FAQ

Noction Flow Analyzer supports NetFlow, J-Flow, sFlow, IPFIX, NetStream as well as BGP.

Generally, NFA is designed to work with any device be it a router, switch, firewall, etc that is capable of exporting NetFlow, J-Flow, sFlow, IPFIX or NetStream. NFA has been successfully tested with Cisco, Juniper, Huawei, Brocade, Alcatel, Vyatta, Mikrotik, Arista, and ZTE devices.

NFA is priced per license at a flat rate of $299/month or $2990/year ($598 savings) with no limitations in terms of network devices, interfaces, or sites added to the system; free upgrades to new releases, and premium 24/7 support.

Custom pricing will apply to deployments with over 10K FPS.

Yes. You can trial NFA for 30 days completely free of charge. Instant access. No credit card required.

Once you request an NFA license online the activation key is sent to you via email. Should you have any questions in regards to NFA licensing, feel free to contact us at info@noction.com

No, you will not have to reinstall or shut down the server. You’ll need to simply introduce the new license activation code under Management > License.

Yes. Free 24/7 support is available for all license types.

Hardware Requirements:

• x86_64 architecture
• Minimum 4x core CPU (8x core CPU recommended)
• Minimum 32GB of RAM (64GB RAM recommended; 128GB RAM – optimal)
• Minimum 250GB SSD storage (500GB SSD storage recommended) allocated to the /var partition

Software Requirements:

• CentOS 7 x86_64 Minimal or CentOS 8 x86_64 Minimal – Clean Install

or

• Ubuntu 20.04 LTS

Note: NFA will install and operate below the recommended system requirements. However, as the database size grows and if complex queries are used, this can result in slow performance.

The minimum system requirements assume default configuration. Significantly increasing the flow collection rate might cause additional load on a server, thus requiring extra memory or a larger CPU.

In production, a dedicated server is recommended. The system can be deployed on a VM as well with matching specifications.

The installation process is quite straightforward and takes less than 15 minutes on average.

Consult the following document or information about installing NFA. Should you still have questions or need assistance contact our 24/7 support at support@noction.com

There is absolutely no limit on the number of devices, interfaces, or sites in the Noction Flow Analyzer.

No. An unlimited number of users can access Noction Flow Analyzer at any time.

For any technical support please contact us at support@noction.com describing the issues you encountered or call (650) 903-7028.

NFA dashboards are the specific sets of flexible and interactive visualizations, designed for quick analysis of the network traffic data and informational awareness. Dashboards consist of widgets – graphical representations of specific data, which can be added, edited, deleted or modified as you like.

Run any query using NFA Data Explorer, save your query as a widget and add it to a dashboard of your choice.

NFA lets you set up a robust and customizable alert system that can proactively notify you via email or Slack when important conditions are detected in your network traffic data. You can configure alerts based on different characteristics and parameters of your network traffic: volume changes, frequency, specific traffic type existence, duration, baseline or a complex combination of such characteristics.

Users with administrative rights have full access to the Collected Network Knowledge through NFA’s Query Editor. You can approach tables from DB using SQL (Structured Query Language), which is the standard computer language for relational database management and data manipulation.

You can save your query in a Query Library for subsequent use. Browse the library of Saved queries in order to start from a typical configuration. Export query results for further processing outside of Noction Flow Analyzer.

BGP Data is delivered as an optional add-on to Noction Flow Analyzer.

NFA overcomes the limitation of BGP support in traditional NetFlow. It employs a collection of full BGP data from BGP tables of edge routers and extracting the required BGP attributes from the tables. NFA extracts BGP attributes such as AS_PATH and matches the obtained data with a corresponding flow record. This enables NFA to see and filter on the full BGP path, not just the next hop, first three or last three AS numbers.

Enabling BGP data will require you to establish a BGP session between at least one of your routers and NFA.

The default level 3 data aggregation is kept for 400 days.

Definitely. Use this form to request new features, suggest modifications to existing features or report a bug. We do read each and every message and use the information provided to improve our Noction Flow Analyzer. Your suggestions, comments, and ideas for improvements are very important to us.

Yes. You may cancel your subscription at any time. No questions asked.

You’ll be able to continue using NFA until the end of your billing cycle.

An IP Flow is a sequence of packets sharing the same properties that are sent between a sending and receiving hosts. For instance, when we watch live streaming video, packets sent from server to PC create a flow as they are part of the same conversation.

NetFlow is a Cisco proprietary network protocol used for flow analysis. NetFlow collects and aggregates information about network traffic flowing through a device with an enabled NetFlow feature. The outputs of NetFlow are flow records that are sent to a centralized place in a network (flow collector) as NetFlow messages. There are multiple NetFlow protocol versions, with the most important ones being versions 5 and 9. Version 5 is most common on Cisco NetFlow enabled devices.

Although sFlow stands for Sampled Flow, actual packets are being sampled here instead of flows. Sampling involves either copying headers of packets or extracting features from a packet. The goal of packet sampling and filtering is to forward only certain packets. Based on a defined sampling rate, an average of 1 out of n packets is randomly sampled. sFlow agent running within a router or a switch packages interface counters and flow samples into sFlow datagrams. The datagrams are continuously sent using UDP to Noction Flow Analyzer where they are further analyzed.

Internet Protocol Flow Information Export (IPFIX) is a standard for exporting the information about network flows from devices. It is derived from Cisco’s proprietary NetFlow v9. A metering process generates flow records collecting data packets at an Observation Point, filters them and aggregates information about these packets. Flow records are sent by the Exporting process running on exporter as IPFIX messages encapsulated by layer 4 protocols (SCTP, UDP or TCP) to NFA.