NetFlow Optimizer

NetFlow Optimizer (NFO) is a real-time processing engine developed by NetFlow Logic Corporation. According to the vendor, NFO is designed to enhance network management and security by processing flow data, including NetFlow, sFlow, J-Flow, and IPFIX, at a significantly higher speed compared to its competitors. It offers the capability to process flow data for storage and forensic analysis or generate optimized and enriched NetFlow records for visualization and processing by other systems.

NFO is said to enhance the capabilities of existing Security Information Event Management (SIEM) systems and log analyzers by providing multi-dimensional views of network traffic and converting records into standard syslog format. According to the vendor, this can help reduce storage hardware costs and license fees for visualization software based on processed traffic volume.

The product claims to deliver a critical component for complete network visibility by extracting valuable data from NetFlow, enriching it with additional information, and correlating it with other machine data. It enables advanced operational intelligence and security for virtual and physical networks, including the detection of security threats such as DDoS attacks, botnets, insider threats, and data leakage.

NetFlow Optimizer is positioned as a cost-effective software solution that eliminates the need for expensive proprietary hardware. It offers high performance, processing up to 350,000 records per second on an 8-core machine with 16GB of memory. The product can be deployed in virtual environments and scales horizontally and vertically to accommodate the growth of enterprise networks.

NFO provides multi-dimensional views of network traffic, enabling analysis of flow counts, bytes, packets, and other flow characteristics per protocol, application, network host, or subnet over time. It generates reports on network device loads, top bandwidth consumers, and servers' response times, facilitating capacity planning.

NetFlow Optimizer enables actionable virtual and physical network monitoring, including identification of virtual machines (VMs) affected by physical network outages, visualization of network data paths, and support for point-to-point communication tracing. The software also helps identify the impact of physical network device and interface failures on the virtual network.

According to the vendor, NFO enriches flow data with current Reputation, GEO IP, and DNS data, allowing the identification of security threats and known threat sources. It can also initiate alerts for anomalous network host behavior and network traffic, including "low and slow" DDoS attacks.