Learn about network traffic management and trouble shooting traffic issues faster.

1. Diagnosing and
troubleshooting
traffic issues faster
Free training on NetFlow Analyzer: Part II

2. Welcome to a free training on
NetFlow Analyzer!

3. Can you hear me?
Can you see the presentation?
Please confirm by commenting in the chat panel.

4. Trainer
Piyushree
NetFlow Analyzer product expert

5. Part II
Diagnosing and troubleshooting
traffic issues faster

6. Agenda
• Customizing data storage
• Customizing dashboards
• Reporting and automation
• Troubleshooting with forensics
• Traffic shaping
• Capacity planning and billing

7. Major concerns while troubleshooting
an issue
• How do I control how long data is stored for troubleshooting?
• How do I identify potential issues early and get alerted about them?
• How do I find the root cause of an issue?
• How do I troubleshoot and resolve an issue?
• How do I optimize traffic and check if my bandwidth is slowly reaching its limit?
• How do I know if I'm being overcharged by my ISP?

8. How long data is stored for
troubleshooting

9. Customizing storage settings
Aggregated dataRaw data
One-minute data

10. Aggregated data
Default ON
Raw data
Default OFF
Types of data storage
• Each and every detail on application, source,
destination, and more
• Storage time limit (one hour to one month)
• By default one day is selected
• Improve raw storage up to one year with
High Perf
• Troubleshoot faster with forensics
• Stores "top 100" records for
conversation by default (Up to 300
records)
• Retains data forever by default
• Capacity planning and long-term
reporting

11. Other storage settings

12. Benefit of turning on raw data
• One-minute granularity for the most detailed traffic analysis
• Long-term storage for better root cause analysis
• Improves accuracy with each and every conversation detail
• Deeper insights for troubleshooting with forensics reports
• Real-time alerts to troubleshoot issues immediately
http://blogs.manageengine.com/product-blog/netflowanalyzer/2010/01/29/data-storage-pattern-in-netflow-analyzer.html

13. Why you need a High Perf reporting engine
database
So you can:
1. Handle huge volumes of traffic with raw data
2. Improve accuracy of traffic analysis
3. Generate insightful reports faster
4. Increase your raw data storage period up to one year
5. Follow capacity trends and troubleshoot efficiently

14. One-minute traffic data
• Interface traffic graph for any 24-hour period
• Capacity planning traffic report
• Compare report
Raw data
• Forensics
• Last 2 hour for interface snapshot graphs
• Traffic details for App flow, Medianet, Multicast, AVC and ASA flow.
Aggregated data
• All widgets in inventory (Application, conversation and QoS)
• All interfaces and graphs, except a traffic graph for any 24-hour period
• Search and custom search report
• Consolidated report
• Schedule report
• Report profile
Data storage summary

15. How to identify potential issues early

16. Traffic summary dashboards
Top N applicationsDevice summary
Top N protocols Top N QoS
Top N conversations

17. View top N traffic details from the dashboard
• Track top N details in traffic summary
• Drill down to the most consumed
traffic; identify suspicious traffic
• Create new dashboards to view the
details that are important to you
• Display live data in your NOC screen
with auto-refresh option

18. Proactive alerting
Link congestionUtilization % exceeds
High traffic volume Link speed is low

19. Set alarms based on bandwidth usage
• Difference between
alarms and events
Alarms display:
• Message
• Source
• Category
• Technician
• Notes
• Severity
• Date/time

20. Possible options with alarms
• Drill down to faulty router/interface
from the alarm
• Note the exact time an issue occurred
• Check for traffic/application graphs
• Add notes to update the status of an
alarm
• Discuss issues with team members
An alarm is raised when WAN link utilization is more than 50%

21. How to find the root cause of an issue

22. Easy reporting
CompareCustom search
Consolidated IP group and protocol
Forensics

23. Drill down to any specific detail with reports
Search/custom search report
Compare report
Consolidated report
IP group consolidated report
Protocol distribution report
Bandwidth analysis reports help you:
Search specific traffic details by the
associated application, protocol, host, or IP
Compare bandwidth usage at different
time intervals
Track top talkers and conversations with
a complete report
Visualize the combined bandwidth usage
of all IP groups
View protocol-based traffic for any
particular interface

24. Save all your reports in Report Profiles

25. Benefits of reporting
• Create criteria-based reports to identify bandwidth shortages or traffic spikes
• Automate and schedule reports at any specific time; receive notifications about reports
• Save reports and export them to PDF or CSV files to share them with upper management
• Generate historical reports to promptly diagnose bandwidth capacity
• Periodically review and optimize the usage of network bandwidth

26. Troubleshooting with forensics
What's the root cause of a traffic spike?

27. Benefits of forensics
• Get more granular traffic statistics using
raw data
• Drill down to identify which users,
applications, and protocols are consuming
the most bandwidth at a specific time
• Troubleshoot accurately by defining
multiple criteria to filter required traffic
• Flexibility to review historical data and find
out why a particular spike was generated

28. Real-life use case

29. There was major network congestion and
critical applications were running slowly...

31. ...which affected all users connected to the
network. The biggest challenge was
figuring out how to quickly resolve the
issue.
Step 1: Determine which part of the network was experiencing congestion
Step 2: Identify what caused the congestion. App or user or external attack?
Step 3: Troubleshoot by applying policies and bring the network back up

32. Step 1: Determine which part of the network
was experiencing congestion
• Where is the congestion and is it notified to me?
• Which applications were contributing to the most traffic?
• What QoS precedence value was the traffic utilizing at the time?
• What were the top source, destination & conversations in the network?
The dashboard immediately provided
details on what was being affected.

33. Step 2: Use forensics to identify what
caused the congestion
• Which applications or users were consuming the most traffic?
• What was the top conversation in the network at that time?
Forensics help locate the real cause.
The issue was with a patch management upgrade that
happened on all windows server during business hours.

34. 1. Block the IP using an access control list (ACL)
2. Reduce the traffic bandwidth utilization
3. Load share the traffic with the help of Compare Reports
4. Reschedule the action to occur during non-business hours
How to troubleshoot and fix the issue

35. 1. Filter out excess router
traffic by blocking IP/ IP
network
2. Allow certain packets
and deny everything
else
#1. Block the IP with an ACL

36. 1. Tweak your traffic policies
with CBQoS configurations
2. Shape interface traffic and
prioritize your critical
applications
3. Monitor the policy change
in CBQoS graphs
#2. Reduce the traffic bandwidth utilization

37. 1. Compare multiple
devices across the same
time period to view each
one's capacity
2. Decide how much to
deviate traffic on each
interface/device
#3 and #4: Load share the traffic or
rescheduling using Compare Reports

38. Once the issue is resolved, generate a
consolidated report to view the traffic stats.

39. What should you do if your bandwidth
is slowly reaching its limit?

40. Capacity planning
Know immediately when you've reached your maximum capacity.
Generate short-term or long-term reports to view your network's usage trends.
Get meaningful insight into application growth, average usage, and any usage deviations.

41. How to bill your customers correctly

42. Billing
Measure bandwidth usage to cross-check with your ISP billing.
Generate bill plans for your customers/clients if you're an ISP.

43. iPhone app

45. Summary

46. Need more help?
youtube.com/netflowanalyzertechvideos
help.netflowanalyzer.com
forums.manageengine.com/netflowanalyzer
netflowanalyzer-support@manageengine.com
+1 (888) 720-9500 / +1 (408) 916 - 9595

47. Q&A

48. Thank you!
Piyushree
piyushree.n@zohocorp.com