Traffic analytics is an important component of SD-WAN. It provides an ability to have visibility to the usage of a last mile, as well as additional such as information security insights. Nepean Network’s provides advanced traffic analytics (ATA) using the Illuminate platform. This is in addition to the current network performance management abilities as well as the ability to directly use wireshark from your laptop to capture packets remotely off the edge hardware.
Besides last mile outages and the causation associated around the problems related to these, the next item that always comes up at a site is who or what is using the bandwidth. Nepean Networks is easily able to answer this using its advanced traffic analytics by providing full transparency to network activity for a site owner. These capabilities exceed those provided by most firewall vendors!
Deployment scenarios
The solution can be deployed in two ways:
directly on the SD-WAN edge where the device is configured to be used as a broadband router. This implies that it does the upstream connectivity to the ISPs using either PPPoE, DHCP, or statics. Also the edge provides the NAT layer as well as performs rudimentary port forwarding if required.
using a switch port mirror when a 3rd party firewall is used at the edge behind the SD-WAN device. The switch port mirror is configured to mirror the internal default gateway of the firewall.
The deployment of the agent to the SD-WAN device is implemented using Nepean Network's leading automation abilities. Its as easy as pie. Not only does Nepean Networks make any firewall more reliable with managing multi-links it provides better metrics as well.
Lightweight edge agent
The solutions using a lightweight agent on the edge which streams telemetry to a cloud portal. The use of compute and network resources on the edge is negligible, especially when compared to some resource hungry alternatives such as netflow/IPFIX which are debilitating slow especially and higher bandwidth speeds approaching gigabit speeds. The ATA architecture of Nepean Networks is a dramatic step up from legacy traffic visualization mechanisms and is significantly more cost effective.
The Nepean Networks standard SD-WAN offering is shipped with a 48 hour trend and statistics ability while a longer term monthly and yearly archive attracts an additional service charge. The ATA ability of Nepean Network's SD-WAN make it a viable deployment for both single and mult-link last mile installations. In actual fact, deploying Nepean Network's SD-WAN is the most cost effective traffic visualization solution on the market! And to top it all, its is better than many of those extremely expensive tools.
Inventory
One of the first abilities highlighted by a deployment of ATA is inventory. All devices at a location are detected and identified. In a typical location a user now would have a laptop, mobile phone and watch. Additional devices are cameras, printers, wireless access points, televisions and VoIP phones. In many cases IoT devices are also deployed such a roombas. ATA creates a usable inventory of all of these and provides the ability to selectively spotlight any of them.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434355670/a83ad1d6-9dd7-4a35-9dce-165268425c95.jpeg align="middle")
As an example, an organization may have a particular policy stating users at a particular site are not permitted to engage in certain activities. Often the is related to employees not being permitted to view porn. Adult education centres might also not allow bittorrent downloads or crypto-mining. ATA is ability to provide visibility to all these transgressions and record them. The ATA logs are then used and submitted in any disciplinary actions.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434386288/6100b048-417b-4e01-a65b-3e8b3a80a84a.jpeg align="middle")
The inventory is able to publish an extensive list of device attributes including vendor, category, IP and MAC address, as well as times discovered and last seen.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434414447/ab958301-3bdf-4ae9-aa43-cb8072f676e6.jpeg align="middle")
In some cases users might deploy unauthorized wireless access points that will interfere with the sites own access points. These are quickly identified,
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434456363/3b365017-9ddf-41f6-8cec-803d8d1f775e.jpeg align="middle")
Applications
Nepean Network's ATA has a best in class deep packet inspection (DPI). It is thus able to identify the significant majority of applications in use. It provides graphs and reports on these sorted from highest to lowest bandwidth use as well as dividing the use into upload and download. It quickly identifies bandwidth hogs.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434480124/75602793-c65e-4eac-b757-270899f61015.jpeg align="middle")
Name resolution
