How to Monitor and Report Traffic Using Crysnet Bandwidth ManagerCrysnet Bandwidth Manager is a network traffic control and monitoring solution designed to help administrators shape bandwidth, enforce policies, and generate actionable reports. This guide covers planning, installing, configuring, monitoring, and reporting traffic with Crysnet Bandwidth Manager so you can maintain predictable network performance and produce useful analytics for stakeholders.
Overview: What Crysnet Bandwidth Manager Does
Crysnet Bandwidth Manager provides tools to:
- Classify and throttle traffic by IP, subnet, application, or port.
- Prioritize critical services and limit recreational or nonessential traffic.
- Record usage statistics and generate reports for billing, capacity planning, or troubleshooting.
- Integrate with authentication systems and network devices to apply policies consistently.
Key benefits: improved QoS for critical apps, better bandwidth utilization, visibility into who/what consumes network resources, and data for informed decision-making.
1. Planning your monitoring and reporting approach
Before deploying monitoring and reporting, decide:
- Objectives: Are you tracking bandwidth for capacity planning, user billing, SLA compliance, or security?
- Scope: Which devices, subnets, VLANs, or applications need visibility?
- Granularity: Do you need per-user/hourly data or aggregate daily/weekly reports?
- Retention: How long should historical data be kept for trend analysis or audits?
- Privacy & compliance: Ensure monitoring complies with local laws and organizational policies.
Concrete example goals:
- Produce a daily top-20 bandwidth consumers report for IT managers.
- Alert when a department exceeds 90% of its allocated bandwidth for over 10 minutes.
- Maintain 12 months of daily aggregates for capacity planning.
2. Deployment and initial configuration
- System requirements
- Ensure the appliance or server meets CPU, RAM, storage, and NIC requirements for the expected traffic volume. Monitoring at high throughput needs proportionally more CPU and fast storage (SSD).
- Network placement
- Inline (bump-in-the-wire) for active shaping and enforcement.
- Passive (SPAN/mirror port or TAP) for monitoring-only setups where no inline interference is desired.
- Basic configuration steps
- Assign management IP and secure access (strong admin password, restrict by IP, use SSH/HTTPS).
- Set time synchronization (NTP) for accurate timestamps.
- Configure upstream/downstream interfaces and link to switch SPAN or TAP if monitoring passively.
- Integrate with authentication (RADIUS/LDAP) if you need per-user reporting.
3. Traffic classification and policies
Accurate classification is critical for meaningful monitoring.
- Built-in classifiers: Use application/port signatures and protocol inspection where available.
- Custom rules: Create rules by IP range, VLAN, port, QoS markings, or DSCP.
- Layered policies: Combine rules so higher-priority traffic (VoIP, SIP, business apps) is consistently recognized and favored.
- Example rule set:
- Priority 1: VoIP (ports/protocols + DSCP EF)
- Priority 2: Business apps (identified by server IP ranges)
- Priority 3: Web browsing (HTTP/HTTPS)
- Throttle: Streaming/media (identified by known domains/IPs or deep packet inspection)
Tip: Start broad, then refine—use initial reports to discover new traffic patterns and adjust classifiers.
4. Real-time monitoring: dashboards and alerts
Real-time visibility helps detect issues before they escalate.
- Dashboards: Customize to show total throughput (bps), per-interface utilization, top talkers, active flows, and queue/latency metrics.
- Live flow lists: Monitor active flows with source/destination, protocol, bytes/sec, and duration.
- Threshold alerts: Configure alerts for high utilization, interface errors, or when specific policies trigger frequently.
- Notifications: Send alerts via email, SNMP traps, or webhook integrations to ticketing and incident systems.
Practical dashboard layout:
- Top row: Global throughput, packet rates, error rates.
- Middle: Top talkers (hosts and applications) and top protocols.
- Bottom: Per-interface utilization and policy enforcement counters.
5. Collecting historical data and retention strategy
- Aggregation levels: Store raw flow records for a short window (e.g., 7–30 days) and aggregated summaries (hourly, daily) for longer retention.
