Since no two environments are identical and no network remains stagnant in Network Monitoring today, the only thing we can expect is the unexpected!
The network has become a living dynamic and complex environment that requires a flexible approach to monitor and analyze. Network and Security teams are under pressure to go beyond simple monitoring techniques to quickly identify the root causes of issues, de-risk hidden threats and to monitor network-connected things.
A solution’s flexibility refers to not only its interface but also the overall design.
From a user interface perspective, flexibility refers to the ability to perform analysis on any combination of data fields with multiple options to view, sort, cut and count the analysis.
From a deployment perspective, flexibility means options for deployment on Linux or Windows environments and the ability to digest all traffic or scale collection with tuning techniques that don’t fully obfuscate the data.
Acquiring flexible tools are a superb investment as they enrich and facilitate local knowledge retention. They enable multiple network centric teams to benefit from a shared toolset and the business begins to leverage the power of big data analytics that, over time, grows and extends beyond the tool’s original requirements as new information becomes visible.
What makes a Network Management System (NMS) truly scalable is its ability to analyze all the far reaches of the enterprise using a single interface with all layers of complexity to the data abstracted.
NetFlow, sFlow, IPFIX and their variants are all about abstracting routers, switches, firewalls or taps from multiple vendors into a single searchable network intelligence.
It is critical to ensure that abstraction layers are independently scalable to enable efficient collection and be sufficiently flexible to enable multiple deployment architectures to provide low-impact, cost-effective solutions that are simple to deploy and manage.
To simplify deployment and management it has to work out the box and be self-configuring and self-healing. Many flow monitoring systems require a lot of time to configure or maintain making them expensive to deploy and hard to use.
A flow-based NMS needs to meet various alerting, analytics, and architectural deployment demands. It needs to adapt to rapid change, pressure on enterprise infrastructure and possess the agility needed to adapt at short notice.
Agility in provisioning services, rectifying issues, customizing and delivering alerts and reports and facilitating template creation, early threat detection and effective risk mitigation, all assist in propelling the business forward and are the hallmarks of a flexible network management methodology.
Here are some examples that require a flexible approach to network monitoring:
- DDoS attack behavior changes randomly
- Analyze Interface usage by Device by Datacenter by Region
- A new unknown social networking application suddenly becomes popular
- Compliance drives need to discover Insider threats and data leakages occurring under the radar
- Companies grow and move offices and functions
- Laws change requiring data retention suitable for legal compliance
- New processes create new unplanned pressures
- New applications cause unexpected data surges
- A vetted application creates unanticipated denials of service
- Systems and services become infected with new kinds of malicious agents
- Virtualization demands abruptly increase
- Services and resources require a bit tax or 95th percentile billing model
- Analyzing flexible NetFlow fields supported by different device vendors such as IPv6, MPLS, MAC, BGP, VPN, NAT paths, DNS, URL, Latency etc.
- Internet of Things (IoT) become part of the network ecosystem and require ongoing visibility to manage