Network Flow Analysis

FlowScan and CUFlow

Although the text-based flow reports demonstrated in Chapter 5 are clearly useful, even nontechnical people easily understand visual representations of traffic. Chapter 7 and Chapter 8 demonstrate graphing arbitrary data, but much of the time graphing nonarbitrary data is sufficient. Every network administrator already has a pretty good idea of what constitutes the most common traffic on their network. For example, if you run a web farm, you probably care more about HTTP and HTTPS traffic than you do that of other services. If you manage an office network, you might care a lot about CIFS and printer traffic. Much of the time you can get adequate results by graphing the stuff you know about and lumping what you don't know about ...