Take the NetFlow Challenge!

Transcription

1 TM Scrutinizer NetFlow and sflow Analysis Scrutinizer is a NetFlow and sflow analyzer that provides another layer of cyber threat detection and incredibly detailed network utilization information about the users and applications that consume your bandwidth. Using both Cisco s NetFlow or sflow Technology found on most switches and routers, Scrutinizer is able to retrieve graphical view. VoIP Analysis Voice over IP (VoIP) Analysis is assisted in Scrutinizer by verifying: What QoS is being requested Visualization of Network Health Visualize Global Networks with Google Maps Scrutinizer offers advanced integration with the Google Maps API, which allows users to plot routers, switches and device groups on imbedded Google or traditional maps. This helps make high level network navigation a snap and Network Behavior Analysis alert you when trouble is recognized. Zero - day worms, SYN Floods and DoS attacks Policy violations and internal misuse Zero Day Threat Detection Behavior based threat detection without the use of signi- Unauthorized application deployments Compare IP addresses to host reputation lists investment in routers and switches to perform zero day detection of unknown threats. Custom Report Filtering IP Addresses, ranges and subnets Port numbers and ranges - The Best Value in NetFlow Regardless of your reason for choosing Scrutinizer, you ll easily recognize the value it brings to your network equipment and your team. Scrutinizer is worth the investment. Take the NetFlow Challenge on the back! Combine interfaces from multiple routers

2 Support for unlimited exporters 5 Support for unlimited interfaces Identify interface names using NetFlow, not SNMP Support for multiple languages Display data in bits, bytes, packets or percent Trend in, out or both at the same time, in all reports 100% support for Flexible NetFlow by breaking out details per template Support for Netstream, sflow (v2, v4, v5), J-Flow, IPFIX and AppFlow Support for NetFlow v1, v5, v6, v7 and v9 Export data in csv format on all reports Granularity down to the second it was received Schedule reports on demand Filter for Host to Host and Subnet to Subnet Abiltiy to add mutliple interfaces across different routers to single report IMPORTANT: As a host may have multiple routes to the same destination Support for IPv6

3 Mapping of network with links that change color based on utilization Ability to click on the links in the map to bring up the top conversations Integration with Google Maps Customize interface names and overwrite default SNMP ifalias name Customize interface speed, both in and out, with different values SNMP v1, v2 and v3 LDAP support Integration with any 3rd party NMS solutions via cross check MPLS reporting on subnets and tags Online technical video training Company has thousands of customers Dashboards: unique interface per login account Group based user permissions reports on demand IP grouping support Exclude transport protocols from being saved per interface, router or globally (very important feature when VPNs and tunnels are involved). Ability to view individual Flow templates (NetFlow v9 and Flexible NetFlow) Ability to rename templates for future reference Ability to select which NetFlow template to use in a report (important when collection NetFlow from the Cisco ASA) Flow Volume Report Pair Volume (Volume of unique to/from address pairs) Alarm for DDoS, DNS issues Host Volume (volume of unique hosts per second)

4 Top Subnets Top Domains Top Countries Report and trend on Microsoft Exchange logs Detect network scans (e.g. SYN, RST/ACK, XMAS, FIN, etc.) Constant automated DNS resolution for Flows received Alarms for high interface utilization Specify allowed subnets and alarm for rogue IP addresses Unique index per alarm (tells how many other alarms the host has violated) Alarm: Identify internal hosts communicating with known compromised internet sites. (Online IP reputation database) Alarm for BitTorrent, YouTube, Facebook, etc. use Support for NBAR via NetFlow (i.e. not SNMP) Flow View Only Mitigate issues by turning ports off on switches or making ACL changes. (i.e. decades) Limited to 24 hours Set permissions per interface * Set permissions per router * Flow Expert in MyView for advanced, proactive awareness of anomalies UltraSurf detection Advanced Reporting on Citrix NetScaler for AppFlow (URLs, Latency, Etc) Support for Cisco ASA NSEL Performance Routing (PfR), Performance Monitoring, Smart Logging Telemetry (SLT), Cisco TrustSec, AVT Performance Agent and others. 3rd party integration w/cross platform fault index

5 Latency and round trip time for all devices on the network Set interface speed per report Search IP addresses or ports across all devices to track where it was seen The dynamic creation of reports based on any exported data (i.e. Element) Company acquired millions in Venture Capital Requires expensive Microsoft Database *Requires Service Provider Module