- Storage planning: Estimate disk space based on traffic volume, number of flows, and retention period. Example: 1 Gbps constant traffic generates far more records than intermittent usage.
- Export options: Configure exports to external databases or SIEMs (CSV, NetFlow/IPFIX, syslog) for long-term storage and advanced analytics.
Example retention policy:
- Raw flows: 14 days
- Hourly aggregates: 90 days
- Daily aggregates: 2 years
6. Generating reports
Crysnet Bandwidth Manager typically provides built-in reporting plus options to export raw data. Useful report types:
- Top talkers (by user, IP, subnet)
- Top applications and protocols
- Interface utilization over time
- Policy hits and enforcement actions
- SLA compliance and peak usage times
- Custom billing reports (per-customer or per-department)
Report customization tips:
- Choose appropriate time windows (peak hours, business day, weekly/monthly).
- Use grouping (by VLAN, department, device owner) for actionable insights.
- Include percentage-of-total columns to contextualize absolute usage.
- Schedule automated delivery (daily/weekly/monthly) in PDF or CSV formats.
7. Advanced analysis: trends, capacity planning, and anomalies
- Trend analysis: Use moving averages and peak-to-average comparisons to forecast growth and plan upgrades.
- Baseline and anomaly detection: Establish normal behavior baselines (per-hour, per-day) and alert on deviations such as sudden spikes, new top talkers, or protocol shifts indicating misconfiguration or security incidents.
- Capacity planning example: If 95th percentile utilization on the core link grows 10% year-over-year, plan upgrades when projected demand approaches 70–80% of link capacity.
Mathematical note (95th percentile): Let throughput samples for a period be sorted ascending: x1 ≤ x2 ≤ … ≤ xn. The 95th percentile is xk where k = ceil(0.95 * n). This metric helps ignore short-lived spikes when billing or planning.
8. Exporting data for external tools
- NetFlow/IPFIX: Export flow records to collectors like ntopng, Elastic Stack, or commercial flow analyzers.
- CSV/PDF: For business reports and sharing with non-technical stakeholders.
- API: Use REST APIs if available to pull data programmatically for dashboards or automation.
- SIEM integration: Forward alerts and logs to SIEM for correlation with security events.
Example use-case: Export daily top-100 talkers via API to a BI system to combine with helpdesk ticketing data.
9. Troubleshooting common monitoring/reporting issues
- Missing flows: Verify SPAN/TAP configuration, correct interface selection, and sampling settings. Ensure flow export is enabled.
- Low visibility of encrypted traffic: Use endpoint/device logs and metadata (SNI, IPs) to infer encrypted traffic types; consider TLS inspection only where policy and privacy allow.
- Clock drift: Ensure NTP is configured so timestamps align across devices for accurate reporting.
- Storage overload: Reduce raw flow retention or increase aggregation, or offload to a dedicated collector.
10. Security and privacy considerations
- Limit who can view reports, especially those showing individual user activity.
- Anonymize or aggregate user identifiers where full detail is unnecessary.
- Keep stored flow data encrypted at rest and secure management interfaces with MFA.
- Comply with local laws and company policies about monitoring employee traffic and data retention.
Example workflow: Create a weekly report of top 20 bandwidth users
- Configure flow collection on core switch SPAN to Crysnet monitoring interface.
- Ensure user-ID integration (RADIUS/LDAP) so flows map to usernames.
- Create a report template: Time range = past 7 days; Group by user; Sort by total bytes; Limit = top 20.
- Schedule report to run every Monday at 06:00 and email PDF to IT managers.
- Review monthly to adjust thresholds, classifiers, and retention.
Conclusion
Monitoring and reporting with Crysnet Bandwidth Manager is a cycle of planning, careful classifier and policy design, real-time observation, historical analysis, and periodic adjustment. With accurate classification, sensible retention, automated reports, and clear privacy controls, you’ll gain the visibility needed for capacity planning, SLA adherence, security detection, and fair bandwidth allocation.
Leave a Reply