NetFlow Analyzer - A case study

The Client

About the Company

The company;s employees are divided into the following categories :

  1. Local Market Department : (170 employees)
    • Medical Rep. 130 employees having Dell-Tables with 3G
    • Managers, Supervisors, others: 40 employees with Laptops and desktops (15 SAP users account)
  2. Geographically strategic unit: 20 Employees with laptops and desktops
  3. Administrtive Department: 30 Employees mainly with Desktops

About the Company

The company's employees are divided into the following categories :

  1. Local Market Department : (170 employees)
    • Medical Rep. 130 employees having Dell-Tables with 3G
    • Managers, Supervisors, others: 40 employees with Laptops and desktops (15 SAP users account)
  2. Geographically strategic unit: 20 Employees with laptops and desktops
  3. Administrative Department: 30 Employees mainly with Desktops

The Local Market department consists of medical representatives that access the Enterprise network via 3G using their Dell tablets. The managers and supervisors have little utilization over the SAP (usually entering the purchases in every end-of-month) with normal business utilization for the Internet and checking their Emails. Both Local Market department and the Geographically Strategic Department share a 2Mbps data leased Line between remote and the headquarters, and it is considered as a courier for the Internet, Email and any resource needed from the Datacenter Hosted in the IT Center Building.

The registration department, which is a relatively later addition, is comprised of 30 users that heavily consume network bandwidth as they rely on the network to read/write customer info into the centralized le server. Apart from this, they also use the network to download medicine certificates and email with bulky attachments.

Business Challenge

The employees experienced sluggishness in the network during certain specific hours. Employees particularly faced it in the morning between 8:30 and 10 AM, as soon as the employees login and also in the afternoon at 2 PM when the medical representatives return to the offices.

The sluggishness had a cascading effect on the employees and affects a wide range of critical business operations such as file transfers, access to the company hard-drive through the Enterprise network, ERP, CRM etc. This not only led to delay in business operations but also soared the temper levels of the employees due to the delay.


From the report shown below, it is seen that the data link is most utilized for uploading and downloading by the registration departments. The uploads and the downloads comprise records of existing and new customers. The data transfer happens between the desktops and the le server. This causes a surge in link utilization thereby affecting the speed and the performance of the network during the times when this operation is performed.

It is also seen that, email traffc is another major reason for which the network is used. When remote employees(Local Market Department) return to the office, they switch to the Enterprise network and switch of their 3G networks. This causes an additional load on the network. This also contributes to email traffic and data traffic when they upload reports for their supervisors and managers.

The traffic statistics can be seen from the figure below:

Traffic Statistics

As we can see, the analysis shows that maximum usage of the link is due to upload/download activities and constitute 55% of the total traffic (shown in green and blue).

The other major reasons for surge in traffic are Symantec checkingMS LDAP authentication, APMC email and the rest. All this causes the internet traffic from 4% to 10% in terms of link utilization.

The figure below shows the contribution of email traffic to the total bandwidth consumption.

Bandwidth Consumption

The figure below shows the High or Top required Servers, it is clear that both File server and the email are at lease utilize at least 40% of the Data link.

(SAP utilization is less than 2%)

SAP Utilization

The NetFlow Analyzer reports helped the company identify exactly where the bandwidth was being eaten. These insights proved extremely crucial in making certain vital policy-level decisions involving infrastructure investments.

The top Destination as a percentage

Destination as Percentage

Lastly but not last, the total Day Utilization (per MB)

Total Day Utilization


The users are highly impacted due to data stream congestion and associated delays on the leased line that connects the machines to the headquarters. The major reason is confirmed to be multiple users using emails and le transfer services at thesame time.

It is evident that the current bandwidth and the speed are not adequate enough to cater to the needs of the users and their ever-growing usage patterns.

Here are some possible solutions:

  1. Upgrading the leased line.
  2. Optimizing the WAN links with WAN accelerators
  3. Better capacity planning so that this doesn't recur in the future

Upgrading the leased line

Upgrading Lease Line

Here are the business benefits of upgrading the data leased line:

  1. Overcomes the data latency problem
  2. Solves the congestion issue
  3. The speed of data ow can be almost doubled with the help of buyers and queues

To ascertain that the requirements will increase in the future, ManageEngine NetFlow Analyzers Capacity Planning reports can be very helpful. These reports analyze historic data, over a certain specic period of time, the consumption pattern and helps in giving insights about future bandwidth requirements.

Upgrading a data lease line involves a list of several new set of products and services. A sample list is shown below:

  1. Data Leased Line 4Mbps Upgrade Fees
  2. Monthly subscriptions for the Data Leased Line
  3. SLA Fees 7% for the Data Leased Line
  4. Internet Leased Line (already ordered for 3yrs)
  5. Firewall (already purchased)
  6. Firewall Licenses (per year)
  7. HP Servers, Delivery 8 - 14 weeks, Cost :13,342 $

Before making such a major purchase decision, it is important to ascertain if there will be substantial increase in the bandwidth usage pattern with the help of Capacity planning reports.

If it is found that the bandwidth requirements will not increase drastically, the alternative is solution 2, which is, optimizing the WAN links with the help of WAN accelerators.

Optimizing WAN links with WAN accelerators

WAN optimization techniques are well known for increasing data-transfer eciencies across wide-area networks. WAN acceleration can have a big impact on le transfers, Microsoft Exchange, corporate databases, and many business-specific applications that rely on static les. This provides clear ROI and benefits that employees and company leaders will notice immediately, because WAN acceleration can drastically improve the speed of le transfers and the performance of many applications for your branch oces and remote workers.

To measure the effectiveness of WAN acceleration, WAAS reports act as a highly useful tool.

NetFlow Analyzer's contribution

ManageEngine NetFlow Analyzer's traffic reports have helped them understand the root cause of the problem. The various reports in ManageEngine NetFlow Analyzer have helped a great deal. Vital information such as top destinations, daily usage patterns, contribution of different types of trac, applications contributing to congestion etc.

Possible features that will help them ensure a hassle-free and a high-performing network:

  1. Capacity Planning reports
    These reports will help in understanding future bandwidth requirements that will inuence further course of action that involves considerably high investments.
  2. WAAS reports
    When the solution to the problem is WAN acceleration techniques, Cisco WAAS reports act as a solution to monitor effectiveness of WAN acceleration performance.


ManageEngine NetFlow Analyzer not only helps in pinpointing the bottlenecks but also oers a rich set of solutions that help the organization overcome its network performance issues.