H3C Technologies H3C SecBlade NetStream Cards - Manual (Page 155)

140
How NetStream works
A typical NetStream system comprises three parts: NetStream data exporter (NDE), NetStream collector
(NSC), and NetStream data analyzer (NDA).
• NDE
The NDE analyzes traffic flows that pass through it, collects necessary data from the target flows, and
exports the data to the NSC. Before exporting data, the NDE may process the data like aggregation. A
device with NetStream configured acts as an NDE.
• NSC
The NSC is usually a program running in Unix or Windows. It parses the packets sent from the NDE,
stores the statistics to the database for the NDA. The NSC gathers the data from multiple NDEs, then
filters and aggregates the total received data.
• NDA
The NDA is a network traffic analysis tool. It collects statistics from the NSC, and performs further process,
generates various types of reports for applications of traffic billing, network planning, and attack
detection and monitoring. Typically, the NDA features a Web-based system for users to easily obtain,
view, and gather the data.
Figure 46 NetStream system
As shown in Figure 46 , the following procedure of NetStream data collection and analysis occurs:
1. The NDE, that is the device configured with NetStream, periodically delivers the collected statistics
to the NSC.
2. The NSC processes the statistics, and then sends the results to the NDA.
3. The NDA analyzes the statistics for accounting, network planning, and the like.
NOTE:
•
This document focuses on the description and configuration of NDE.
• NSC and NDA are usually integrated into a NetStream server.
Key technologies of NetStream
Flow aging
The flow aging in NetStream enables the NDE to export NetStream data to the NetStream server.
NetStream creates a NetStream entry for each flow in the cache and each entry stores the flow statistics.