Data Collected

The NetProfiler collects data from multiple sources, including:

  • Riverbed Cascade Sensor

  • Riverbed Alluvio Flow Gateway (which collects NetFlow, SteelFlow Net, sFlow, IPFIX, and compatible Packeteer data sources)

  • Riverbed Alluvio NetShark

  • Riverbed Alluvio AppResponse

  • Microsoft Active Directory domain controllers (optionally)

Sensor

Using mirror ports on switches or passive taps on lines, Sensors provide the NetProfiler with statistics for the following network traffic characteristics:

  • Connections between hosts on the monitored segments of the network

  • Source and destination IP addresses and port numbers used in the connections

  • Ports and applications being accessed on hosts

  • Protocols

  • Traffic volumes in connections, bytes, or bits per second

The Sensor also provides the NetProfiler with application traffic information.

Flow Gateway

The Flow Gateway is deployed in a local or remote network to receive traffic data from NetFlow, SteelFlow Net, sFlow, IPFIX, or Packeteer FDR sources at that location. It aggregates the data, compresses it, encrypts it, and then transmits it to up to two NetProfiler systems. Additionally, it can forward this data in its native format to up to two other destinations.

NetShark

The NetShark sends the NetProfiler information about all the traffic it sees on the network. From within the NetProfiler user interface, you can access the NetShark and Packet Analyzer for detailed packet-level analysis.

AppResponse

The AppResponse sends the NetProfiler information about the traffic it sees on the network.

SteelHead

SteelHead sends SteelFlow Net to the NetProfiler by way of a Flow Gateway appliance.  SteelFlow Net from a SteelHead includes both traffic statistics and SteelHead Quality of Service configuration information. The NetProfiler uses the traffic information to report the traffic flows and WAN performance associated with the SteelHead appliances. It uses the SteelHead QoS configuration information to provide unified monitoring and reporting of the effectiveness of SteelHead QoS shaping policies deployed on SteelHead appliances across the network. more

Microsoft Active Directory domain controllers

The optional user identity feature relies on data obtained from the security event log of one of more Microsoft Active Directory domain controllers. This data can be sent directly to the NetProfiler or it can be read by a Windows intermediary host that sends it to the NetProfiler.

The NetProfiler interprets this data to track successful and failed login attempts by domain users on hosts within the domain. It associates this user identity information with host information to produce reports that identify users as well as hosts.

Integrating NetExpress with other products