Lead Image © Sergii_Figurnyi, 123RF.com

Improved visibility on the network

Fishing in the Flow

Article from ADMIN 77/2023

By Christian Pape , By Ronny Trommer

OpenNMS collects and visualizes flows so you can discover which network devices communicate with each other and the volume of data transferred.

Administrators monitor key network connections to detect issues (e.g., congestion) at an early stage. The Simple Network Management Protocol (SNMP) is often used for this purpose to query the metrics of the network interfaces. The measured values can be visualized as time series diagrams, and the user can define threshold values that trigger notifications if exceeded.

What happens, though, when the admin is notified? A quick look at the time series chart reveals that the network connection is busy, but this doesn't tell you which conversations and which applications are using the connection. Information from flows can fill this gap. Today, many network devices let you export this kind of information, but the opportunity often remains unused.

In this article, we look into the use of OpenNMS Horizon and monitoring with SNMP to visualize the make-up of network traffic with flow protocols. Given appropriate visualization in Grafana and unrestricted access to the flow data by Elasticsearch, OpenNMS Horizon can support administrators in their troubleshooting, capacity planning, and security tasks.

What Are Flows?

Flows are not essentially related to a connection on the transport layer, but to a set of Internet Protocol (IP) packets with similar characteristics that pass through a measurement point within a defined period of time [1]. As shown in Figure 1, these properties include the IP source and target addresses, the ports, and the transport protocol.

...

Use Express-Checkout link below to read the full article (PDF).