An extensive and comprehensive name resolution report exists for a site. This provides the ability to have detailed reporting on Internet usage at a site. Besides identifying each and every site to which users connect, the reports categorize connection so it is possible to see the breakdown between business use and social media use as an example.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434505209/1d7cb65c-8a4c-441d-9b23-a221380a0639.jpeg align="middle")
The abilities extend to being able to identify to which countries the most connections are being established.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434535166/b4fd676f-c9bc-431d-954a-b0809d033332.jpeg align="middle")
Malware
ATA identifies malware by being out of band to the user device. Sophisticated malware often disables the information security agent of the laptop of a user and these are in most cases these are not detected and lurk for months, even years, under the radar at a site. Nepean Networks is able to immediately detect these sneaky applications and report on them. It is also able to report on IoT devices that have been compromised as often these do not event have information security agents.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434556901/cbbb149f-db9b-4958-8303-49d1575195bd.jpeg align="middle")
This ability of ATA makes it a crucial mitigation in preventing future ransomware attacks as a site owner will have a heads up to it going down well before it is triggered. It would be able to mitigate a situation as what recently happened at the Department of Justice in South Africa which was severely impacted by a ransomware attack.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434591277/08c0065a-4580-4d85-80a4-101d6a30a929.jpeg align="middle")
Any access to known command and control servers for botnets are logged and immediately visible.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434744946/ec895627-cbf9-49ba-b51c-cda9004fa133.jpeg align="middle")
The IP address can be pasted into IBM X-Force to obtain more details. Here is an example of one that was detected with high risk!
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434709721/39e35b78-02b3-405b-8733-09d30a1825cb.jpeg align="middle")
Data leak protection
Many IoT devices, operating systems and even browsers have a call home facility. As an example you might have a camera manufacturer that is leaking information back to a jurisdiction to which you do not have knowledge. ATA identifies these breaches allowing site owners to mitigate their risks.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434787758/ca6948f4-d049-4eaf-8082-77531b56faf6.jpeg align="middle")
Network level protection
Nepean Network's ATA identifies the DHCP and DNS servers being used at a site. A site owner is thus able to identify rogue DHCP services which would disrupt connectivity at a site. It will also be able to identify unauthorized DNS servers being used in man in the middle attacks. A site owner can also audit the use of file servers. All file servers are identified included ones that use the legacy version 1 protocol that is a popular target used to propagate ransomware. Many organizations are still in whack a mole mode with a known ransomware variant known a wannacry due to these legacy systems.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434812213/62000146-b18d-4f3e-a8f0-2e91d13cd109.jpeg align="middle")
Nepean Network's ATA is also have to identify and highlight which users are accessing the dark web.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434836201/a2ab4a18-60c1-4ac7-8cd1-f5acb7d2c711.jpeg align="middle")
The ability to provide visibility into network level-protection also extends to identify encrypted connections and those connections using dated and insecure protocols that are easily compromised.
Identification of local services
All local web services (HTTP/S) and remote desktop protocol (RDP) servers are identified allowing the site owner the ability to determine if the deployment of these are authorized and valid. Nepean Network's ATA also identifies all the different types of VPNs being used at a site.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434900903/79b1ed30-ec1f-43a0-9c1c-340f399d2cf3.jpeg align="middle")
The ATA's ability even extends to being able to identify the use of 3rd party SD-WAN appliances at a site.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1722434927237/2b4ffb69-cc8d-4790-9542-05efad5ef231.jpeg align="middle")
To install Illuminate on an edge use:
wget -q -O - https://provisioning.sdwancloud.net/scripts/install-illuminate.sh | /bin/bash
Author
Ronald Bartels provides solutions to networking and last mile reliability problems. The solution from Nepean Networks allows a business to stay 100% connected, avoid downtime and keep working. The Nepean Networks solution has been installed in many vertical industries including state owned and private entities. In addition to the IBM Beacon Award 2020 for Infrastructure Services, the solution is a mature software platform that has over 2000 installed instances of multiple site private wide area networking deployments.
Ronald is dedicated to connecting Internet-inhabiting things at Nepean Networks, where connectivity excellence is the ultimate goal.
👉 Learn more: Contact Nepean
