Flow Analytics (FA) Company wide monitoring and aggregated reporting across all routers/ switches.
- Archiving of Scrutinizer Database beyond 24 hours (i.e. infinite years of data can be saved at selectable intervals). The free version of Scrutinizer drops all data at midnight. Even raw flows can be saved forever (i.e. all the flows, all the records, all the time)
- Top Applications, Conversations, Flows, Protocols, Domains, Countries, Subnets, etc. across dozens of routers and switches. The user interface allows administrators to pick which exporters tables the algorithms query.
- Any saved report in Scrutinizer can be configured with a threshold to trigger an alarm. E.g. want to monitor an application for a certain ToS, within a class A subnet, etc. FA can do it.
- DNS resolution becomes automated and a constant process.
- Reporting and alarming on internal network SYN, NULL, FIN, XMAS Scans, RST/ACK worms, P2P, ICMP Unreachable, illegal IP addresses, excessive Multicast traffic, known compromised internet hosts, DDoS attacks and more. Repeat offenders build a Unique Index (UI) within the alarms tab as well as a count. The UI is important for tracking repeat offenders. It also help locate machines involved with DoS attacks or infected with viruses.
- Several additional report types:
- Applications NBAR: (requires IOS v15 on Cisco routers)
- Conversations App: Displays to/from host pairs and application used.
- Conversations NBAR: (requires IOS v15 on Cisco routers)
- Flows: Connections report with ToS field.
- Host Flows: Hosts sending the most flows.
- Host Volume: Volume of unique hosts per second.
- Pair Volume: Volume of unique to/from address pairs per second.