Monitoring Network Performance and Events

This chapter describes how to monitor network performance and identify unusual events. It includes the following sections.

Interfaces Sending or Receiving Traffic

To identify specific interfaces that are sending or receiving traffic, you can use the following features:
  • DMF Top Filter interfaces
  • Production interfaces
Figure 1. DMF Filter Interfaces
Figure 2. sFlow > Flow by Production Device & IF

This information derives from the LLDP/CDP exchange between the production switches and the DANZ Monitoring Fabric switches.

Anomalies

Use the following features to recognize unusual activity or events on the network.
  • Comparing dashboards and visualization over time
  • sFlow > Count sFlow vs Last Wk
  • New Flows & New Hosts
  • Utilization alerts
  • Machine Learning

Identify any unusual activity by comparing the same dashboard over the past 1 hour to the same time last week. For example, the bar visualization of traffic over time shows changing ratios of internal to external traffic, which can highlight an abnormality.

The Count sFlow vs Last Wk visualization in the sFlow dashboard shows the number of unique flows being seen now compared to last week. This visualization indicates unusual network activity and will help pinpoint a Denial of Service (DOS) attack.
Figure 3. Count sFlow vs Last Wk

In a well-inventoried environment, use the New Flows & New Hosts report.

Figure 4. Production Traffic

Configure utilization alerts associated with the following DMF port types:

  • Filter
  • Delivery
  • Core
  • Services
Figure 5. Monitoring Port Utilization Alerts
The other alerts available include the following.
  • Percentage of outbound traffic exceeds usual thresholds.
  • New Hosts appearing on the network every 24 hours.
Figure 6. New Host Report
Perform Anomaly Detection in data over byte volume and characteristics over time using machine learning.
Figure 7. Machine Learning

Application Data Management

Application Data Management (ADM) helps users govern and manage data in business applications like SAP ERP. To use Arista Analytics for ADM, perform the following steps:

  1. Pick a service IP address or block of IP addresses.
  2. Identify the main body of expected communication with adjacent application servers.
  3. Filter down to ports that need to be communicating.
  4. Expand the time horizon to characterize necessary communication completely.
  5. Save as CSV.
  6. Convert the CSV to ACL rules to enforce in the network.

Machine Learning

Arista Analytics uses machine learning for anomaly detection. The following jobs are available:
  • Single-metric anomaly detection
  • Multimetric anomaly detection
  • Population
  • Advanced
  • Categorization
Figure 13. Machine Learning
For every job, a job ID must be configured. To create a machine learning job:
  • Select the time range
  • Select the appropriate metric
  • Enter details: job ID, description, custom URLs, and calendars to exclude planned outages from the job
Figure 14. Machine Learning Job options

Single-metric anomaly detection uses machine learning on only one metric or field.

Figure 15. Single-metric Anomaly Detection
Multimetric anomaly detection uses machine learning on more than one metric field. In the image below, we are using two metrics over and running ml per l4 app.
Figure 16. Multimetric Anomaly Detection
Multimetric Anomaly Detection detects network activity that differs from the population of data points. Arista Networks recommends this analysis for high-cardinality data.
Figure 17. Population
This job groups data points into categories and then finds anomalies between them.
Figure 18. Categorization