How to Setup Segments and Aggregates

Overview
Segmentation and Aggregation provides the ability to aggregate flow data from various network equipment and/or segment the data for reporting and analysis by different groups such as customers, locations or departments. Flows can be segmented by almost any flow property and the data attributed to each segment is placed in a secondary source, in either your own account or any account that you have RW access to.

In this Article

Segment Properties
Adding in a new Segment
Segment Fields Explained
Adding in a new Aggregate
Aggregate Fields Explained

Segments
Segments allow flow data from one or more primary sources (e.g. an in-line Sinefa Probe or a SPAN port) to be filtered into secondary sources based on properties of the flow. The currently supported properties are:

Using the above properties, flows can be segmented into secondary sources, providing full visibility into each segment.

Example
As an example, lets say we have the following environment:

We have a mirror port and a Sinefa Probe in the DC sending traffic containing all the flows to/from the branch offices. With segmentation, we can create secondary sources that include only the traffic to/from the main Branch office which we want to identify in our reporting as Internal Subnet.

1. To create segments, navigate to the Settings > Utilization page and click on the Segments tab.
2. Click on Add new Segment

Each field explained

Example

For a different example, we have the following WAN environment:

To create a segment that filters only the flows to/from the UK, we can use the 'External Address' filter. Flow data is collected from the DC, and the UK is external to the DC, so this filter matches all flows to/from the UK subnet. We've set-up this segment to send results to the "UK" source in my own account. If you own more than one account, you can send the results to a different account. Once this is completed, you will need to Subscribe each segment you've setup.

After setting up both the UK and China, this is what my segments look like.

Navigating back to the Sources tab will show our existing Primary Source and our 2 new Secondary Sources.

The only other change to make is to toggle the Collection Point on both Secondary Sources to Internal. If we were to look at the reports for the UK, for example, our internal hosts would be reported as external and our external hosts would be reported as internal. This is because collection happens at the DC, so a host's internal/external status is determined from the point of view of the Primary Source. Changing the Collection Point to Internal reverses the direction of the flows from the point of view of the Secondary Sources.

With our Segments now created, we can now view all the reports from the point of view of our UK and China locations. 

Segmentation can also be used to segment customer's traffic in multi-tenant environments. For example, if I'm a service provider I could segment the traffic for each of my customers and provide them access to detailed visibility reports, just showing their data.

Aggregates
Aggregates are like the reverse of segments, they allow flow data from multiple Primary Sources to be aggregated into a single Secondary Source.

Example
As an example, lets say we have 2 load-balanced routers with port mirroring configured for traffic to flow to a Sinefa Probe in our data centre. We want to view this location as a single source, not as 2 individual sources.

1. To create an aggregate, navigate to the Settings > Utilization page and click on the Aggregates tab.
2. Click on Add new Aggregate.

Each field explained

Once this has been created - subscribe the new aggregate.

Navigating back to the Sources tab will show our existing Primary Sources as well as our new Secondary Source.

The only other change to make is to Suppress the Primary Sources, this means they won't report any flow data, so on our reports, we will see the Secondary Source only.

See Also
How to filter Sinefa reports
Sinefa Best Practise Guide
How to create a custom dashboard
How to setup report scheduling
How to allow Sinefa probes to connect to Active Directory Domain Controllers as a non-Administrator user
How to Setup Active Directory Username Visibility