Netflow analysis:

Netflow version 5 or 9 is exported into sensors from one or more routers on port 9996. These are then converted into bidirectional traffic events and then further processed by nLive.

Packet analysis:

Packets are mirrored into Ethernet interfaces on sensors from up to three Ethernet switches. These are then converted into bidirectional traffic events using a state machine and then further processed by nLive.

Reports:

There are standard reports as well as reports from search operations. These are shown on screen in HTML and can be made into PDF as well. Some can be scheduled to be sent periodically.

Dashboards:

These are live reports that update themselves and can be played on screen to keep you updated in near real time.

Graphs:

These are live connected graphs of conversations between hosts, business groups etc. They are similar to dashboards since they update in near real time.

Search:

Searching with various traffic and host parameters are possible. Searches are distributed across all sensors, whenever applicable. The results are combined before presentation. Searches can result in reports, graphs or tables.

Drill down:

Drill down involved clicking on a chart or graph to narrow down into a host, application, device, port etc. This is another form of searching, but convenient for investigations.

Problem detection, True Machine Intelligence

A key feature of nLive is the ability to detect traffic problems automatically. This is described elsewhere in detail.

Switch port - host mapping, explorer

Using the feature, nLive maps switch ports into the connected hosts, thereby enabling you to locate a problem host quickly. You can also search into the database of switch ports and hosts using various parameters.

Distributed architecture, more than one sensor, region

Having several sensors, each one with its own database and analysis engine, enables one to scale nLive to very large and intercontinental networks. The distributed sensors make sure that minimum data is passed across your links, thereby minimizing any overhead of running nLive.