User's Guide
Table Of Contents
- ExtremeAnalytics® User GuideVersion 8.4
- Legal Notices
- Trademarks
- Contact
- Extreme Networks® Software License Agreement
- Table of Contents
- ExtremeAnalytics™ Help
- ExtremeAnalytics Licensing
- Configuring Enhanced Netflow for Extreme Analytics and Extreme Wireless Contr...
- How to Deploy ExtremeAnalytics in an MSP or MSSP Environment
- ExtremeAnalytics Tab Overview
- ExtremeAnalytics Dashboard Overview
- ExtremeAnalytics Insights Dashboard
- ExtremeAnalytics Tracked Applications Dashboard
- ExtremeAnalytics Browser Overview
- ExtremeAnalytics Application Flows
- ExtremeAnalytics Fingerprints Overview
- ExtremeAnalytics Custom Fingerprints
- Delete Custom Fingerprints
- Custom Fingerprint Examples
- Create Custom Fingerprints Based on Flow
- Create Custom Fingerprints Based on Destination Address
- Create Custom Fingerprints Based on Application or Application Group
- ExtremeAnalytics Packet Captures
- ExtremeAnalytics Configuration Overview
- Virtual Sensors
- ExtremeAnalytics Engine Advanced Configuration
- Flow Collection Type
- Collection Privacy Levels
- Client Aggregation
- Slow Client Data
- Max End-Systems in Hourly Details
- Sensor Log Levels
- Store Application Site Data
- ExtremeControl Integration
- Flow Sources/Application Telemetry Sources
- Web Credentials
- Configuration Properties
- Sensor Modules
- Auditing
- Network Settings
- ExtremeAnalytics Reports
- ExtremeAnalytics Report Descriptions
- Report Descriptions
- Analytics Events
- Bandwidth for a Client Over Time
- Interface Top Applications Treemap
- Sites Using the Most Bandwidth
- Most Popular Applications
- Most Used Applications for a Client
- Most Used Applications for a User Name
- Network Activity by Site
- Network Activity by Client
- Network Activity by Application
- Slowest Applications by Site
- Top Applications Group Radar
- Top Applications Radar
- Top Applications TreeMap
- Top Applications for Interface
- Top Applications for Server
- Top Clients by Interface
- Top Interfaces by Application
- Top N Applications
- Top N Clients
- Top N Servers
- Report Descriptions
- Add and Modify Fingerprints
- Add Fingerprints
- Enable or Disable Fingerprints
- Modify Fingerprints
- Update Fingerprints
- Custom Fingerprint Examples
- How to Deploy ExtremeAnalytics in an MSP or MSSP Environment
- ExtremeAnalytics Virtual Sensor Configuration in Extreme Management Center
- Stream Flow Data from ExtremeAnalytics into Splunk
- Stream Flow Data from ExtremeAnalytics into Elastic Stack
Flow Information Sources
50 of 218
ExtremeAnalytics engines. There is also a 25,000 client limit per engine for most
license types. However, if you have an NMS-ADV license without any
ExtremeAnalytics license, the per-hour total limit is 100 clients across all
ExtremeAnalytics engines.
Flow Information Sources
The ExtremeAnalytics engine uses NetFlow or SFlow records from the switches
and wireless controllers in your network as a source for flow data. Information
such as IP addresses, ports, and bytes transferred comes from this flow data
source.
This data is augmented with additional layer 7 application information produced
by the ExtremeAnalytics engine through deep packet inspection. Information
such as application name and network response time comes from this source.
There is additional information that can be obtained from sources other than
NetFlow/SFlow records and deep packet inspection.
NOTE: Most of these sources rely on ExtremeControl data. If ExtremeControl is part of your network
configuration, then ExtremeControl integration can be enabled (see instructions below) to
provide access to these sources. Site data is obtained from sites configured in Extreme
Management Center.
The following is a list of information that can obtained from different sources:
l Hostname — The client or server's hostname can be derived using ExtremeControl.
ExtremeControl integration must be enabled.
l Site — The site for a flow is the site of the client in the flow. Client and server sites
are derived from the sites configured on the Network tab. If a client does not match
a site, then the site is empty. If a flow has a site, the flow is considered to be in-
network.
l Detailed Site — Detailed site information is derived from the switch and
port information resolved for the client end-system. ExtremeControl
Integration must be enabled.
l Device Family — The device family is a general description of the operating system
detected in the client, for example, Windows, Linux, or Android. The device family is
derived from network packet inspection. The device family can also be provided by
ExtremeControl, if ExtremeControl integration is enabled.