Outside flows

This component focuses on netflow flows with resources located outside the infrastructure (i.e. IPs located on Internet). It provides a quick view of the origin countries of flows, their ASN (Autonomous System Number, i.e. the network provider), and which VMs has communications with outside.

Characterization of outside flows

There may be a large amount of outside network flows. To ease the understanding of these flows, we propose to analyse these flows with several points of views. It is possible to select which point of view to use :

By virtual machine

It shows the virtual machines that have communication with outside IPs, first showing those who have the highest traffic.

By countries

It shows the countries from which outside flows come, first showing those who have the highest traffic.

By network provider (ASN)

It shows the network provider from which outside flows come, first showing those who have the highest traffic. In a context of a cloud project, this component can be useful to find VMs that are connected to the cloud project.

If you display the details of communications of an ASN, you get the flows as a datagrid. For the sake of clarity, by default ASN communications are groupes, thus by default an ASN appears one time as a single row, and the outside IP address shown in the row is one of the ASN's IP address.

It is however possible to show all individual communication of an ASN, as depicted by the following video :

By accessed ports

It shows the virtual machines that may have ports exposed to the outside. We provide two information :

• Ports count : how many different ports of the VMs has been accessed from outside.
• IPs count : how many different outside IPs has accessed at least one of the ports of the VMs.

This component can help to find VMs that are can be accessed from the outside. Please note that the accuracy of this information depends of the source of flows information, as we rely on SFlow and Netflow data transmitted to DC Netscope.