Scrutinizer Application traffic analytics, visualization and reporting tool Computer networking is an integral focal point of virtually every business. Unfortunately the ability to understand and identify the traffic flowing across the network has been somewhat of a puzzle to most organizations. With this as a backdrop, organizations are also facing budget and costs constraints, and are under increasing pressure to optimize capital investment and minimize costs, including monthly Internet service costs. At the same time, non-business-related web traffic, such as social media, is increasing exponentially, draining bandwidth and productivity. IT is constrained by outdated monitoring and reporting tools that provide limited visibility into ports and protocols yet lack insight into application traffic flow across the firewalls, routers and switches on the network. In addition, traditional firewalls do not always adequately stop threats originating from infected hosts inside the network. Value-Added Resellers carry the added burdens of demonstrating service value to customers, while controlling their own costs and the amount of time spent managing individual customer accounts. Dell SonicWALL Scrutinizer is a multi-vendor, flow-based application traffic analytics, visualization and reporting tool to measure and troubleshoot real-time and historical network performance, while increasing productivity for enterprises and service providers. You can deploy Scrutinizer as a Windows application or as a virtual appliance, which has been designed specifically to scale to high performance environments. The combination of Scrutinizer and a Dell SonicWALL Next-Generation Firewall gives you unparalleled insight into application traffic analysis from IPFIX or NetFlow data exported by Dell SonicWALL firewalls. Increase return on your technology investment with broader compatibility with a wide range of third-party routers, switches, firewalls and data-flow reporting protocols. Simplify forensic analysis with improved analytic capabilities. Scrutinizer easily identifies top applications, conversations, flows, protocols, users, domains, countries and subnets, and alerts on suspicious behavior. While some other firewall vendors may support NetFlow or IPFIX, only Dell SonicWALL offers this level of application traffic detail. Scrutinizer features deep-packet application traffic analysis, proactive jitter/latency monitoring automated reporting, suspicious behavior alerting and customizable dashboards. Scrutinizer also provides historical and advanced reporting, role-based administration, advanced analysis, and threshold-based alerts 1, plus special features for MSPs and ISPs 2. Benefits: Shorten root-cause analysis Quickly pinpoint the source of jitter, packet loss, latency, or a misconfigured network Speed troubleshooting Visualize real-time or archived application traffic data Simplify forensic analysis Analyze traffic in high throughput environments Gain deep granular insight into application usage on your network Receive greater return on your existing technology investment Customize alerting Ease administration 1 These feature require the Flow Analytics Module 2 Available in the Service Provider Module
Features and benefits Shorten root-cause analysis with granular analytics and reporting. Scrutinizer provides easy visualization of network traffic, VPN traffic, VoIP traffic, top hosts, protocols, ports, applications, traffic and conversations across all network realms and devices. Flexible analysis options can display trend data in bits, bytes, packets or percent of total bandwidth consumed. Scrutinizer offers support for both IPFIX and Flexible NetFlow for fully customizable report templates, and can save all flow records indefinitely. Quickly pinpoint the source of jitter, packet loss, latency, or a misconfigured network by lighting up the end-to-end path (including asymmetrical connection paths) of a flow across a multi-vendor network topology with Flow Hopper Speed troubleshooting of capacity bottlenecks, latency, jigger, Active Timeout, top conversations, top host flows, host volume, pair volume, MAC addresses, VLANs, and domains by leveraging IPFIX and other flow based protocols for deeper insight. Track latency and round-trip time (RTT) in flexible increments with the Flowalyzer NetFlow and sflow Tool Kit. Visualize real-time or archived application traffic data with powerful tools that list top interfaces across all routers, switches and firewalls, including interactive charts, tables, Google Maps, an innovative matrix view to show flow fields, and animated network topology maps showing relevant flow data. Simplify forensic analysis through enhanced detection capabilities and alerts. Scrutinizer captures unauthorized applications, malicious traffic, knowncompromised Internet hosts, Flow Sequence Number violations, DNS cache poisoning, rogue IP addresses, DHCP and mail servers, port scanning, excessive multicast traffic, HTTP hijacking and DDOS attacks. Analyze traffic