Scrutinizer NetFlow Analyser :
Architecture
Collect D
Confirm Scrutinizer's findings with raw data Scrutinizer's debug console provides real time insight into the conversations coming into the NetFlow collector.
To run it, stop the Scrutinizer NetFlow Collector service and bring up a command prompt. From the ~/SCRUTINIZER/html directory, type in "collectd".
Watch live NetFlow conversations as they come in from the routers. The above can be very helpful when trying to understand the nature of some attacks.
Drag & Drill
Simplicity is the core of Scrutinizer's navigation. Scrutinizer includes Drag & Drill technology empowering the user to drag the mouse over a time sample, release and view a closer look at the top talkers and applications of a specific time frame.
Customer User Interface
Change the look and feel of Scrutinizer Scrutinizer uses CSS style sheets to determine its overall appearance. Altering Scrutinizer's global CSS file allows you to change colors and fonts based on your own preferences. Companies can change Scrutinizer to match their own applications or company colors for more continuity.
Flog & Capture
Capture conversation data per host. Alarm Conditions trigger FLOGs, which results in the capture of every conversation that host is having until the file size threshold is met (e.g. 1 megabyte).
FLOGs can be generated on abnormal traffic patterns from:
- Hosts
- Applications
FLOGs can tell you:
- Who the host was conversing with at the time of the anomally
- What protocol/application was being used in the transaction
- How many systems the host was conversing with
- How many protocols/applications the host was using
- The amount of data transmitted in the conversation
- Hosts using a specific application at the time of the anomally
- Identify patterns in the conversations that will lend clues to viruses and certain attacks.
An email alert, SNMP trap, Syslog or other notification can also be sent to alert administrators of unusual traffic patterns.
Search & Find
Search for specific hosts or protocols. Select any device sending NetFlow or sflow and search by host or protocol. The results are displayed in easy to understand format. Drag and drill in on the selected time frame. Ingress interface Click on the conversation icon and identify the interface the host comes in on!
Vital Signs
Does your server meet system requirements? View the health of Scrutinizer when you have questions on whether or not the hardware can handle the amount of flows being transmitted to it.