1

We have a Logrhythm freemium network monitoring solution depending on port mirroring using span ports on switches to receive all traffic and analyze it. But I cannot understand the output.

If I am monitoring, for example, user A usage of YouTube, user A opens YouTube for 30 minutes, When I filter on user A and application YouTube I see around 20 flows each with duration less than 5 minutes, so I cannot figure from the output the total number of minutes spent on YouTube.

I need to know the definition for flow and why 20 flows appear for only one session. Also, for each flow I see a flag which indicates the flow completed or not, so I see 10 flows completed and others not completed. What is the meaning of flow completed or not ?

Improve this question
1
  • 1
    Netflow is the wrong tool to monitor usage. A user can spend lots of time reading a page/looking at an image without generating flows. If I'm watching a video or just reading comments, I'm still "using" YouTube. But in the latter case, I'm not generating flows. – Ron Trunk Feb 16 at 20:23
1

An HTTP client often uses multiple socket connections (=flows) to fetch a full HTML page. Youtube might also do some complex buffering for the videos. It's not streaming real-time but fetches chunks in the background while playing - you can watch that in your browser's network inspector. Depending on the flow sampling, it can look pretty weird on a switch. The specifics largely depend on the application which I'm afraid is off-topic here.

If you need better control/monitoring of what your users do on the Internet you should run the analysis on the firewall. Next-generation firewalls can provide pretty exact control through policies on a very granular level.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.