Monitoring IT network using network traffic does not result in ANY overhead on to your IT network or devices or application or server infrastructure. Our NetSense packet sensor sits passively in your network and collects rich KPI information from network traffic. Passive network monitoring using network traffic also does not result in any form of cyber security compromise.

Our NPM solution monitor IT network using network traffic. Our solution detects any device communicating on the network. Our solution pricing is based on #Devices our solutions monitor in your IT network. A device is any computer/phone/networking equipment which is communicating on the network. Our NPM subscription pricing is based on #devices being monitored internal to your IT network. We generally do not count devices in public internet. for subscription. However, if your network is 100% public facing only, we do count #unique IPs communicating to your IT network to determine the subscription pricing.

Yes, NetSense needs a dedicated machine virtual or physical depending on where you are monitoring, for high-speed physical data centers > 1Gbps traffic dedicated server class machines are recommended. Recommended OS is Ubuntu 20.04 server LTR which is a secured linux OS. NetSense is also supported on other linux OS favors on case-to-case basis. Contact support@thoughtdata.com if you any such need.

Minimum resource requirements starts at 4CPU/16GB RAM/300GB HDD for <1Gbps traffic. The resource requirements increases as the volume of traffic monitored increases. Please refer to NetSense deployment guide for resource requirements or contact support@thoughtdata.com for detailed resource requirements based on your IT network

You have to identify critical links where network traffic aggregates to monitor the network. It is not necessary to monitor interfaces which carry duplicate traffic across multiple hops as the data sets are same.

There are 2 options to tap the traffic

Option1: Tap the traffic using span configuration on router/switches

Your network traffic traverses through multiple router/switches, identify the critical link on the router/switch you would like to monitor, create a span configuration on the router/switch to copy the traffic to another interface on the same router/switch. Physically connect the span port to the physical interface of NetSense packet sensor.

Option2: Tap the traffic using passive taps for network packet brokers

Alternatively, you may buy a passive network tap or network packet broker device which can tap the links and make copies of traffic. Aggregate traffic ports as needed and send aggregated network traffic to physical ports of NetSense packet sensor.

You can roll out NetSense as a virtual machine attached to a vNic on any hypervisor. Hypervisors provide packet mirroring functions where you can pick and choose which VMs you want to monitor and configure to send all traffic to destination VM which will be NetSense VM. NetSense VM can reside on same or different hypervisor as long as the source and destination are on the same virtual distributed switch (vDS).

In case of hypervisors which do not have vDS. you can optionally enable promiscous mode on physical interfaces of your hypervisor and attach NetSense VM to the physical interfaces to monitor all the traffic on the physical interfaces(east-west) as well as (north-south).

You can roll out NetSense as a virtual machine/cloud computing instance in any public cloud (AWS, Azure, GCP etc)

Monitoring in AWS

Roll out NetSense as VM in your AWS network. AWS provides a traffic mirroring function to send traffic from any cloud computing instance/VM to destination VM which will be the NetSense VM, you can mirror multiple VMs traffic to one NetSense VM. You may also mirror traffic directly from ELBs to NetSense VM.

Monitoring in non-AWS networks(Azure/GCP etc)

Roll out NetSense as VM in your public cloud network. Public cloud providers other than AWS do not support traffic mirroring function. To solve this ThoughtData provides a software called as NetMirror which does the same job as traffic mirroring in AWS. NetMirror when installed on your application computing nodes, streams all traffic to NetSense VM. Multiple NetMirrors can stream traffic to one NetSense VM. All traffic is processed outside in NetSense VM and no overhead is incurred on your application cloud computing nodes. This provides 100% passive monitoring in public cloud environments and also does not compromise any cyber security on your computing nodes. The NetMirror function works at Layer 3 on computing nodes and does not interact with application layer and all traffic is sliced, compressed and then streamed to NetSense causing minimal overhead on cloud network. alternatively customers can create a virtual monitoring network for streaming network traffic between NetMirror’s and virtual NetSense to avoid any overhead on production network.

Yes, one NetSense packet sensor can monitor multiple ethernet interfaces on the same machine on which its installed. However resource requirements increase as you enable more interfaces to monitor.

Atleast 2, one for connecting to the network and one for monitoring. You cannot monitor and communicate to the network on one interface.

For on-premises <1Gbps traffic we support all generic purpose NIC cards like Intel, Dell, Broadcom, Cisco etc.

For <10Gbps traffic we recommend specific Intel based NIC cards. Please refer to NetSense deployment guide for different Intel NIC cards recommended for optimal performance or contact support@thoughtdata.com for details.

For >10Gbps traffic. ThoughtData provides high speed FPGA based NIC cards for optimal performance. In most cases the NIC cards are always bundled in our solution pricing. Please contact info@thoughtdata.com or your ThoughtData sales team for additional details.

NetSense extracts rich telemetry information from Layer 2-7 headers in network packets. NetSense also has built in intelligence to parse most common standard applications at Layer 7 to extract application specific KPIs.

No, all metadata extracted from network traffic is immediately pushed to Enterprise360 in real time and no metadata is stored locally.

Yes, you can choose size of packet store during NetSense installation. NetSense uses this storage space as configured to locally store packets for deep packet level troubleshooting. The packet store wraps continuously and stores the latest data. The size of packet store and speed of network traffic decides how long the packet data is retained. You can control your storage needs depending on how long you would like to retain packet data for your troubleshooting needs.

Yes, all metadata is encrypted over SSL/TLS

It depends on the volume of traffic being monitored. NetSense only sends extracted flow level meta data/KPIs to Enterprise360 not packets themselves. Hundreds/Thousands of packets (Kilobytes to Gigabytes) worth of packet data translate to one flow, and each flow metadata is around 100kb which is sent to Enterprise360. The bandwidth consumption between NetSense and Enterprise360 is very minimal.

SsnmpSense sensor requires a dedicate machine physical or virtual. Required OS is Ubuntu 20.04 Server LTR. Minimum resource requirements are 4CPU/16GB RAM. For higher number of SNMP devices polling replicate and distribute your SNMP devices polling across multiple SsnmpSense sensors.

This is directly dependent on how much resources (CPU, Memory) are provided to the SnmpSense sensor and how many MIBs you are polling, please refer to SnmpSense deployment guide for more details and performance statistics or contact support@thoughtdata.com for more details.

ThoughtData’s SnmpSense follows an open SNMP poller framework and lets you configure which MIB you want to poll and its OIDs. Our solution automatically understands the MIB structure and polls the data and sends it to Enterprise360.

Yes

No, Enterprise360 comes only with standard SNMP MIB based dashboards out of box. However, you can add a custom dashboard for your SNMP devices within minutes inside Enterprise360 after the polling has started and visualize the data the way your team wants to solve your specific use cases. Sample vendor specific dashboards as available from technical support which can be reused or as reference examples.

Yes, once you have a visualization for the OID/Metric in Enterprise360, you can setup an alert.

Yes, you can add new dashboards to Enterprise360 to monitor specific types of SNMP devices in categories (Eg : Routers/Firewalls/Printers etc) and build your own visualization and alerts.

This can be configured per MIB in SnmpSense according to your requirements. Out of box MIBs comes with default polling intervals which can also be customized.

Yes, 1 Custom dashboard is included in your subscription. Additional dashboards can be built based on your requirements at additional cost. Contact support@thoughtdata.com for more details.