Hello,

Regarding “network performance management products should automatically establish a baseline measurement of ‘normal’ behavior” I think this can also hide informative information that Network Administrators want to see.

In other words, not all odd behaviors are alerted on rather, they are brought to the administrators attention. For example, why would a host communicate using 1200 flows to a single or just a few hosts in a 5 minute period? Sometimes this is normal so, alarming isn’t always necessary. However, the network admin may want to know that an application behaves this way as it could be an inefficient business application.

We developed Flow Analytics which incorporates many NBA traits:
http://www.plixer.com/products/scrutinizer_alarm.php

Scrutinizer takes a packet sniffer approach to NetFlow.

Sincerely,

Mike at plixer.com

Click to read the article this is in response to.