O R G A N I C / F E R T I L I Z E R: 03.13

Mar 26, 2013

who is using your network? a netflow demo…

my friends at jalasoft sent me this little gem below. i’ve known about their product for a number of years. while i personally have never had the opportunity to use them, it’s impressive to see how much it has matured. if you’re using opsmgr 2012 and xian network manager, check out what you can do with netflow.


How to Know Who Is Using Your Network in Operations Manager

Jalasoft Inc.
March 2013

So you’re monitoring your network with Operations Manager 2012, but how do you know exactly who is actually using your network? How do you prevent misusage of your valuable network resources and internet access? In most cases, people are always most interested in finding out who is using the network. With Xian Network Manager 2012 this can be easily accomplished thanks to its built in NetFlow traffic analyzer. Below, we will explain how you can easily configure this feature if you have Xian NM 2012 installed.

 

 

1. Add a Netflow device

If you do not yet have a flow device available in Xian NM, you will need to add one. This is very easy. First, open the Xian Network Manager Console, next click on Device in the menu, select Flow and click.clip_image002[4]

In the Rule Wizard that appears on the screen, go directly to Parameters and click on the Add Button. Now fill in the name and the IP Address of the Netflow enabled device. Verify that the device is enabled and if it is sending the Netflow packets to the machine where Xian NM is installed.

Now you can click on OK and then on Finish. A default policy template is automatically added by default, you can opt to remove this option in the Policy Template Tab. Furthermore, below we will show you how to create your own filter and set up an appropriate rule.

 

 

2. Create the Netflow filter

Next we will create a simple filter that aggregates the Netflow records to local IP Addresses. This means that it will create objects that consist on the active local IP Addresses and their corresponding traffic. In order to accomplish this you go to the Filter Tab of the Flow Device Properties. Here you click on ‘Add ‘.

clip_image004

Figure 1, The parameters tab in the ‘Add filter wizard’

Under the parameters tab you provide a clear name and description. Then you click on Next.

clip_image006

Figure 2, The Aggregation tab in ‘Add filter wizard’

In the add filter wizard, you have to decide the criteria for aggregating our grouping up the Netflow records. For example, perhaps you would like to see the performance data grouped by Destination IP, Port, and Protocol etc. This is also important if you want to send out an alert if any counter goes over a threshold.

To be able to keep track of the incoming traffic, we suggest to group up data by destination IP. This is done in order to see the total traffic downloaded by each local IP address.

clip_image008

Figure 3, The Filter tab in ‘Add filter wizard’

To prevent unwanted data from being analyzed you can set up a selection under the ‘Filters’ tab, as shown in figure 3. For the Download by local IP Addresses, we are going to filter the source on only Public network IP addresses and the destination IP addresses on Private networks. Ports, protocols and ToS, will be set on all options to be able to capture all traffic.

Now click ‘Finish’ and the filter is set up. All that is missing is to enable to filter in a Rule.

 

 

3. Add the rule and define the threshold type

In order to have data arriving in Operations Manager you will need to set up a rule in Xian Network Manager. Within the rule settings you can define thresholds, intervals, severity and other settings. To start, go to the ‘Active rules’ tab in the device properties of your Netflow device. Next you add a rule. For our example we will pick the ‘bytes per second’ rule.

clip_image010

Figure 4, filter selection in the ‘Add rule wizard’

First you have to select the filter that you want to apply as a base for the rule in the ‘Filter’ tab. Here we will use the filter we just created to monitor the traffic going to local IP addresses.

clip_image012

Figure 5, setting up thresholds in the ‘Add rule wizard’

 

Thresholds

Now you need to decide which is the proper threshold for the rule. Since there are no elements discovered yet (this will occur once the rule is running) you cannot set up specific per element thresholds.

There are three types of thresholds; Manual, Automatic and Dynamic thresholds. If you opt for manual, you will need to personally setup the upper and lower threshold. An automatic threshold only requires you telling Xian how many points it will use to calculate a manual threshold. Finally the dynamic threshold gives you the option of being alerted when traffic has sudden big changes.

Since we don’t have a clear idea of the type of traffic, we are going to select the Automatic thresholds and set it to calculate the threshold in 24 data points.

Schedule

In this part you indicate how often you want the rule to be executed and send performance data and if needed, alerts, to Operations Manager. Note that an interval that is too low (under 5 minutes) might cause performance issues on Operations Manager or SQL Server.

clip_image014

Figure 6, Setting up Device Update in the ‘Add rule wizard’

Device Update

Lastly, you have to point out what needs to be done when new elements appear. This is important since it is possible that during the time the rule is running new elements (IP addresses) are discovered. In this case, we set Xian NM up to discover new elements through automatic threshold, but note this will only work during the period of calculation, after this the rule will apply default settings and a manual activation of the recalculation is needed.

clip_image016

Figure 7, Active rules tab in the Device properties of a Netflow device.

Now you can see the rule appearing in the Active Rule tab in the Device Properties window. First, it will be on calculating mode, this will last until a threshold has been calculated. However, performance data is already sent to Operations Manager.

 

 

4. Check all in Operations Manager

clip_image018

Figure 8, the Netflow dashboard in Operations Manager

If you go to Operations Manager you will be able to see all the performance data and alerts under the Xian Network Manager section. Additionally, you can create your own dashboards like the one shown above in Figure 8.

