NetQos Report Analyser:

Introduction:

This document covers the Colliers NetQos link utilization reporting and analysing tool which captures all
the traffic that is passing IN and OUT of the Colliers CE router outside interface.

This document has tried to explain about how to check the link utilization and how to analyse the link
utilization and how to convert them into reporting.
This part of the document can be used by both administrator and end user and any new team member
who newly joins the team and want to understand about this tool.

This document has also tried to explain how to create a new user accounts and new groups.
This part of the document can be used only by administrator, who has the administrative rights to create
user account and groups.

This document has used the screenshots to explain the tool and its usage.

NetQos:

NetQos is a CA product and is used for link utilization reporting and analysis. Colliers uses NetQos to
capture traffic flow occurring IN and OUT of the Colliers CE router egress or outside interface. So this tool
will capture internal traffic traveling to MPLS cloud and external traffic coming from MPLS cloud. Colliers
uses NetQos tool only for the sites that are connected to MPLS cloud.
For any technical or administrative issues, we have premium membership account with CA and their
contact details are mentioned at the end of this document.

NetQos upgrades:

NetQos was recently upgraded on 30th August 2013 and all historic data till 30 th August 2013 was moved
to server 10.168.175.174, while all the real time data from 30 th August 2013 exist in the server
10.168.176.76

Administrative task:

Following are the administrative task for any new site to be added in NetQos:
 Configure NetFlow in the CE router.
 Configure SNMP in the CE router
 Add the user account in the NetQos
 Add the groups in the NetQos

NetFlow:
  Colliers configure NetFlow to capture the incoming and outgoing MPLS traffic that hits the Cisco
CE router outgoing interface.
 Colliers uses NetQos report analyser tool, a CA product for link and bandwidth utilization and
reporting.
 NetQos communicates with MPLS CE router outgoing interface using SNMP community string
“coll01” and the CE router outgoing interface export the traffic utilization to the NetQos server
(10.168.175.212) on IP and Protocol basis, which NetQos server will further convert this
captured traffic into a graphical output.
 Colliers has implemented NetFlow on its entire NA region CE routers that are connected in the
MPLS cloud and the NetQos report analyser tool provides the utilization report for the entire NA
region MPLS connected CE routers.

Below is the configuration for NetFlow:

ip flow-export source Loopback0
ip flow-export version 9 ---------------- > These commands are configured in Global
ip flow-export destination 10.168.175.212 9995 configuration mode

ip flow ingress ---------------- > These commands are configured under outgoing
ip flow egress interface and sub-interface of the CE router

SNMP:

SNMP is used for monitoring the network devices carried out by the snmp-server tool that periodically
do polling of the network devices to capture the device health report, utilization report, interfaces status
etc.

Colliers all internal tools that communicate with network devices (routers and switches) uses community
string “coll01”.
NetQos also uses the community string “coll01” to communicate with CE router outgoing interface.

Below are the SNMP commands that are configured on the CE routers.

snmp-server community coll01 RO ----- > Read-only community string for internal monitoring tools
snmp-server community coll01s RW ----- > Read-write community string for internal monitoring tools
snmp-server host 10.168.175.212 coll01 ----- > This command is for NetQos server as a SNMP-Server
snmp-server trap-source GigabitEthernet0/1.51 ----- > This command sends traps from outgoing
sub-interface

Adding user account in NetQos:

Below are the procedure and the screenshots to create user account.
 First login to NetQos tool using Internet Explorer or Google Chrome. (Google Chrome is
preferred application).
http://10.168.176.76

Use the administrative account to login in to the below page.

 Once logged in, click the “Administration” tab at the top menu to get inside the administrative
tasks.
 Once we are in administrative page, click the “User” section shown in the left side of the page.

Administration ---- > Authentication ---- > Users

 Once we click on the “Users”, it will take us to the list of user accounts configured in the netqos.
 The above user account list contains Administrator and User accounts. Administrator accounts
are created with Admin permissions, while User accounts are created with read-only access.
 ISA and Service-desk are provided user accounts with read-only access.
 ISA’s has user account name based on the site or location name and password remains the same
as user name. Groups allowed for each ISA are only those site which they manage.
 While Service-desk has user account name as “servicedesk-PST“ and “servicedesk-EST” and
password as “service-desk” for both accounts. All groups permission are allowed for service-desk
user accounts. Based on the site timezone, service-desk team will use the user account to access
NetQos and capture the traffic utilization report.