in high throughput environments by deploying Scrutinizer as a virtual appliance, enabling over 40,000 flows-per-second, thus easily accommodating high-performance requirements and reducing overhead costs and complexity. Gain deep granular insight into application usage on your network using IPFIX and NetFlow data and Dell SonicWALL Application Traffic Analytics, a unique solution providing a powerful bundle of industry leading Next- Generation Firewalls and Scrutinizer software. The firewall transmits IPFIX data in real-time to the traffic analyzer collector application, where the administrator can examine usage data by application or user, look at data over different time periods and much more. While some firewall vendors do support NetFlow or IPFIX, only Dell SonicWALL offers this level of application traffic detail. Receive greater return on your existing technology investment through deep and broad compatibility with third-party systems that may already be embedded in your infrastructure, thereby extending long-term value. Scrutinizer is compatible with hundreds of routers, switches, firewalls, and other networking devices regardless of vendor to monitor thousands of interfaces simultaneously. Customize alerting based upon interface utilization, unfinished flows, nefarious activities, and degraded voice and video. Scrutinizer alerting can show how many alarms a host has violated and can also facilitate various automatic remediation options. Ease administration with flexible, customizable dashboards per login, group-based and per login permissions to access flow data for specific router, switch, and firewall interfaces. MSPs can easily modify style sheets to match branding. Create summary reports on Dell SonicWALL and third party devices and view them directly on your dashboard. 2
Customizable dashboard Customizable user dashboard provides powerful at a glance insight into network performance. Dashboards can be created per user to easily see host status, outstanding alarms, the top applications, network volume, or custom mashups that are relevant to specific users. Google Maps Google Maps integration provides a comprehensive view of the entire network, even across the globe! Links are color coded and displayed based upon their current status making troubleshooting a snap. Matrix view The innovative matrix view provides powerful visualization into conversations across the network. Easily identify host to host connections by seeing connections as they are created. 3
Dell SonicWALL templates Custom Dell SonicWALL templates provide an additional layer of granularity and insight into traffic as it crosses the network. On the left, Dell SonicWALL IPFIX with Templates; on the right, traditional application traffic analytics. Threat heat map Easily determine the most severe threats through an intuitive, quadrantbased visualization. Simply look in the upper-right quadrant for data flows with the most violations and unique violators. Applications defined Break down application traffic into numerous different views to see traffic by number of packets, bits, bytes or as a percentage of total traffic seen over a particular time interval. 4
Features and specifications Scrutinizer Scrutinizer with Scrutinizer with - trial version Flow Analytics Flow Analytics and Modules Add-on Modules Capacity and visualization Archived data Up to 24 hours Unrestricted Unrestricted When combined with report archiving provides a platform for trend analysis Up to 24 hours List top interfaces across all all routers, switches and firewalls Limited to 5 interfaces Compatible with numerous vendors Capable of handling up to 40,000 flows per second in v11 Supports over 1,000 exporters and over 1,000 interfaces Integration with Google maps Network topology map with network traffic patterns Flexible reporting Multiple scheduled reports in a single email Ability to include and exclude data using filters Ability to rename templates for future reference Definable default landing page per customer logs in Define Application Groups using ranges of ports and IP addresses Display data in bits, bytes, packets or percent Granularity down to the second it was received using FlowView Report per interface on top hosts, protocols, applications, conversations and more Save filters on custom reports Trend in, out or both at the same time, in all reports Ability to add multiple interfaces across multiple routers, switches, or firewalls to single report Filter on any field exported (e.g. Mac address, vlan, latency, etc.) in the templates Easily identify top appplications on the network across numerous network devices Mpls reporting by subnets Report and trend on Microsoft Exchange logs Saves all the records, all the flows, all the time for as long as necessary including indefinitely Create reports based upon top countries, domains or subnets Dell SonicWALL specific reporting templates (applications, web sites visited, VoIP traffic, VPN traffic, etc.) Customizable billing solutions for over usage and invoicing