WhatsUp Gold Flow Publisher Plugin

With WhatsUp Gold Flow Publisher, you can get unique insight and visibility into your network traffic for every device – whether they natively support flow monitoring or not.

In short, Flow Publisher makes flow monitoring possible for every network segment and for literally every device. By capturing raw traffic from the network and converting it into standard NetFlow records, Flow Publisher puts you in complete control and conversing in a language your users understand.

With Flow Publisher you can:

• Turn on network traffic analysis for every device and every network segment
• Determine which users, applications or traffic sources are consuming bandwidth
• Require no costly upgrade of your devices to turn on application flow visibility
• Get alerted in real-time when monitored traffic parameters breach targeted thresholds
• Ensure business applications get the bandwidth they need
• Access over 40+ web and mobile reports for base-lining and analysis

Flow Publisher's unique ability to capture and process raw traffic information from non-flow enabled devices or host systems, combined with the powerful analysis capabilities of Flow Monitor deliver the following features:

Flow Publisher Basics

• Simple, software only solution that can be deployed on any current Windows operating system
• Capture of raw traffic flows from any of the following:
  • Port mirroring  (SPAN or RAP)
  • Network Test Access Points (TAP)
  • Directly on Windows server platforms
• Creates NetFlow v1, v5 or v9 compliant records from raw traffic
• Maps device MAC addresses to reported interfaces
• Provides options to log flows and commands
• ACL’s for access to administration and configuration
• Flow Publisher Management Console:

• Configuration and management of single or multiple agents
• Interface(s) from which to capture network traffic
• Mode and status for each interface in the probe (promiscuous or normal)
• Collector IP address to forward NetFlow records
• NetFlow version of flow data to send to a collector
• Local IP and port of the probe to forward flow records
• Active and Inactive timeout for flow record management
• SNMP index for the default input/output reported interface MAC Addresses to Interface indices mapping

Traffic Analysis and Monitoring / Troubleshooting Capabilities (in conjunction with Flow Monitor)

• Automatic classification of traffic by type and protocol in real-time
• Real-time identification of traffic flow patterns through the network
• Identification of traffic sources (top talkers) and destinations
• Identification of traffic destination by group, domain, top level domain (TLD), and country
• Pinpointing of internal and external traffic sources and destinations
• Conducting traffic identification and analysis for Quality of Service using ToS or DSCP
• Grouping of flow data based on common parameters, including IP addresses by domain, TLD or country
• Automatic identification of high traffic flows to un-monitored ports and highlighting of those ports as candidates for monitoring
• Uncovers unauthorized applications, including file and music sharing
• Detection of failed connections

Reporting (in conjunction with Flow Monitor)

• Access to over 40 flow management reports via WhatsUp Gold web and mobile access
• Automated rollup of flow data with hourly, daily, weekly, monthly and yearly views
• Displays flow information in custom formats
• Sorts and displays filtered reports by protocol, application, host, domain, TLD, country, groups or type of service
• Integration of flow reports with WhatsUp Gold workspace reports
• Access to WHOIS information for sender and receiver reports
• Display traffic information by bytes, packets or flows

Configuration and Management (in conjunction with Flow Monitor)

• Configuration of thresholds on multiple flow metrics via the Alert Center
• Configuration and management of flow data retention policies
• Configuration of flow logging levels
• Configurable support for non-standard ports and proprietary protocols
• Starting and stopping of flow services
• Setting of address resolution levels
• Access to flow database and service status, providing instant views of database parameters and running flow services
• Backup and restoration of flow database
• Apply custom names to flow interfaces
• Notification of database status

Key Capabilities of WhatsUp Gold Flow Publisher include:

Uses Flow Monitor plug-in for advanced reporting and alerting

WhatsUp Gold Flow Publisher acts as a network traffic flow information source for Flow Monitor and forwards processed NetFlow records to it. Flow Monitor acts as a standard collector, as it does for other flow-enabled devices, and provides a comprehensive picture of application flows across the entire network in one screen. All of Flow Monitor’s powerful reporting, configurable thresholds, analysis and alerting capabilities are also available to Flow Publisher records - ensuring centralized management of application, host and user traffic.

Works with any existing network devices and your Windows servers

Since Flow Publisher captures and processes raw network traffic from any mirrored switch port, or network TAP (Test Access Point) or even a Windows host server – there is no requirement for changes or upgrades to existing device capabilities. While Flow Monitor can be used to directly receive flow records from NetFlow, sFlow or J-Flow enabled devices, Flow Publisher seamlessly extends coverage to any non-flow enabled device. With Flow Publisher in place, the entire network can be managed with the same level of visibility.

Develops standard format flow records that you can easily understand

Flow Publisher outputs NetFlow v1, v5 and v9 compliant records enabling operations staff to use existing knowledge, skills and best practices that your business may already have in place. With advanced analysis, real time alerting and historical trending available through Flow Monitor – network managers can identify top conversation pairs, top senders and receivers, failed connections per host and analyze breakdown of traffic from every monitored network interface on any device.

Delivers accurate visibility with full flow capture

Popular flow protocols like sFlow or J-Flow employ sampling techniques that reduce the granularity of visibility and insight that flow data can provide. For example, flow sampling may completely miss occasional network congestion instances caused by intermittent and unpredictable user actions or malicious virus activity. With Flow Publisher, the full extent of raw traffic is captured and processed into NetFlow compliant records – ensuring accurate and in-depth visibility into user, protocol, source and destination, and application activity on the network.

Supports simple, manageable and cost-effective deployment

Flow Publisher is a small footprint application that can be installed on most Windows systems, enabling cost-effective deployment. It can capture flows from remote network ports and from four ifferent traffic sources simultaneously. For servers, Flow Publisher is installed directly on the target system. Further, Flow Publisher supports configurable ACL’s (access control list) for administration and management.