Network Flow Analysis
by Michael W. Lucas

June 2010, 224 pp.
ISBN: 978-1-59327-203-6
Contents | Reviews | Updates

You know that servers have log files and performance measuring tools and that traditional network devices have LEDs that blink when a port does something. You may have tools that tell you how busy an interface is, but mostly a network device is a black box. Network Flow Analysis opens that black box, demonstrating how to use industry-standard software and your existing hardware to assess, analyze, and debug your network.

Unlike packet sniffers that require you to reproduce network problems in order to analyze them, flow analysis lets you turn back time as you analyze your network. You'll learn how to use open source software to build a flow-based network awareness system and how to use network analysis and auditing to address problems and improve network reliability. You'll also learn how to use a flow analysis system; collect flow records; view, filter, and report flows; present flow records graphically; and use flow records to proactively improve your network. Network Flow Analysis will show you how to:

  • Identify network, server, router, and firewall problems before they become critical
  • Find defective and misconfigured software
  • Quickly find virus-spewing machines, even if they’re on a different continent
  • Determine whether your problem stems from the network or a server
  • Automatically graph the most useful data

And much more. Stop asking your users to reproduce problems. Network Flow Analysis gives you the tools and real-world examples you need to effectively analyze your network flow data. Now you can determine what the network problem is long before your customers report it, and you can make that silly phone stop ringing.

About the Author

Michael W. Lucas is a network/security engineer who keeps getting stuck with network problems nobody else wants to touch. He is the author of the critically acclaimed Absolute FreeBSD, Absolute OpenBSD, Cisco Routers for the Desperate, and PGP & GPG, all from No Starch Press.

Listen to Michael Lucas's BSD Talk interview about his latest book:

http://cisx1.uma.maine.edu/~wbackman/bsdtalk/bsdtalk190.ogg

Listen to Michael Lucas's TechBytes interview about Network Flow Analysis:

Part 1: http://www.ronnutter.com/a018-network-flow-analysis-part-1-michael-w-lucas/
Part 2: http://www.ronnutter.com/a019-network-flow-analysis-part-2-michael-w-lucas/

Table of Contents

Introduction

Chapter 1: Flow Fundamentals
Chapter 2: Collectors and Sensors
Chapter 3: Viewing Flows
Chapter 4: Filtering Flows
Chapter 5: Reporting and Follow-up Analysis
Chapter 6: Perl, Flowscan, and Cflow.pm
Chapter 7: FlowViewer
Chapter 8: Ad-Hoc Flow Visualization
Chapter 9: Edges & Analysis

Index

View the detailed Table of Contents (PDF).

View the Index (PDF).

(top)

Reviews

"Why do I like Network Flow Analysis? As I've said before, Michael W. Lucas is probably my favorite technical author. He is complete, accurate, and entertaining like no one else."
—Richard Bejtlich, TaoSecurity (Read More)

Network Flow Analysis "was valuable enough that I found myself planning ways to implement [it] at my workplace."
—DragonFly BSD Digest (Read More)

"The sequence of topics and the consistent tone and focus kept me engaged and confident that I could go as far as I'd like, with this book as a start."
—Michael Ernest, JavaRanch (Read More)

"This book is mandatory reading for network people, even if they already use netflow. There are sure to be tips and hints that you will enjoy."
—Henrik Kramshoj, Kramses Blog (Read More)

"A thorough and well-presented coverage of network flow analysis intended for professional network administrators/managers."
—Linux Users of Victoria (Read More)

"This book is worth its weight in gold, especially if you have to deal with a shoddy ISP who always blames things on your network."
—Utahcon.com (Read More)

(top)