Current Filter: Network>>>>>>

   

The EndaceFlow appliances from Emulex relieve this burden by taking over NetFlow data generation. Supporting a range of NetFlow versions including v5, v9 and v10/IPFIX, they can operate with any type of collection and analysis application.

Our review subject is the new EndaceFlow 3040, Emulex's first dedicated NetFlow generation appliance. It's designed for high-speed networks and comes with four 10GbE ports, handling up to 30Gbits/sec of aggregated traffic. It also supports up to 64 million concurrent flows and can generate over 600,000 un-sampled NetFlow records per second. A single NetFlow collector may not be able to handle this amount of data but the 3040 offers load balancing so that businesses can run multiple collectors, allowing them to specifically direct NetFlow records for analysis.

Deployment in the lab was swift and the appliance only required a copy of all network traffic to be sent to it, in this case achieved using switch port mirroring. To further reduce overheads on the switch you could use a tap instead. For high volume network traffic generation we used the lab's Ixia XM2 chassis and its dual Xcellon-Ultra NP load modules, and for data collection and analysis we deployed SolarWind's NetFlow Traffic Analyzer software.

The 3040 runs Emulex's proprietary OS on top of a hardened Linux kernel. Management access is via a web browser and we started by creating a profile for our SolarWinds NetFlow collector which detailed its IP address and port number. Templates must be created for NetFlow v9 and IPFIX which defines the data fields you are interested in collecting. These range from source IP addresses and VLAN IDs to IP CoS and maximum TTL.

That's all that was required as the appliance was now monitoring all our live lab and Ixia created traffic and generating NetFlow data, which we directed to our SolarWinds collector. SolarWinds analysed the received data and displayed graphs and tables showing clearly all of the application traffic along with conversations and top endpoints.

The 3040 handles high traffic loads using Emulex's DAG (data acquisition and generation) hardware. The DAG is a card in the appliance providing high performance data capture, allowing it to operate at wire speed without data loss. The base Linux OS has a built-in hypervisor and the Emulex software runs as a virtual machine. This has its own web interface, making visible the appliance health and traffic loads, and multiple appliances can be managed using the same interface.

The appliance classes each physical network interface as a metering point. These are valuable where different network segments are being monitored as you can pass traffic from each meter to separate collectors for further analysis. Load balancing is simple to configure by using filters to control where the NetFlow data is sent. For multiple collectors you can define percentages of data that are to be sent to each one, or go further and use filters based on IP addresses, source and destination ports and so on. Alternatively, you can use filter matches to send traffic for specific systems such as web servers to a particular collector.

The EndaceFlow 3040 improves enterprise network performance and monitoring by offloading NetFlow data generation from critical devices. It's clearly capable of handling very high traffic loads and during testing we found it remarkably easy to deploy and manage.

Product: EndaceFlow 3040
Supplier: Emulex Corporation
Tel: 0118 977 2929
Web site: www.emulex.com