15. 02. 2016 Tobias Goller Log-SIEM, NetEye

Easy NetFlow Analysis using Kibana4 on NetEye

Kibana4 dasboards in NetEye

On NetEye we are using NfSen for the collection, analysis and view of NetFlow data.

Unfortunately, many users complain, that the NfSen tool is not that simple to use, especially in terms of fast data analysis and for the reporting of the analysis results to their responsibles.

NfSen is able to provide many possibilities to analyze NetFlow data, but if you need an easy standard view for the most important data flow scenarios, it is maybe better to use Kibana4 for visualizing this data.

Kibana4 is integrated to NetEye 3.6. Thanks to the use of Logstash and Elasticsearch it is possible to gather the NetFlow data for creating clear Kibana4 dashboards.

On the following four images you can see four visualization examples for NetFlow data on Kibana4. Obviously, you can easily filter this information for a time period, which can be individually selected from the GUI.

top 10 source ports - which are creating the most traffic

Here you can see the top 10 source ports, which are creating the most traffic.

Top 10 destination ports which are creating the most traffic

Here you can see the top 10 destination ports, which are creating the most traffic.

Top 10 source IP’s - which are creating the most traffic

Here you can see the top 10 source IP’s, which are creating the most traffic

Top 10 destination IP’s - which are creating the most traffic

Here you can see the top 10 destination IP’s, which are creating the most traffic.

Tobias Goller

Tobias Goller

NetEye Solution Architect at Würth Phoenix
I started my professional career as a system administrator. Over the years, my area of responsibility changed from administrative work to the architectural planning of systems. During my activities at Würth Phoenix, the focus of my area of responsibility changed to the installation and consulting of the IT system management solution WÜRTHPHOENIX NetEye. In the meantime, I take care of the implementation and planning of customer projects in the area of our unified monitoring solution.

Author

Tobias Goller

I started my professional career as a system administrator. Over the years, my area of responsibility changed from administrative work to the architectural planning of systems. During my activities at Würth Phoenix, the focus of my area of responsibility changed to the installation and consulting of the IT system management solution WÜRTHPHOENIX NetEye. In the meantime, I take care of the implementation and planning of customer projects in the area of our unified monitoring solution.

Leave a Reply

Your email address will not be published. Required fields are marked *

Archive