Cisco Application Visibility and Control (AVC) and Performance Routing (PfR) reports Cisco ASA Access Control List (ACL) descriptions and filtering Alerting Alarm on saved filters, high interface activity, unfinished flows and nefarious activities Any saved report in Scrutinizer can be configured with a threshold to trigger an alarm Unique index per alarm (tells how many other alarms the host has violated) Facilitation of Automatic Remediation Offers administrators the ability to proactively monitor QoS and become automatically alerted of degraded voice/video traffic Troubleshooting Excellent troubleshooting tool for helping administrators identify slowness on the network Latency/jitter analysis on nprobe only Search for specific hosts or ports Capacity planning tool for system admins to determine usage during peak hours Host flows (volume of flows per host or volume of unique hosts) Pair volume (volume of unique to/from address pairs) Leverages ipfix statistics to provide greater insight into VoIP metrics (codec, caller id, duration, originator, destination, etc.) Security Configurable time frame for DNS caching Filter for Host to Host and Subnet to Subnet Ability to filter traffic based upon TCP flag Keeps track of the Flow Sequence Number, trends results and indicates problems Threat Heat Map graphical representation of the most frequent policy violations and unique violators Alert and Detection of banned applications (e.g. BitTorrent P2P, FTP, YouTube, Facebook, Skype, etc.) Alert and Detection of malicious traffic (e.g. worms, viruses), known compromised internet hosts, illegal IP addresses, excessive Multicast traffic, HTTP hijacking, DNS Cache poisoning, Rogue DHCP servers, DDoS attacks, etc. Alert and detection of Scanning: SYN, NULL, FIN, XMAS etc Administration Customizable MyView dashboards per login Group based user permissions Configure permissions per login account for access to flows for specific router, switch, firewall interfaces Multi-Tenancy Module Style sheets easily modified with several defaults to change the colors, fonts, and logos to Multi-Tenancy match the Service Providers marketing efforts Module Supported protocols and other technical specifications Customize interface names and overwrite default SNMP ifalias name Customize interface speed, both in and out, with different values Identify interface names using NetFlow or SNMP Integration with any 3rd party NMS solutions LDAP support Microsoft AD username mapping to IP address Listen for flows on unlimited UDP ports Support for IPv6 Support for NetFlow v1, v5, v6, v7, v9, jflow, sflow (v2, v4, v5), SNMP(v1, v2, v3) and IPFIX Filter for Nexthop Support for FnF NBAR and IPFIX performing deep packet inspection to identify Layer 7 application traffic DNS resolution becomes automated and a constant process Dell SonicWALL 2001 Logic Drive, San Jose, CA 95124 www.sonicwall.com T +1 408.745.9600 F +1 408.745.9300 Windows appliance Minimum specifications (for trial installations) RAM: 4GB Disks: 50GB HDD (IDE or SATA) Processor: Dual Core 2GHz+ Operating system: Windows 7/8, Windows Server 2008/2012 Recommended specifications (for production environments) RAM: 8GB Disks: 1+ TB 15k SCSI in a RAID 0 or Processor: Quad Core 2GHz+ Operating system: Windows Server 2008 and 2012 Virtual appliance Minimum specifications (for trial installations) RAM: 16GB Disks: 1 TB 15k SCSI in a RAID 0 or Processor: Quad Core 2GHz+ VMware: ESX(i) 4.x / 5.x Recommended specifications (for production environments) RAM: 64GB+ Disks: 1+ TB 15k SCSI in a RAID 0 or Processor: 2 x Quad Core 2GHz+ VMware: ESX(i) 4.x / 5.x Dell SonicWALL Scrutinizer with Flow Analytics Module 5 Nodes 01-SSC-4002 (physical) 01-SSC-3443 (virtual) 25 Nodes 01-SSC-4003 (physical) 01-SSC-3765 (virtual) 50 Nodes 01-SSC-0335 (physical) 01-SSC-3766 (virtual) 100 Nodes 01-SSC-0336 (physical) 01-SSC-3767 (virtual) 150 Nodes 01-SSC-0337 (physical) 01-SSC-3768 (virtual) 250 Nodes 01-SSC-2906 (physical) 01-SSC-3769 (virtual) 500 Nodes 01-SSC-2907 (physical) 01-SSC-3770 (virtual) 1,000 Nodes 01-SSC-3771 (virtual) 2,500 Nodes 01-SSC-3772 (virtual) Add-on modules 5 Nodes 01-SSC-3773 25 Nodes 01-SSC-3774 50 Nodes 01-SSC-3775 100 Nodes 01-SSC-3776 150 Nodes 01-SSC-3777 250 Nodes 01-SSC-3778 500 Nodes 01-SSC-3779 1,000 Nodes 01-SSC-3780 2,500 Nodes 01-SSC-3781 Multi-Tenancy Module Software License 5 Nodes 01-SSC-3782 25 Nodes 01-SSC-3783 50 Nodes 01-SSC-3784 100 Nodes 01-SSC-3785 150 Nodes 01-SSC-3786 Note: For node upgrade options and support SKUs, please visit www.sonicwall.com Dell Software 5 Polaris Way, Aliso Viejo, CA 92656 www.dell.com If you are located outside North America, you can find local office information on our Web site. 2013 Dell, Inc. ALL RIGHTS RESERVED. Dell, Dell Software, SonicWALL, the Dell Software logo and products as identified in this document are registered trademarks of Dell, Inc. in the U.S.A. and/or other countries. All other trademarks and registered trademarks are property of their respective owners. 09/13 DS 0545