NetFlow/IP FIX/sFlow
NetFlow is a push technology where the router sends call record information about each flow that crosses it. Each record contains header and volume information about each flow. Using this information, the NetFlow Reporting Engine—the SevOne FlowFalcon—provides crucial insight into bandwidth and performance management. Going beyond simple network utilization statistics, the SevOne FlowFalcon delivers the visual details of who is talking to whom, who is using the most network resources and much, much more.

Though PAS series appliances support NetFlow collection in a large network, users may choose to distribute load using DNC (Dedicated NetFlow Collector) appliances. DNCs are designed to be a cost-effective way to instrument large networks. They work (cluster) transparently with both PAS as well as other DNC appliances to give users a single pane of glass view into their infrastructure.

SevOne NetFlow collectors can be positioned in the network to receive flow data from the closest routers on the network. The collector stores the data locally for 30 days, although longer periods can be achieved if additional storage is provided. The SevOne NetFlow collector will receive and store the data in real time, and data is available for report generation as soon as it has been received. Reports can be generated from any SevOne appliance spanning data across all peered appliances. In this way, for example, a Top Application report across routers monitored by all appliances can be generated by a user logged into any SevOne appliance.

Common uses for NetFlow include:

• Network planning and traffic engineering
• Application monitoring
• Security analysis, including worms, viruses, and DoS attacks
• Time and usage-based billing

SevOne FlowFalcon ships with 30 stock templates to help users analyze flow traffic coming from their routers. FlowFalcon also allows users to define their own templates, mixing and matching any available fields to break down traffic in ways that best make sense to their particular application and business environment. This is especially useful when analyzing NetFlow v9 and IPFIX data where the field set is flexible based on router configuration.

SNMP
Short for Simple Network Management Protocol, SNMP is a set of protocols for managing complex networks. SNMP works by sending query messages to SNMP-compliant devices located anywhere in the network. Device types can range from routers and switches to servers, firewalls and load balancers to UPSs, temperature sensors and many, many more. Devices store data about themselves in Management Information Bases (MIBs) and return this data to the SNMP requesters.

In SevOne, the SNMP system uses a series templates for different device types to determine what to poll and how to present the information. In this way, new device types supporting standard or generic MIBs are supported immediately. Importing new definitions for new MIBs and objects is easily done in just a few minutes using SevOne’s SNMP Object Editor. The operation is entirely GUI driven, and even the most complex and enterprise-proprietary MIBs can be easily configured.

The SevOne SNMP library built for speed and flexibility. This helps users to:

• Set up monitors with a few mouse clicks
• Quickly pinpoint issues with quality of service (QoS) and VoIP
• Quickly drill down on network performance problems to find the root cause

IP SLA
Using Cisco's IP SLA network technology, SevOne can create and graph synthetic, active measurements of end-to-end network performance between any two points on the network. This provides a validation of network performance as measured by latency, jitter, packet loss and throughout, independent of the devices that transmit network traffic.

With SevOne IP SLA, you can:

• Gather traffic statistics that cannot be observed externally
• Validate the performance of independent devices that transmit network traffic
• Analyze the end user experience

Using IP SevOne's IP SLA tools, network managers are able to create thresholds and get insight hop-by-hop to isolate problems for true end-to-end performance measurement.

NBAR
NBAR (Network-Based Application Recognition) protocol discovery in SevOne analyzes application traffic patterns in real time and discovers which applications are running on the network without using NetFlow. Using NBAR, you can discover what applications are running on the network and monitor their resource consumption, all with minimal impact and network overhead. This eases classification of voice and data traffic and serves to help set priority policies for traffic. You can set thresholds on individual protocols on a device and receive alerts when they go beyond the set threshold.

With SevOne NBAR, you can:

• Track applications running on the network and their resource consumption
• Set thresholds for individual protocols on an interface
• Ease classification of voice and video traffic
• Police anomalous traffic

QoS
SevOne helps you manage the latest network applications by closely monitoring any policy or class-based QoS on the network. Deploying QoS best practices without thoroughly understanding an application's WAN needs or configuration settings is difficult at best. That's why SevOne produces helpful QoS reports needed to properly manage the priorities of mission-critical real-time applications such as VoIP or transaction processing.

Combining NBAR's unprecedented ability to define application in a granular fashion with SevOne's QoS reports helps you to see your network policies in action. With SevOne QoS you can:

• Throttle down low priority traffic during times when high priority traffic is competing for bandwidth
• Know when your provider's network is affecting the flow of traffic
• Classify traffic in your MPLS network

With SevOne QoS, you can optimize your QoS configuration to best match your infrastructure needs and serve your customers better by configuring alerts for your policies, classes, match statements and queues.