eSight Network Traffic Analyzer supports mainstream network traffic protocols, including NetStream, NetFlow, and sFlow.

Figure 5-1 shows the customized dashboard that displays network status.

Customized dashboard

• Multiple dimensions: eSight Network Traffic Analyzer ranks the traffic on devices and interfaces, including interface usage, application, host, session, and Differentiated Services Code Point (DSCP) traffic.
• Customization: eSight Network Traffic Analyzer allows users to customize the presented content, format, and formatting style and supports partial traffic updates without changing the Graphical User Interface (GUI).
• The interface traffic and usage rankings display interface traffic statistics, including the incoming and outgoing rate and incoming and outgoing data packets. Clicking an interface will reveal information about the traffic composition at different times, in multiple dimensions, including the application, host, session, and DSCP.

Customized Traffic Applications and Group Network Traffic

Customization options for traffic applications and group network traffic, as follows:

• Customized applications
• Customized DSCP group
• Customized application group
• Customized IP address group or interface group

Customized Applications

eSight Network Traffic Analyzer components are recognized based on the protocol and port number, and hundreds of standard applications and common Layer 4 applications are preset. Protocols and port numbers can also be added for unknown applications, and network administrators can add applications as required. Users can customize applications based on the specified protocol, port number, and IP address ranges.

Customized DSCP Group

DSCP group is a logical group, and users can create a group to differentiate DSCP composition. For example, in WAN QoS monitoring, users can create a voice group (EF), a video group (AF31), and a group for the other DSCP; therefore, eSight Network Traffic Analyzer can provide a reference for proper enterprise QoS bandwidth and key service bandwidth planning.

Customized Application Group

Create application groups as required to obtain comprehensive information about specific applications. For example, create an application group named Mail Service, and combine Lotus Notes, pop3, and SMTP applications into the group to learn about mail application traffic.

Customized IP Address Group or Interface Group

Users can consider the IP addresses or interfaces in a certain range as a whole to calculate traffic statistics. For example, assume that an enterprise has two floors and the total enterprise traffic must be calculated. Simply combine all switch interfaces on the two floors into an interface group and analyze the total traffic.

Monitoring Multi-dimensional Traffic with Simple Configuration

Overall network traffic analysis depends on high performance traffic analysis. Network administrators need only add a monitoring interface and configure the traffic sampling ratio before monitoring and analyzing interface traffic from multiple dimensions, including the following:

• Interface traffic analysis
• Application traffic analysis
• Source/Destination host traffic analysis
• DSCP traffic analysis
• Session traffic analysis

Interface Traffic Analysis

Interface traffic analysis checks the traffic trend for a specified interface, time range, and incoming and outgoing traffic. Based on interface traffic analysis, network administrators can identify the interfaces that are used most frequently on the network to gain a comprehensive understanding of the entire network status. Administrators can detect interfaces with abnormal traffic and locate faults before network performance is affected.

Application Traffic Analysis

Application traffic analysis checks the trend of application changes for a specified interface, time range, and incoming and outgoing traffic. Administrators can locate the host that causes performance problems based on the source ranking and destination hosts using a specific application.

Source/Destination Host Traffic Analysis

Source/destination host traffic analysis checks the trend in source/destination host bandwidth usage changes for a specified interface, time range, and incoming and outgoing traffic. Based on source/destination host analysis, network administrators can identify the host that consumes high bandwidth and solve any bandwidth problems in a timely manner to ensure bandwidth usage efficiency.

Session Traffic Analysis

Session traffic analysis checks the trend of session traffic for a specified interface and time range. Session traffic analysis provides detailed session information the network administrator can use for further fault location.

DSCP Traffic Analysis

DSCP traffic analysis checks the DSCP traffic trend for a specified interface and time range, ensuring proper QoS bandwidth planning and the quality of key services.

Group Traffic Analysis

Group traffic analysis displays the DSCP group, interface group, application group, and IP group traffic statistics on specified interfaces within a specific time range. Network administrators can conveniently analyze specific traffic as required to satisfy special maintenance requirements.

Threshold Value Alarm

eSight allows administrators to set traffic threshold values for applications and hosts. When the number of times that the monitored value exceeds the threshold values within a specified time reaches the preset value, eSight sends alarm notifications through email.

Customized Traffic Report

eSight Network Traffic Analyzer can customize reports by specifying filtering rules, report type, and report layout configuration. Traffic reports provide references for further network planning.

Original Data Stream Facilitates Fault Location

NTA can extract an original data stream based on a specified time range and filtering rules for further analysis and fault location. Original traffic information includes the router, source, and destination address, application, source and destination port, protocol, TCP flag, next hop, inbound and outbound interface, and DSCP, traffic, and data packets.

Users can create traffic investigation tasks for suspected abnormal traffic on the NTA page to extract original data stream information about the current traffic.

eSight Network Traffic Analyzer can be deployed on the same server as eSight Unified Network Management Platform standard or professional edition, or on a different one. When they are configured on one server, they can manage no more than 10 NEs, and the configuration requirements are the same as those of the platform. When they are configured on different servers, configuration requirements are as follows:

Operating System	Configuration Requirement
Windows Server 2008 R2 standard	CPU: 1 x quad-core 2 GHz or higher Memory: 4 GB Disk space: 120 GB Database: MySQL 5.5, Microsoft SQL Server 2008 R2 standard PC servers are recommended. Determine the hardware specifications based on the network scale.

When eSight Network Traffic Analyzer and eSight Unified Network Management Platform are deployed on different servers, eSight Network Traffic Analyzer can be deployed on a VM. VM resource requirements are as follows:

Operating System	Resources Required by a VM
Windows Server 2008 R2 standard	VMWare ESXI 5.0 CPU: 1 x quad-core 2 GHz or higher Memory: 6 GB Disk space: 300 GB Database: MySQL 5.5, Microsoft SQL Server 2008 R2 standard PC servers are recommended. Determine the hardware specifications based on the network scale.

eSight Network Traffic Analyzer enables NetStream on an enterprise's WAN-link device interfaces to send traffic information to the eSight Network Traffic Analyzer. eSight NTA provides the following functions in this scenario:

• Analyzes the current WAN link traffic composition.
• Helps recognize abnormal traffic and junk applications.
• Quickly locates the IP address of the terminal generating abnormal traffic.
• Optimizes link application traffic distribution.
• Improves WAN link usage.
• Recognizes DSCP bandwidth distribution on the enterprise branch egress.
• Adjusts service priority policies.
• Periodically generates a link interface traffic report.
• Detects network application traffic increase.
• Facilitates advance network planning and expansion.





Item	Quantity	Remarks
eSight AppBase-Standard(include 60 devices License) or eSight AppBase-Professional(include 60 devices License)	1	Mandatory, eSight Unified Network Management Platform.
eSight Network Traffic Analyzer manager	1	Mandatory, eSight Network Traffic Analyzer.
eSight NTA License-Incremental 1 Device License	Optional	One such item indicates the management of 1 more device.
eSight NTA License-Incremental 2 Device License	Optional	One such item indicates the management of 2 more devices.
eSight NTA License-Incremental 5 Device License	Optional	One such item indicates the management of 5 more devices.