What are key Cisco NetFlow limitations?

Q & A with Douglas Smith - President of network troubleshooting and analysis solutions vendor, Network Instruments.

By Brad Reese on Thu, 10/22/09 - 12:50am.

Earlier this month, network troubleshooting and analysis solutions vendor - Network Instruments, announced GigaStor NetFlow Agent, which according to Network Instruments:

"Allows engineers to utilize NetFlow data about any device in any environment. GigaStor captures and converts packets into NetFlow data flows, pushing it out to multiple destinations simultaneously. This is especially valuable for Network Behavior Anomaly Detection (NBAD) and compliance monitoring applications."

In the Q & A below, Douglas Smith - Cofounder and President of Network Instruments, discusses the key limitations of Cisco NetFlow as well as the benefits of his new GigaStor NetFlow Agent:

1. So what are key Cisco NetFlow limitations?

Douglas Smith:

There are several limitations that can prevent the use of NetFlow as a performance monitoring technology across an entire network. For companies using NetFlow-dependent reporting applications for NBAD, security, compliance or performance management, these limitations severely limit visibility to portions of the network.

Four examples of limitations that can prevent the use of NetFlow as a performance monitoring technology:

1) Non-NetFlow capable devices are blind to local traffic

Typically, you need higher-end Cisco routers and switches to produce NetFlow data. Other infrastructure vendors provide comparable flow technologies in their higher-end offerings but none are as widely implemented as Cisco NetFlow. In most cases, companies have either legacy or non-NetFlow capable infrastructure. With many reporting applications depending upon NetFlow for monitoring performance, compliance, or security, non-NetFlow capable devices create large blind spots on the network.

2) Devices only export two flows

Cisco NetFlow devices only allow you to export two flows to two NetFlow collectors. If a company has more than two reporting applications, decisions must be made that impact visibility and monitoring.

3) NetFlow overhead can overtax infrastructure

Sending NetFlow can add too much overhead to already over-taxed routers and switches. The risk of overloading infrastructure already spread too thin, stops engineers from enabling NetFlow on their network.

4) Visibility limited to routed traffic

NetFlow only shows routed traffic or packets. As a result, network engineers are blind to internal LAN and VLAN communications and activities.

2. What gave you the idea for creating NetFlow Agent?

Douglas Smith:

Some of our larger customers discussed NetFlow's limitations with us and were looking for a way to expand the visibility of their NetFlow-dependent reporting applications. There were several spots on their network where they either wouldn't enable NetFlow or had non-NetFlow capable routers and switches. While handling NetFlow isn't a core competency of the company, our developers have a deep understanding of networks developed over the last 15 years. For the last three to four years, we've been expanding the incorporation of NetFlow and other flow technologies into our performance management platform. Most important, this was a customer need that didn't have a real solution, and we could easily develop something to address it.

sFlow and NetFlow provides extended visibility, probe delivers detailed drill-down

3. What are the benefits of GigaStor NetFlow Agent?

Douglas Smith:

The GigaStor NetFlow Agent overcomes these issues by producing NetFlow data about any network device, including servers and non-NetFlow capable routers and switches. GigaStor captures and converts packets in NetFlow data flows, pushing them to reporting applications.

GigaStor NetFlow Agent Benefits

	Produce NetFlow about any device
	Expand visibility of NetFlow-dependent NBAD and compliance applications
	Push flow data to multiple reporting applications simultaneously