Also, you have the option to execute reports in the Reporting section and schedule them as you are used to with other Operations Manager report.

 

 

What else can you do?

This is just an example of how you can keep an eye on your environment’s network traffic, but you can probably imagine other scenarios. In a very similar way, you can analyze protocol traffic, active ports, visited websites, or even very specific ones like who is the top user of a specific SQL server.

Mar 22, 2013

free e-books on a variety of microsoft tech

if you’re looking to increase your learning and knowledge potential, here are some free books for you!

Lync

Microsoft Lync Server 2013 Step by Step for Anyone

Office

Deployment guide for Office 2013
First Look: Microsoft Office 2010
Microsoft Office 365: Connect and Collaborate Virtually Anywhere, Anytime
Microsoft Office 365 for professionals and small businesses: Help and How To
Security and Privacy for Microsoft Office 2010 Users

SharePoint

Explore SharePoint 2013
Deployment guide for SharePoint 2013
Create a Balanced Scorecard
Configure Kerberos Authentication for SharePoint 2010 Products
SharePoint Server for Business Intelligence
Get started with SharePoint Server 2010
Deployment guide for SharePoint Server 2010
Upgrading to SharePoint Server 2010
Profile synchronization guide for SharePoint Server 2010
Remote BLOB storage for Microsoft SharePoint Server 2010
Governance guide for Microsoft SharePoint Server 2010
Business continuity management for SharePoint Server 2010
Technical reference for Microsoft SharePoint Server 2010

SQL Server

5 Tips for a Smooth SSIS Upgrade to SQL Server 2012
A Hitchiker's Guide to Microsoft StreamInsight Queries
Books Online: Backup and Restore of SQL Server Databases
Books Online: Data Analysis Expressions (DAX) Reference
Books Online: Data Mining Extensions (DMX) Reference
Books Online: Data Quality Services
Books Online: High Availability Solutions
Books Online: Master Data Services
Books Online: Monitor and Tune for Performance
Books Online: Multidimensional Expressions (MDX) Reference
Books Online: SQL Server Distributed Replay
Books Online: Transact-SQL Data Definition Language (DDL) Reference
Books Online: Transact-SQL Data Manipulation Language (DML) Reference
Books Online: XQuery Language Reference
Extracting and Loading SharePoint Data in SQL Server Integration Services
Introducing Microsoft SQL Server 2008 R2
Introducing Microsoft SQL Server 2012
Master Data Services Capacity Guidelines
Microsoft SQL Server AlwaysOn Solutions Guide for High Availability and Disaster Recovery
Microsoft SQL Server Analysis Services Multidimensional Performance and Operations Guide
Optimized Bulk Loading of Data into Oracle
Planning Disaster Recovery for Microsoft SQL Server Reporting Services in SharePoint Integrated Mode
QuickStart: Learn DAX Basics in 30 Minutes
SQL Server 2012 Tutorials: Analysis Services - Data Mining
SQL Server 2012 Tutorials: Analysis Services - Multidimensional Modeling
SQL Server 2012 Tutorials: Analysis Services - Tabular Modeling
SQL Server 2012 Tutorials: Reporting Services
SQL Server 2012 Tutorials: Writing Transact-SQL Statements
SQL Server 2012 Upgrade Technical Guide
SQL Server Community FAQs Manual

Visual Studio

Moving to Microsoft Visual Studio 2010
Upgrade Team Foundation Server 2012: the ultimate upgrade guide

Web Development

Deploying an ASP.NET Web Application to a Hosting Provider using Visual Studio
Developing Modern Mobile Web Apps
The Entity Framework 4.0 and ASP.NET Web Forms – Getting Started
Getting Started with ASP.NET 4.5 Web Forms (Beta)
Getting Started with the Entity Framework 4.1 using ASP.NET MVC
Intro to ASP.NET MVC 4 with Visual Studio (Beta)
Introducing ASP.NET Web Pages 2
Project Silk: Client-Side Web Development for Modern Browsers

Windows

Deploying Windows 7: Essential Guidance
Programming Windows 8 Apps with HTML, CSS, and JavaScript

Windows Azure

Autoscaling Application Block and Transient Fault Handling Application Block Reference
Building Elastic and Resilient Cloud Applications - Developer's Guide to the Enterprise Library 5.0 Integration Pack for Windows Azure
Building Hybrid Applications in the Cloud on Windows Azure
Create Your First Application - Node.js and Windows Azure
Drupal on Windows Azure
Migrating Data-Centric Applications to Windows Azure
Moving Applications to the Cloud, 2nd Edition
Using Windows Azure Mobile Services to Cloud-Enable your iOS Apps
Using Windows Azure Mobile Services to Cloud-Enable Your Windows Phone 8 Apps
Using Windows Azure Mobile Services to Cloud-Enable your Windows Store Apps in C#
Using Windows Azure Mobile Services to Cloud-Enable Your Windows Store Apps in JavaScript
Windows Azure and SQL Database Tutorials
Windows Azure Prescriptive Guidance
Windows Azure Service Bus Reference

Windows Phone

Developing an Advanced Windows Phone 7.5 App that Connects to the Cloud
Programming Windows Phone 7

Windows Server

A Guide to Claims-Based Identity and Access Control, Second Edition
Introducing Windows Server 2008 R2
Introducing Windows Server 2012
Understanding Microsoft Virtualization Solutions: From the Desktop to the Datacenter, Second Edition