How to enable DPI in NetFlow Analyzer?

    To enable DPI, download winPcap and HighPerformance reporting engine add-on. Follow the steps given below:
    1. For Windows machine, download and install winPcap packages from the below link :https://www.winpcap.org/install/, skip this step for linux OS.
    2. Download and install HighPerformance reporting engine under 'More Downloads' from the link https://www.manageengine.com/products/netflow/download.html

    DPI in NetFlow Analyzer

    3. Navigate to Settings > NetFlow > HighPerf Reporting Engine, provide installed server login credentials, test and save.

    DPI in NetFlow Analyzer

    4. Navigate to Settings > DPI, Enable Data Collection, select the ethernet card, select the data retention period and save. 

    DPI in NetFlow Analyzer

    5. To Verify navigate to \DPI\PcapFilesTemp and check if new file is generated. 

    How to select ethernet card?

    To find the respective Network card (in windows ) , open regedit, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\ . Here you can find the respective name of network card in readable format. 

    Ethernet Card in NetFlow Analyzer

    How to get DPI working?

    Traffic packets passing through the network device, can be mirrored to a port of the same device for inspection. Also multiple ( WAN/LAN /Uplink) port traffic can be mirrored and set for inspection. In case you wish to inspect packets from multiple devices, You can save the mirrored packets and upload it to NetFlow Analyzer server. Real time packet capture works only when Netflow Analyzer server is directly connected to the mirrored port.DPI working in NetFlow Analyzer

    In the above diagram, 4 ports 1, 2, 7 & 8 are mirrored for monitoring to the last port (port 24) of the device. Here all the mirrored network packets reaches the NetFlow Analyzer as it is directly connected. Port mirroring commands vary from vendor to vendor. You can check with the respective device vendor for commands.

    Below is an example for port mirroring on a HP Switch

    Below is the detailed cmd structure to mirror all the 23 ports to the last 24th port. 

    DPI working in NetFlow Analyzer

    DPI working in NetFlow Analyzer

    With these received network packets NetFlow Analyzer will analyze the captured packets and generate reports.