Traditional security approaches use Firewall and Intrusion Prevention devices to identify and stop malicious traffic. They are limited in their effectiveness to enforce Internet Usage policies and are not always effective against attacks which originate or spread across the internal network infrastructure.
Technologies such as Network Behavior Analysis (NBA) were developed to combat these types of attacks and network abuse. NBA technology utilizes the Internet Protocol traffic information gathered from network choke points such as Firewalls, Intrusion Detection and Prevention devices and Core Routers. It then applies a variety of heuristic algorithms and signature based matching techniques to detect abnormal behavior within the internal network which can be reviewed and processed by the administrators.
The most popular appliances utilizing NBA technology rely on proprietary IP flow information protocols such as NetFlow, sFlow, cFlow and J-Flow. NetFlow is an open proprietary network protocol developed by Cisco Systems. It collects IP traffic information from Cisco IOS-enabled equipment such as Cisco Routers.
Cisco IOS devices can only export the NetFlow traffic to a single destination. Even with the new "NetFlow Multiple Export Destinations" feature included in the newer Cisco equipment, the flows can only be exported to two destinations. This restriction has forced enterprises to chose which applications will receive the NetFlow data, increasing the security risk to the network and impeding the effectiveness of other business tools which also require NetFlow data.
NetSieben recognized the need for a proprietary "netflow forwarder" or "netflow replicator" so NetFlow data could utilized by a multitude of Businesses Intelligence applications, Log Correlation engines and Traffic Analyzers which provide important network data analysis and reports.
NetSieben's NetFlow Replicator Appliance (NNRA) addresses this problem by utilizing proprietary technology allowing it to collect data from a multitude of Cisco IOS devices and forwarding it to multiple destinations. NNRA is able to process high volumes of NetFlow traffic adding little latency in the process. The traffic is split according to policies which are configured by the administrator utilizing an easy to use Web front end.
