Dashboard of bandwidth graphs in bits

[Dnet8]

Hi,

We are considering getting NAA in our company (very happy with NagiosXI and Log Server)

I have configured four sources with netflow (ipfix) sources using sampling rate of 1/1000 packets. I need to display bandwidth graphs for all sources.

Questions:

1. Is it possible to change the display value for bandwidth from bytes to bits?
2. Is it possible (either in NAA, or integrated with NagiosXI) to display a Dashboard of bandwidth for all sources?

[jdalrymple]

1) The feature doesn't exist today. A feature request already exists though and NNA will be due some TLC from the devs after they're done pouring over the current XI major release.

2) I'm a bit confused by this question. Would you like to know the bandwidth of incoming source data for each source, or is this more of a "I want to know the entire aggregated bandwidth of every network device with a flow." The former I've discovered sometimes gets filtered out by the source device and we're not in control of that unfortunately so the data simply may not be available unless we add in some magic counters to the NNA box itself. The latter doesn't exist as I described it. It's probably something that could be implemented as a special query, but the underlying query engine couldn't handle it today I don't think. What would the use case be?

[Dnet8]

Thanks for your reply!

Its a bummer that you cannot show the bandwidth in bits. This might be a deal breaker for us. With regards to nr2 the use case is a managment friendly dashboard showing pretty graphs of the utilization of the upstream links to our ISP.

I have encountered a new problem. Due to some liminations in our routers (ALU SR7750) we are receiving flows from several virutal routers and interfaces in the same NNA source. The flow packets contain ingress/egress interface numbers:

Code: Select all

Cisco NetFlow/IPFIX
    Version: 10
    Length: 1406
    Timestamp: Sep  2, 2015 16:22:11.000000000 Vest-Europa (sommertid)
        ExportTime: 1441203731
    FlowSequence: 369587
    Observation Domain Id: 0
    Set 1
        FlowSet Id: (Data) (300)
        FlowSet Length: 1390
        Flow 1
			...
            InputInt: 324
            OutputInt: 279
            Packets: 1
            Octets: 72
			...
        Flow 2
			...
            InputInt: 325
            OutputInt: 330
            Packets: 15
            Octets: 3192
            ...

Is it possible to create querries/reports/views/graphs based on these fields? At the moment all the router traffic is lumped togeather in one big source graph. It would be nice to be able to drill down further based on the fields in the flow packets.

Hoping for positive replys! You guys are always helpfull ^_^

[jdalrymple]

Its a bummer that you cannot show the bandwidth in bits. This might be a deal breaker for us.

Sorry to hear that. As I mentioned it's likely coming in the next release, but it's definitely not there today.

the use case is a managment friendly dashboard showing pretty graphs of the utilization of the upstream links to our ISP

This is fairly trivial, and exactly what NNA is good at. A query like '(src net 10.0.0.0/8 and dst net not 10.0.0.0/8) or (src net not 10.0.0.0/8 and dst net 10.0.0.0/8)' would do fine for you.

Is it possible to create querries/reports/views/graphs based on these fields?

These fields appear implementation specific. We don't collect vendor proprietary stuff, just the vendor agnostic stuff: source port/ip, destination port/ip, flow age, bytes, packets, etc.

[Dnet8]

These fields appear implementation specific. We don't collect vendor proprietary stuff, just the vendor agnostic stuff: source port/ip, destination port/ip, flow age, bytes, packets, etc.

Not that it matters much, but they are not proprietary:

IANA lists inegress and egress interface as ElementID 10 and 14 at https://www.iana.org/assignments/ipfix/ipfix.xhtml

Also RFC 5102 section 5.1.3, and 5.1.4

[tmcdonald]

I would need to enter this in as a feature request if the Devs were to look at it, and I can certainly do so if you would like. However, that does not guarantee that a feature will make it in, only that it will be considered.

Would you like me to do so?

[Dnet8]

I think that for our flow analyzing needs we are going to look elsewhere. I feel NNA is a bit rudimentary when compared to the features and flexibility offered by other products.

By all means, enter the request. I cannot guarantee a purchase (and we would certainly need a new trial period), but I am sure this feature will enhance the product and make it alot more viable.


Anyway, thanks for swift answers and great support!

[hsmith]

I think that for our flow analyzing needs we are going to look elsewhere. I feel NNA is a bit rudimentary when compared to the features and flexibility offered by other products.

By all means, enter the request. I cannot guarantee a purchase (and we would certainly need a new trial period), but I am sure this feature will enhance the product and make it alot more viable.


Anyway, thanks for swift answers and great support!

We're sorry to hear that this is not an ideal solution for you. I'll talk to the devs and see if this is planned for the future, and if not see about getting a feature request submitted for you.

Please let us know if you need anything else.

[Dnet8]

I want to pint out that IPFIX is not a "competing product" as your stealth-editor seems to think.

It is the last version of the protocoll on which your product is built.

[jdalrymple]

Sorry about that Dnet8, some of the folks working through the forums aren't SMEs on all the products yet and as such are unaware of all the different standards in use. As you can tell even I'm learning things. I apologize for my hasty assumption that your interface offsets were vendor specific things - I've grokked netflow a lot in the past couple months and it just hasn't been in front of my face. All that said the situation kind of stands, we aren't doing anything with that data. Our capture daemons are indeed storing the data so that perhaps in future versions if we want to add it as a filterable/viewable field we can do that, but it's not there today.

I will be creating a feature request (that won't get looked at for awhile because of the upcoming XI release) to make all the fields for which we're collecting data filterable and viewable. It seems a bit silly that the data is there but not at all accessible.