Network flows observability for your datacenter

DC Netscope

See every network flow of your virtual infrastructure, understand who talks to whom and why, and build the inventory of the flows your information system relies on.

Install DC Netscope Explore the views

What DC Netscope does

1

Collect

Your distributed vSwitches, firewalls and probes send their NetFlow and sFlow metadata to DC Netscope. It reads the inventory of VMware vSphere and XCP-ng to name every address it sees.

2

Understand

Flows are shown between virtual machines, hosts and groups of applications rather than between IP addresses, for any period of time, with the raw data always one click away.

3

Govern

Describe the flows you expect, tell the authorized ones from the others, and follow how much of the observed traffic is described: the inventory of flows regulations such as NIS2 ask for.

Architecture

DC Netscope is a virtual appliance deployed in your infrastructure. It receives the flows metadata of your network devices, queries your virtualization platforms to know the resources behind each address, and serves its web interface to your users.

Architecture of a DC Netscope deployment: the users reach DC Netscope over HTTPS, DC Netscope queries vSphere and XCP-ng over HTTPS, and receives NetFlow from distributed vSwitches and sFlow from firewalls
A typical DC Netscope deployment

Ports to open

FlowFromToPort
Web interfaceUsersDC Netscope443/tcp
InventoryDC NetscopevCenter, Xen Orchestra443/tcp
InventoryDC NetscopeNutanix Prism9440/tcp
NetFlow, IPFIXVirtual switches, network devicesDC Netscope9000/udp
sFlowNetwork devicesDC Netscope10000/udp
IPFIX from NutanixNutanix clusterDC Netscope11000/udp

These are the default ports of the collectors of DC Netscope, which are set in the configuration of its administration interface. DC Netscope only receives the metadata of the flows (addresses, ports, protocols, volumes), never their content.

Will it work on my infrastructure?

DC Netscope needs a source of flows: the virtual switches of your platform, or network devices that export NetFlow, IPFIX or sFlow. Follow the graph from your virtualization platform:

flowchart TD platform["<b>Which platform runs your workloads?</b>"]:::start platform --> vmware["<b>VMware vSphere</b>"]:::platform platform --> xcpng["<b>XCP-ng / Xen Orchestra</b>"]:::platform platform --> nutanix["<b>Nutanix AHV</b>"]:::platform platform --> other["Another platform,<br>physical servers"]:::platform vmware --> dvs["Distributed vSwitches<br>(DVS)?"]:::question xcpng --> shell["Shell access to<br>the XCP-ng hosts?"]:::question nutanix --> prism["Prism account allowed<br>to set up IPFIX?"]:::question dvs -->|yes| vmwareSupported["<b>Supported</b><br>NetFlow from the DVS"]:::supported shell -->|yes| xcpngSupported["<b>Supported</b><br>NetFlow from Open vSwitch"]:::supported prism -->|yes| nutanixSupported["<b>Supported (beta)</b><br>IPFIX from Nutanix"]:::supported devices["Do network devices (switches, firewalls, probes)<br>export NetFlow, sFlow or IPFIX?"]:::question dvs -->|no| devices shell -->|no| devices prism -->|no| devices other -->|"via <a href='frontend/external_ips/'>External IPs</a>"| devices %% Invisible links, which put the question under the Supported boxes vmwareSupported ~~~ devices xcpngSupported ~~~ devices nutanixSupported ~~~ devices devices -->|yes| partial["<b>Partially supported</b><br>only the flows crossing these devices"]:::partial devices -->|no| none["<b>Not possible yet</b><br>no source of flows"]:::none classDef start fill:#1565c0,stroke:#1565c0,color:#ffffff classDef platform fill:#f5f8fc,stroke:#9fb3c8 classDef question fill:#e3f2fd,stroke:#2b95f6 classDef supported fill:#e6f4ea,stroke:#2e8540 classDef partial fill:#fff4e5,stroke:#d98a0b classDef none fill:#fdecea,stroke:#c92100
  • Supported: DC Netscope sees every flow of your virtual machines, including the ones between two virtual machines of the same host.
  • Partially supported: DC Netscope only sees the flows crossing your network devices: the traffic that stays inside a host, or behind a device, may be invisible to it.
  • Not possible yet: there is no source of flows. Contact us: we will look at your infrastructure with you.

See Compatibility for what each answer means and for the equipment known to export flows.

Explore the views

Dashboard

Traffic over time, inside vs outside traffic, top protocols and top emitters at a glance.

Flows Views

Clusters, networks, dependencies and protocols: several ways to draw the flows, each with its datatable.

Apps Groups

Gather resources into applications, by hand or by name patterns, and see the flows between them.

Flows Descriptions

Describe and classify the expected flows, and measure how much of the traffic they cover.

Outside Flows

The flows exchanged with the Internet, by country, by network provider (ASN) and by virtual machine.

External IPs

Name the physical servers, network equipment and online services that appear in your flows.

Custom Protocols

Recognize the protocols running on non-default ports, and define your own.

Reports

Word documents summarizing the network activity of your infrastructure over a period.

Public API

Fetch the data of DC Netscope from your own scripts, with security tokens.

Getting started

  1. Import the OVA and give the virtual machine its network settings and default accounts.
  2. Add your monitoring targets, such as your vCenters, so that DC Netscope knows the resources of your infrastructure.
  3. Configure your network devices to send their NetFlow or sFlow metadata to DC Netscope.
  4. Activate your license: a 15 days trial license is active as soon as DC Netscope is installed.

Once flows come in, see how to choose the time period and the filters shared by all the views, and how to list and export the flows behind every chart.

Note

Need help? Have a look at the troubleshooting page, or contact our support.