NBAR & Flow
Last updated
Was this helpful?
Last updated
Was this helpful?
Feature comparison of NBAR (a Cisco Application recognition utility) and Flow (a standards based analysis of data conversations) on the Details page.
A more detailed description of Flow can be found on the page.
indicates the Traffic Analysis is Flow based(no Flow in heading) indicates the Traffic Analysis is NBAR based
Options for Flow are explained in
Options for NBAR - for day view only
1 Hour: Show the graphs in hourly intervals (default)
30 Minutes: Show the graphs in half-hourly intervals, this will reset to default (1 hour) when you next log in
Today only
Colour coding applies to all sections on the Details page except Traffic Trend and Traffic Analysis (Flow and NBAR). There are no targets for Traffic Analysis data and thus it does not impact any heat tile colours. The indicator will always be green for today.
Highlight supports bi-directional application visibility in one of two ways: via NBAR (Network-Based Application Recognition - Cisco only) or by Flow data (IPFIX, Cisco NetFlow v5 or v9, or Juniper J-Flow). These two technologies offer different pros and cons and these should be considered when selecting which application analysis tool to use.
Find out more about
Highlight Flow uses distributed agents (collectors) which receive Flow data directly from network devices, store and aggregate the raw data locally, compress it, and send this reduced data stream to the core Highlight platform. By distributing both storage and compression, Highlight Flow can remain accurate but also very scalable. Normally a single agent is placed within an enterprise network, although organisations can deploy multiple agents at strategic locations within large networks or where flow traffic must be kept to an absolute minimum.
The flow collector receives flow data from the customer routers via UDP port 9996 and once processed, posts this data every hour to Highlight, encrypted via HTTPS.
NBAR does not have a Hosts option, but note the greater granularity of applications. On a day view, you can switch between hourly and 30 minute intervals.
Refer to the page for a full explanation of the Flow Details page.
The flow collector agent can run on a physical or virtual server and the server specification required can be found here: . The minimum specification flow collector is capable of processing flow data from 20 flow sources. The flow collector software is free from Highlight but there may be Highlight licence considerations. for any questions regarding Flow.
Note the option to select Applications or Hosts in the side bar. Refer to the page for more details.
To set up a router for Flow, refer to the page.
Cisco routers can be configured to identify the ‘Unknown’ traffic. See the Highlight Support document for details on