Bringing Flow to New Places

At EMA, we’ve been pushing application awareness as the path to service-savvy enlightenment for network engineering and operations professionals. And yet, one of the big challenges is finding application activity details from the less well-outfitted corners of your domain. That might have just gotten a little easier.

Last week, PacketTrap announced ptFlow, and what it represents is a means to get application-aware visibility in places where there are no xFlow-capable (i.e. NetFlow, sFlow, JFlow) devices. The idea is pretty straightforward – they created a software module to look at a stream of packets, pick out the relevant details, and construct and publish flow records. ptFlow is in NetFlow v5 format, and while PacketTrap certainly takes full advantage of this within the Network Traffic Analysis module of their Perspective performance management platform, it’s not unreasonable to think ptFlow could be forwarded to other tools that work off of NetFlow streams, whether that be performance reporting, usage-based billing, or security monitoring.

Deployment appears relatively simple and cost is low – much less than alternatives like upgrading or replacing existing gear to flow-capable versions, or deploying something that produces flow records as a byproduct of other functionality, such as a WAN optimization controller. It gets even more interesting when you consider virtual systems. When you deploy their software within a VM, you can see all of the traffic to and from that VM. When you install outside of the VMs, you can see traffic across each and every VM on that physical server – even VM-to-VM flows that never exit the physical box. This could be a big bonus for operations teams that are responsible for watching both network and server infrastructure.

What do you think? Would this help you better cover your environment? Are there other ways of getting flow records from legacy gear, or flow records from VMs?

• Network Management
• Application Performance Management
• NetFlow
• NetFlow Reporting Tools
• PacketTrap
• visibility