Docs Home User Guide

Contents

Flow Analysis

Flow based analysis is a critical part of deep network monitoring. Trisul not only stores the flows in a highly efficient manner but provides you dozens of tools to work with them. Trisul enables flow analysis in packet capture mode as well as Netflow mode.

Highlights

You can do all of the following

  1. Record all flows, no summarization or roll ups
  2. Fast retrieval of flows
  3. Access to flows from alerts, traffic, end points
  4. Pull up PCAPs for any flow
  5. Flow Taggers – Tag flows automatically for future searches
  6. Flow Tracker – Track top flows that interest you
  7. Flow alerts – Get an alert when someone uploads 10MB out of your network
  8. Payload search – Reassemble TCP, HTTP and search inside flows

Related features

Flow Tracker

Tracks the top-N flows matching a certain criteria over a certain period of time.

Flow Tagger

Tags interesting flows based on observation of certain types of traffic.

Real Time Stabber

A stabber that enables you to monitor currently active flows involving a host or application.

Task list

  • Find out which flows caused a traffic spike
  • View flow activity of a host or port in real time
  • Jump from alerts to flows that caused them
  • Search flows for IP
  • Optimize full content storage (eg, store only first 1M of each flow)
view All tasks

Flows are a critical part of the emerging breed of monitor everything tools like Trisul. If you can isolate your concerns to a few flows, your network analysis task is almost done. Trisul helps you grapple with hundreds of millions of flows by including two flow processor tools called Flow Tracker and Flow Tagger These pick out interesting flows such as flows with most volume, duration, of a certain port range, or even to a certain country.

Meta Resources Logging certain types of metadata can greatly help you navigate flows and traffic. To this end Trisul logs all URLs from HTTP flows and all domain names from DNS packets.

Session Dashboard Sample

Key features at your command :

  • No roll ups → all flows, all alerts, all resources are stored – none deleted
  • Scales → Designed for huge flow volumes of 100M flows per day and running for months
  • Tools → Tools to work with flows included
  • Extract and search on all URLs requested
  • Extract and search all names found in DNS records
  • Netflow → Trisul constructs flows from raw packets or from Netflow