Michael Patterson : Advanced NetFlow Traffic Analysis
Michael Patterson
Founder and Product manager for Plixer's Scrutinizer NetFlow and sFlow Analyzer as well as Flow Analytics.

Homeland Security and EU Remind us Companies are Not Cybersecure

In case the news of constant breaches isn't enough to inform you that most companies are not prepared for cyberattacks, recently, the...

Full Story »

Fuze Touts Rapid Growth and Significant Samsung Partnership

Fuze is a global UCaaS provider – in business since 2006. Their average seat size is greater than 3,000 with 40% of...

Full Story »

Infovista Ipanema SD-WAN Now With Nextgen Application Intelligence+ and Cloud-Native Orchestration

In an in-person interview, Ricardo Belmar, Sr. Dr. Global Enterprise Marketing, Infovista explained the company’s Ipanema SD-WAN has enhanced application intelligence as...

Full Story »

CallMiner Makes AI-Fueled Speech Analytics a Reality

CallMiner allows organizations to extract intelligence from customer interactions,” said Scott Kendrick, VP of Marketing In an in-person interview. You may know...

Full Story »

Omilia Conversational AI Expands into Cloud

Omilia is a software company focusing on customer service automation. They have an AI system commercially deployed at large scale. They handle...

Full Story »

PCM Enhances Collaboration Portfolio

PCM is the 2.3 billion dollar a year organization you may not have heard of. They were once PC Mall – remember...

Full Story »

Beware of New Zealand-Related Scams and Malware Campaigns

Please make note of this important warning from DHS: ---In the wake of the recent New Zealand mosque shooting, the Cybersecurity and...

Full Story »

Log Management Solutons

October 14, 2012

Here is some good news for the log management software industry: appliance vendors exporting machine messages (e.g. syslog, SNMP Traps, Event Logs, NetFlow, etc.) can now export everything in one common format using IPFIX.  This technology has been around for years and allows vendors to export machine messages in a structured format. Unlike traditional logs which are unstructured, IPFIX messages are much easier to save to a database and query.  Experienced system admins know that the problem they face when trying to manage logs or analyze logs is often the sheer volume.  Most log analyzer tools start to choke under a massive volume.  IPFIX is a technology break through that solves scalability issues for most consumers.  Cisco ASA syslog reporting can be improved by exporting the messages as IPFIX as shown below:

Nimsoft Service Desk Pricing: Distributed NetFlow Solutions

September 24, 2012

The Nimsoft Service Desk claims that it will allow you to coordinate and accelerate incident response and proactive IT management.  This of course will in turn increase user satisfaction, reduce costs, and help meet business objectives.  In many cases when vendors like Nimsoft (owned by Computer Associates) try to provide the all-encompassing solution, they sometimes turn to best of breed vendors like Plixer to provide highly specialized solutions to address specific areas of IT.  In this case: NetFlow and IPFIX. 

NetFlow Training Seminar: NetFlow University

September 4, 2012

Are you looking to attend a NetFlow training seminar or a NetFlow University?  There are two companies offering these types of courses and both offer Cisco CPE credits toward Cisco Certification.

NetFlow Training Schedule for 2012

August 11, 2012

The 2012 NetFlow Training Schedule has been posted and the agenda looks to provide a thorough overview on what is possible with NetFlow and IPFIX technologies. Some NetFlow seminars are really a sales pitch to push the vendor solution.  This NetFlow training course focuses on the latest Cisco Flexible NetFlow exports as well as the industry trend toward IPFIX.  

Flexible NetFlow Configuration example for Performance Monitoring for TCP, VoIP and Cisco NBAR

July 12, 2012

Here is a sort of generalized FnF – Flexible NetFlow configuration where I created a TCP class that includes all TCP traffic. I don't normally recommend this as typically I would identify the business applications that I want to track with performance monitor and create classes for monitoring each. If all TCP latency is desired, this should work fine. Also, this FnF configuration is based on IOS 15.2(2)T and includes Cisco NBAR configuration details as well. If an earlier IOS is being used, ignore the error when creating the flow records. Reports should still work well if of course you have the best NetFlow reporting solution.

Ingress NetFlow or Egress NetFlow part 2

June 22, 2012

Switching from Ingress to Egress

Don't forget to read Ingress or Egress NetFlow part 1 first. What if you wake up one morning and announce to your network traffic monitoring team that for several reasons, you want to export both ingress and egress NetFlow on a few of the Cisco Routers. What will the network monitoring gurus say?  Hmmmm......  Probably nothing. 

Ingress NetFlow or Egress NetFlow part 1

May 31, 2012

Why use Egress NetFlow

The topic of ingress or egress NetFlow has come up more than once at our company.  The benefits of egress over ingress flows are outlined in the above link.  It is important to understand that NetFlow v5 only supports ingress NetFlow where by the flows are collected as traffic comes into an interface and not as they go out.  The logic was that if NetFlow is metered (i.e.

Cloud Service Monitoring

May 20, 2012

Interest in cloud service monitoring utilities will grow as businesses become more dependent on these types of virtual services.  In this post, I’ll outline some great ways to monitor cloud services by leveraging in house hardware namely, Cisco Routers and the use of Flexible NetFlow Performance Monitoring or Medianet exports.

Temperature Monitoring Solutions with Remote Humidity Sensors

May 9, 2012

Generally I write about NetFlow solutions but, today I’ve got temperature monitoring solutions on my mind for a data center we use that requires remote humidity sensors or electronic hygrometer equipment.   Server room monitoring isn’t something I consider my forte but, it seemed I couldn’t avoid getting involved with this project.

Cisco ASA Vs. Juniper SRX: NetFlow Reporting

May 6, 2012

The Cisco ASA Vs. Juniper SRX was being hotly debated on the Cisco forum.   Being a flow analysis company we always ask about NetFlow or IPFIX support before we purchase a network appliance, especially a firewall.  Reporting on data in our organization is paramount as “he who stays in the know, stays ahead”.  When it comes to firewall reporting, we are looking for:

  • Traditional flow reporting
  • Log reporting
  • Other cool flow exports (e.g. usernames)
Featured Events