 To create any new user account, click “ADD” button. To modify any existing user account, select
the check-box next to user account and click the “EDIT” button.

 To create a new user account, click “ADD” button. In the below screenshot the fields are updated
with example.
  Under “Permission Groups”, we can select all sites or all groups from “Available groups” to
“Assigned Groups” or specific groups to “Assigned Groups”.

 All groups are available by default, while specific groups need to be created under “Groups”
section, which is explained in the below document.

 If the user account is “Administrator”, then select “Administrator“ privilege for NetVoyant and
NetQos Performance Center and then click “SAVE” button, as showed in the below screenshot.

 If the user account is “User”, then select “User“ privilege for NetVoyant and NetQos
Performance Center and then click “SAVE” button, as showed in the below screenshot.

Adding group in NetQos:

 In the above document we saw, how to create user account and while creating user account, we
assign permission to each user account to a particular group or all groups.
 All groups exist by default, while to create a particular group, follow the below screenshot in
continue to the above screenshots.

 Click the “Admin” tab from the menu bar and then click “Groups” as shown in below screenshot.
This will take us to the Groups page.

 Click “Add Group” tab to create a new group.

 In the below “Add Group” window enter the details and click check-box as shown in below
screenshot and then click “SAVE” button.

 Below screenshot shows group name as “Colliers-Pune” as sample.

 Group name “Colliers-Pune” got added in the left side of the screenshot. Now select and click
“Colliers-Pune” group and we will get a page with “Add Item Type” in the right side to add the
sites we want to add them in the group Colliers-Pune.

 Click “Add Item Type” in the below screenshot.

 “Add Items” window appears and this will list currently “Available Items” as shown in the below
screenshot.
 Select “Devices” from the drop-down menu at the top of the “Add Items” window as shown
below.
 Below screenshot displays list of available items under “Device” type.
 Under the search bar, type the item you want to add under “Colliers-Pune” group.
 As an example, we add Pune router in to the “Colliers-Pune” group by searching the Pune router
interface IP address or by hostname in the search bar in the below screenshot.
 Click the check-box next to the device name and then click the “CLOSE” button.

 The Pune router interface got added in the “Colliers-Pune” group.

 Now if we have to go back to “Users” page then click Admin tab ---- > Users and then add the
Colliers-Pune group in the “Permission groups” of the user account, as shown in earlier
screenshot while creating a new User Account.
  If we have to go back to the list of Interfaces or devices that we see in the main page as soon as
we login then click Admin tab ---- > click Reporter@10.168.176.76

Reporting and Analaysing link utilization:

Below screenshot shows how to capture and analyse traffic from a particular site and link.

 First login to NetQos tool using Internet Explorer or Google Chrome. (Google Chrome is the
preferred application).
http://10.168.176.76
 Use the User account or Administrative account to login in to the below page.
 Once logged in, click the any site router from the list of routers showed in the below screenshot.

 Expand the site router or interface by clicking the site you want to capture the traffic utilization.
 Once we expand the site link, we will see LAN and WAN interfaces, and these information is
captured from the router by the NetQos using NetFlow and SNMP protocol.
 This information also covers interface description, Speed, interface active status.
 Interface Active status in the below screenshot means “NetFlow” is configured in that interface.
 In the above Edmonton site, WAN interface Gig0/1.136 is configured with NetFlow and we are
going to capture traffic utilization for this interface.
 Click interface “Gig 0/1.136” from the above screenshot. Below are the lists of screenshot that
appear in the same page.

 The reporting page get open and displays the overview of the traffic utilization report that covers
traffic send and received using protocols, traffic send and received using TOS, traffic send FROM
local host, traffic send TO remote host and TOP Talkers.
 We need to define the interval and the time-period for the report that we are generating.
 Below screenshot will guide us to set the date and time and the period for which we are
generating the report.

 In this example, we are generating report for the traffic utilized on 6th September from 8 am to 6
pm PST for the Edmonton site.
 In the below screen, we set the date as 6th September 8 am PST to 6 pm PST and then click
“SET”

 Once we set the period and date and time, the report will get generated for the traffic send and
received using protocols, traffic send and received using TOS, traffic send FROM local host, traffic
send TO remote host and TOP Talkers.
 The below screen shot is for the Inbound Protocol traffic. Right side we can see the total link
bandwidth as 10 Mbps and the right side of the graph shows list of protocols with their color
coding.

