Application monitoring - adding custom applications to NetCrunch flow monitoring

NetCrunch recognizes flow traffic from thousands of applications out of the box. See how you can easily add your own definitions to correctly monitor less common or custom applications that are used in your network.

Traffic flow monitoring in NetCrunch

NetCrunch supports traffic flow monitoring of:

• Cisco NetFlow versions: v1,v5,v8,v9 and IPFIX
• Sflow and all related protocols like jFlow, netStream, cFlow, AppFlow, and rFlow.

NetCrunch comes with a pre-defined database of thousands of applications that can be recognized by NetCrunch, including definitions from Cisco NBAR. Thus, it recognizes almost all 'public' applications based on their traffic patterns. However, your network may include traffic sources that are less popular and thus not included in the database. You may also have your own or otherwise custom built applications whose traffic flows you would like to have monitored by NetCrunch.

Custom Application Ports

NetCrunch allows you to define your own applications on selected TCP or UDP ports. What's more, you can define IP address along with ports to make monitoring even more precise (in the case that the application uses only one IP address and only specific ports).

Defining an Application:

If the application's flows were sent to NetCrunch already, they will be displayed as "Application on port xxx", where xxx is the port number that this application is using. It will also be assigned to the "unknown" applications group. All applications that have no definitions (i.e. are not recognized by NetCrunch), are assigned to the unknown group automatically.

1. Click on Customize in the Flows tab.
2. If your router sent flows of your application already they will appear on the list of Custom Application like on the screen below NetCrunch automatically assigns the applications to the Unknown group. It also shows you from which IP address the flows came, and on which PORT the traffic was generated.

3. Click on the application. A new window will appear where you can set all aspects of the application:

   • Group: the name of the group where the application will be added in the "Traffic by application types" chart.
   • Application name: the name of your application.
   • Description: (optional) you can briefly describe the application for other NetCrunch users.
   • Ports: If the application was discovered by NetCrunch, it lists the IP address and Port numbers on which NetCrunch discovered it. If there are other addresses or ports used by this application, you can add them here.
4. After everything has been filled in with your desired values, you can save the definition.
5. Now NetCrunch will correctly recognize and classify all traffic flows of this application. It will be properly displayed in charts on the flows tab, and also in the flow analitycs window.

custom applicationcustom flowsport