CA Network Flow Analysis Flow Detailed Consumption

[Allan Salas]

Hi All,

 

Is there any way to NFA shows the interface consumption detailing the url accessed or the type of traffic transferred (executables, videos, music) by user or IP Address? Currently only shows consumption by protocol or TOS.

 

Thanks in advance!

Regards,

[Allan Salas]

Hi,

 

Anyone knows if this is possible?

 

Thanks!

Regards,

[Robert Kettles]

First, we have to look at what is in a flow record that comes from the device:

 

A flow is defined based on 7 or more criteria:

     •  Source IP Address

     •  Source Port

     •  Destination IP Address

     •  Destination Port

     •  IP Protocol Type (TCP=6, UDP=17)

     •  ToS Byte (DSCP)

     •  Logical Interface (ifIndex)

 

That's the data that NFA is typically limited to since that is what is being sent from the device.  If you have Cisco devices that support AVC, then you can get additional visibility into URLs, application response time, and more.  You can learn more about AVC here:  AVC:AVC Tech Overview - DocWiki.  NFA added support for AVC in 9.2 and additional features have been added in subsequent releases but ultimately, NFA will be limited to what information is captures by the devices sending flow records.  Hope that helps.

 

-Rob

[Christopher Walsh]

Cisco AVC/NBAR2 would be the only way to get this information as Rob stated.

 

The NFA 9.3.0 Admin Guide covers some information about NBAR2

https://support.ca.com/cadocs/0/CA%20Network%20Flow%20Analysis%209%203%200-ENU/Bookshelf_Files/PDF/NFA_Administrator_Guide_en_US.pdf

 

Also we have a couple Tech Tips about NBAR2 Applications below:

Tech Tip: How to import the NBAR2 Application Definitions into NFA

Tech Tip: How to verify NBAR2 Application data for NFA 9.2 using Wireshark

[Allan Salas]

Hi Christopher, Robert,

 

Thanks to both for your help! I will review this docs and let you know the results.

 

Thanks again!

Regards!