service Desk Pricing: Distributed NetFlow Solutions

September 24, 2012

The Nimsoft Service Desk claims that it will allow you to coordinate and accelerate incident response and proactive IT management.  This of course will in turn increase user satisfaction, reduce costs, and help meet business objectives.  In many cases when vendors like Nimsoft (owned by Computer Associates) try to provide the all-encompassing solution, they sometimes turn to best of breed vendors like Plixer to provide highly specialized solutions to address specific areas of IT.  In this case: NetFlow and IPFIX. 

NetFlow Training Seminar: NetFlow University

September 4, 2012

Are you looking to attend a NetFlow training seminar or a NetFlow University?  There are two companies offering these types of courses and both offer Cisco CPE credits toward Cisco Certification.

NetFlow Training Schedule for 2012

August 11, 2012

The 2012 NetFlow Training Schedule has been posted and the agenda looks to provide a thorough overview on what is possible with NetFlow and IPFIX technologies. Some NetFlow seminars are really a sales pitch to push the vendor solution.  This NetFlow training course focuses on the latest Cisco Flexible NetFlow exports as well as the industry trend toward IPFIX.  

Flexible NetFlow Configuration example for Performance Monitoring for TCP, VoIP and Cisco NBAR

July 12, 2012

Here is a sort of generalized FnF – Flexible NetFlow configuration where I created a TCP class that includes all TCP traffic. I don't normally recommend this as typically I would identify the business applications that I want to track with performance monitor and create classes for monitoring each. If all TCP latency is desired, this should work fine. Also, this FnF configuration is based on IOS 15.2(2)T and includes Cisco NBAR configuration details as well. If an earlier IOS is being used, ignore the error when creating the flow records. Reports should still work well if of course you have the best NetFlow reporting solution.

Ingress NetFlow or Egress NetFlow part 2

June 22, 2012

Switching from Ingress to Egress

Don't forget to read Ingress or Egress NetFlow part 1 first. What if you wake up one morning and announce to your network traffic monitoring team that for several reasons, you want to export both ingress and egress NetFlow on a few of the Cisco Routers. What will the network monitoring gurus say?  Hmmmm......  Probably nothing. 

Ingress NetFlow or Egress NetFlow part 1

May 31, 2012

Why use Egress NetFlow

The topic of ingress or egress NetFlow has come up more than once at our company.  The benefits of egress over ingress flows are outlined in the above link.  It is important to understand that NetFlow v5 only supports ingress NetFlow where by the flows are collected as traffic comes into an interface and not as they go out.  The logic was that if NetFlow is metered (i.e.

Cloud Service Monitoring

May 20, 2012

Interest in cloud service monitoring utilities will grow as businesses become more dependent on these types of virtual services.  In this post, I’ll outline some great ways to monitor cloud services by leveraging in house hardware namely, Cisco Routers and the use of Flexible NetFlow Performance Monitoring or Medianet exports.

Temperature Monitoring Solutions with Remote Humidity Sensors

May 9, 2012

Generally I write about NetFlow solutions but, today I’ve got temperature monitoring solutions on my mind for a data center we use that requires remote humidity sensors or electronic hygrometer equipment.   Server room monitoring isn’t something I consider my forte but, it seemed I couldn’t avoid getting involved with this project.

Cisco ASA Vs. Juniper SRX: NetFlow Reporting

May 6, 2012

The Cisco ASA Vs. Juniper SRX was being hotly debated on the Cisco forum.   Being a flow analysis company we always ask about NetFlow or IPFIX support before we purchase a network appliance, especially a firewall.  Reporting on data in our organization is paramount as “he who stays in the know, stays ahead”.  When it comes to firewall reporting, we are looking for:

  • Traditional flow reporting
  • Log reporting
  • Other cool flow exports (e.g. usernames)
Featured Events