 Report says Inbound HTTP traffic was on peak at 10 pm PST using bandwidth of 7 Mbps.
 While Inbound HTTPS traffic was at peak at 10 pm PST using bandwidth of around 6 Mbps.
 The below screen shot is for the Outbound Protocol traffic. Right side we can see the total link
bandwidth as 10 Mbps and the right side of the graph shows list of protocols with their color
coding.

 Report says Outbound HTTPS traffic was on peak at 5:45pm PST using bandwidth of 800 Kbps.
 While Outbound HTTP traffic was at peak at 9pm PST using bandwidth of around 800 Kbps.

 Below TOS report is a continue of the above protocol report.

 The below TOS report is based on the QOS defined in the router.

 TOS inbound report says the Default traffic was on peak at 10 pm PST using bandwidth of 7
Mbps.
 TOS outbound report says the traffic marked with AF21 was on peak at 10 pm PST using
bandwidth of 7 Mbps.
 While the TOS outbound report says the Default traffic was on peak at 6 pm PST using
bandwidth of 750 Kbps.
 While the TOS outbound report says the traffic marked with AF21 was on peak at 6 pm PST and 9
pm PST using bandwidth of 800 Kbps above.

 Below screenshot shows the traffic generated FROM particular host is a continue report of the
earlier Protocol and TOS traffic report.

 This screenshot shows the traffic generated FROM a particular local host. The Host generating
traffic will show either in hostname or IP address. While sending the report to end user we need
to resolve the IP address to their hostname using windows “Nslookup” or “ping –a <ip address>.
Then send the end user both IP address and their Hostname. Sample mail is addressed in the
end of the document.

 The below screenshot says 132.245.3.220 host is generating the most amount of traffic.
 The host 132.245.3.220 is generating 2.33 GBytes of traffic, which is alone using 20.16 % of
Edmonton site total bandwidth of 10 Mbps.
 This screenshot shows the traffic generated TO a particular local host.

 The below screenshot says host edmokeatingm2.na.corp.local (207.61.65.67) is receiving the

most amount of traffic.
 The host edmokeatingm2.na.corp.local (207.61.65.67) is receiving 4.49 GBytes of traffic, which
is 35.65 % of Edmonton site total bandwidth of 10 Mbps.
 Below report for the TOP Talkers is a continue report of the earlier report of Protocol and TOS
report and Host generating and receiving traffic report.

 The below screenshot of Top Talkers report is a combination of earlier screenshot of Host FROM
and Host TO report.

 In the below report, the host 132.245.3.220 is communicating to host

edmokeatingm2.na.corp.local (207.61.65.67) using 2.28 GBytes of traffic which is 16.61 % of the
Edmonton site total bandwidth of 10 Mbps.
 You can get into the forensic report of what actual time the host 132.245.3.220 was
communicating to host edmokeatingm2.na.corp.local (207.61.65.67), by clicking the traffic
report.

 Last 2 Hrs period for the communication happened from host 132.245.3.220 to host
edmokeatingm2.na.corp.local (207.61.65.67).
 Last 8 Hrs period for the communication happened from host 132.245.3.220 to host
edmokeatingm2.na.corp.local (207.61.65.67).

 Till now this document explained us the “Overview” of the traffic utilization.
 We can also take separate report based on Protocols, TOS, Hosts and Conversation by selecting
from the drop down menu as showed in the below screenshot.
 The report for Protocols, TOS, Hosts and Conversation will be same as explained in this
document earlier, because “Overview” document contains the collective reports of all these
components.

 By clicking “Print” option at the right top corner of the page, we can save the traffic utilization
report in a PDF format and then send it to the end user.
Contact details:

CA support:

For NetQos related issues, contact CA technical support team and their details are below
CA Helpdesk and technical support contact number ------ > +1 800 225 5224
technicalsupport@ca.com ------ > CA Helpdesk and technical support

Appendix:

Below is the sample pdf format.

Edmonton report ---

September 06 --- 8 am to 6 pm.pdf

Below is the sample mails send to customer and end users in the past.
 GLA location netqos Washington DC Link
report for last 24 hrs and during peak
Utilization
hrs.msg
Report for 22nd July.msg