Skip to main content

Trisul with NetFlow

Applies to

NetFlow mode.

This section explains how to set up Trisul in NetFlow mode. In this mode, Trisul uses NetFlow and other flow telemetry, instead of raw packets, to drive its analytics engine. It describes how to configure NetFlow mode, how to analyze traffic from a Device perspective, and how to use advanced features such as “Interface Tracking”.

Key Features of Trisul Netflow​

Trisul supports Netflow v1, v5, and Netflow v9, Flexible Netflow, and all versions of SFLOW, and IPFIX. All routers and interfaces are auto discovered.

Bandwidth and Traffic MonitoringFlow Analytics for incident responseSecurity and Anomaly Detection
  • Monitor bandwidth usage
  • Device and interface drilldown Over 200 Metrics
  • TopN BottomN NO ROLL UPS
  • Full resolution metrics
  • LIVE Real Time views
  • Alerting
  • Long term interface drilldowns
  • Store ALL flows
  • No rollups or loss of info
  • Drilldown flows from interfaces
  • Flow Query
  • Graph Analytics for Flows
  • Enrich with Flow Taggers
  • Long timeframe Top-K flows
  • Detect Exfil and Long Sessions
  • Threat monitoring
  • Threshold Band
  • Detect anomalies in metrics
  • Identify compromised hosts
  • Query IP spaces
  • Over 20 Retro Analysis tools
  • Complement Packet based Trisul
  • TRAI ISP Compliance

Introduction to Netflow for Trisul​

NetFlow is a cost-effective way to acquire network data from a large number of network elements. For maximum visibility, we recommend you enable Netflow all over your network and send the logs to a Trisul context.

The following diagram shows an example deployment.

Figure: Configuration of routers/switches to send Netflow (JFLOW,IPFIX,SFlow,etc) to Trisul-Probe

Advantages of Netflow vs Packet Capture​

Trisul’s default input mode is raw packet capture. Trisul also supports NetFlow v5/v9/JFlow/IPFIX/and SFlow metering.

Advantages of netflow inputDisadvantages
Easier distributed deploymentNo packet based traffic metering like DNS, HTTP, SSL analysis,etc
Less expensive hardwareLimited security visibility
Scales far better than packetsCannot access packets for forensics or malware analysis

Tip: You can use packet capture mode to do full NSM (Network Security Monitoring) at the perimeter, and NetFlow to gain visibility into lateral traffic inside your network.

Global vs Device View​

This may be confusing for those coming to Trisul from traditional netflow solutions. Most of the Trisul dashboards are Global views that represent the sum total of all the interfaces in your network. If you see metrics for 8.8.8.8 it represents the TOTAL traffic to 8.8.8.8 from all the routers in your network.

Trisul also has a Device View. You access that through the Routers and Interfaces tool. The Device View allows you to select a router then an interface on that router and then see the breakup of traffic within that.

If you log on for the first time into a Netflow instance you may get a dashboard like below. The image below shows where to find the Router and Interfaces for getting to the Device Specific view.

Figure: Global vs Device View

The following docs contain further instructions to setup Netflow

  1. Setup Netflow— How to switch Trisul into a Netflow mode
  2. Netflow Configuration Wizard— Using the NetFlow Config Wizard to customize, use SNMP to resolve, set up Email alerts, etc.
  3. Routers and Interfaces— The Device Drilldown tool that allows you to select a router, view interfaces, drilldown into an interface
  4. Using Interface Tracking— Enabling Interface Tracking, a feature that allows long term accurate analysis of Hosts, Apps, Protocols into and out of an interface
  5. Interface Drilldown— Using the Interface Drilldown Screen
  6. Netflow Sources Dashboard— The netflow sources dashboard
  7. Using SNMP— Using SNMP to complement NetFlow device views
In this page: