Active Flow Monitoring Applications
Flow monitoring can be used for many different reasons such as network planning, accounting, usage-based network billing, security, and monitoring for Denial-of-Service attacks.
Some examples of the types of things you can use flow monitoring for are:
Tracking what kind of traffic is entering or exiting an ISP or corporate network.
Tracking traffic flows between BGP autonomous systems.
Tracking traffic flows between enterprise network regions.
Taking a snapshot of the existing quality-of-service (QoS) policy results prior to making changes in QoS policy in case you need to roll back changes later in the process.
Verifying that load balancing techniques are performing as intended.
Capturing a base line of current network performance prior to making changes intended to improve performance so that you know if the changes are helping.
Discovering if network users at an enterprise are using bandwidth for work-related activities or for non work-related activities.
Examples of how flow monitoring helps with network administration include the following:
A large service provider uses active flow monitoring on its core uplinks as a way to collect data on the protocols in use, packet sizes, and flow durations to better understand the usage of its Internet service offering. This helps the provider understand where network growth is coming from.
Service providers bill customers for the data sent or bandwidth used by sending captured flow data to third-party billing software.
At a large enterprise, VoIP users at aremote site complained of poor voice quality. The flow monitoring reports showed that the VoIP traffic did not have the correct type of service settings.
Users on an enterprise network, reported network slowdowns. The flow monitoring reports showed that one user’s PC was generating a large portion of the network traffic. The PC was infected with malware.
A growing enterprise planned to deploy new business management software and needed to know what type of network bandwidth demand the new software would create. During the software trial period, flow monitoring reports were used to identify the expected increase in traffic.
Thus, while flow monitoring is traditionally associated with traffic analysis, it also has a role in accounting and security.
