Scrutinizer

Dell® SonicWALL® Scrutinizer is a multi-vendor, application traffic analytics visualization and reporting tool to measure and troubleshoot network performance and utilization while increasing productivity for enterprises and service providers. Scrutinizer supports a wide range of routers, switches, firewalls, and data-flow reporting protocols, providing unparalleled insight into application traffic analysis from IPFIX/NetFlow data exported by Dell SonicWALL firewalls. Scrutinizer easily identifies top applications, conversations, flows, protocols, domains, countries, subnets and alerts on suspicious behavior. Scrutinizer also provides historical and advanced reporting, role-based administration, advanced analysis and threshold-based alerts,1in addition to numerous special features for MSPs and ISPs2.

+

Visualization Tools

Granular analytics and reporting.

IT can perform analysis and create reports based on top hosts, protocols, ports, applications, network traffic, VPN traffic, VoIP traffic and conversations across all network realms and devices.  Flexible analysis options can display trend data in bits, bytes, packets or percent of total bandwidth consumed on a periodic basis down to the second. Scrutinizer offers support for both IPIX and flexible NetFlow using fully customizable report templates and can trend in, out, or both at the same time.  Filters can be used to include or exclude data on any field exported in the templates (e.g., MAC Address, VLAN, latency, country, domain, subnet, IP grouping, etc.).  Scrutinizer can save all flow records for an unrestricted amount of time.

Powerful visualization tools.

Intuitive visualization tools list top interfaces across all routers, switches and firewalls to display real time or archived application traffic data using interactive charts, tables and Google® Maps, with an innovative matrix view to show flow fields, and network maps showing relevant flow data.

Enhanced forensics capabilities.

Administrators can use Scrutinizer to trend results to identify, and get an alert on unauthorized applications, malicious traffic, known-compromised internet hosts, Flow Sequence Number violations, DNS cache poisoning, rogue IP addresses, DHCP and mail servers, port scanning, excessive multicast traffic, HTTP hijacking and DDOS attacks.

+

Network Optimization

Dell SonicWALL Application Traffic Analytics.

Administrators can enhance network optimization with a unique application flow analytics solution that combines Dell SonicWALL Next-Generation Firewall and Dell SonicWALL Scrutinizer. The firewall transmits IPFIX data in real-time to the traffic analyzer collector application, where the administrator can examine usage data by application or user, look at data over different time periods and much more. While some firewall vendors do provide NetFlow support or IPFIX support, only Dell SonicWALL offers this level of application traffic detail.

+

IPFIX & NetFlow Support

100% IPFIX and flexible NetFlow support.  

Scrutinizer enables administrators to define Application Groups using ranges of applications, ports and IP addresses. Administrators can also apply Dell SonicWALL-specific templates, rename templates, save filters, schedule reports to be sent out via email and export .CSV files for billing purposes, customize billing for usage invoicing, set up default landing pages by account login (useful for service providers servicing multiple customers), and save all records and flows for an unrestricted amount of time.

Third-party support.

Scrutinizer is compatible with hundreds of routers, switches, firewalls and other network devices regardless of vendor to monitor thousands of interfaces simultaneously. Scrutinizer supports all industry standard data flow protocols including NetFlow v5, NetFlow v9, Flexible NetFlow, J-Flow, sFlow and IPFIX.  The optional Cisco Advanced Reporting Module and the Citrix Advanced Reporting Module provide extensive support for Cisco equipment and Citrix equipment respectively.

+

Troubleshooting Tools

Customizable alerting.

Administrators can set alerts to trigger upon interface utilization, unfinished flows, nefarious activities, and degraded voice and video traffic. Scrutinizer’s unique index-per-alarm feature displays how many other alarms the host has violated. Various alerting and notification options including SNMP traps and script execution also facilitate automatic remediation processes.

Flexible administration.

Administration is a breeze with the central, easy-to-use console. Dashboards can be customized per login.  Permissions can be set at the individual user and group-level to access flows for specific router, switch, and firewall interfaces. The Scrutinizer Cross Check Module provides integration with third party monitoring and flow analytic tools such as WhatsUp Gold and Orion. Service providers can easily modify style sheets to match branding.

Bring your analytics solution to the next level with Scrutinizer Add-On Modules.

Flow Analytics Module

Service Provider Module

Cisco Advanced Reporting Module

Citrix Advanced Reporting Module

Cross Check Module

Flow Analytics Module.

The Dell® SonicWALL® Flow Analytics Module brings traffic flow diagnostics to the next level by adding valuable functionality to Dell SonicWALL Scrutinizer software, such as historical reporting for an unrestricted period of time, advanced alarming with the ability to set thresholds and facilitate automatic remediation, role-based administration, and in-depth traffic analysis algorithms. With the Flow Analytics Module, Scrutinizer can easily identify top applications, conversations, flows, protocols, domains, countries and subnets on the network, as well as watch for and alert on suspicious or potentially hazardous network behavior patterns, thereby providing administrators with greater network security awareness. Benefits include:

Flexible reporting.

The Flow Analytics Module adds advanced reporting options such as flow volume, MPLS by subnet, Microsoft® Exchange log trending and NBAR support. Administrators have with a wealth of information right at their fingertips.

Custom reports.

IT administrators can create custom reports by applying filters to granularly define the specific information desired. Once created, custom reports can be saved for later use.  Custom reports allow the user to configure detailed reports by filtering on fields such as IP Addresses, ranges and subnets; port numbers and ranges; defined applications including ranges of protocols and groups of protocols; multiple interfaces from different routers and switches; any exported field available via NetFlow or IPFIX; dynamic Quality of Service (QoS) monitoring; and detailed security/forensic information.

Traffic analysis reports.

The Flow Analytics Module adds several additional flow based traffic analysis report types. Examples include granular IPFIX based application visualization reports for Dell SonicWALL products; flexible NetFlow NBAR based application reports (requires IOS v15 on Cisco routers); conversations to/from host pairs and applications used; flow reports with ToS field; host flow reports to show hosts sending or receiving the most flows; host volume reports to show the volume of unique hosts per second; and pair volume reports to show the volume of unique to/from address pairs per second.

Set It and Forget It alerting.

The Flow Analytics Module provides administrators with greater automation control, making routine advanced reporting a snap. Alerts can be configured based upon everything from unfinished flows to specific interface utilization. Administrators can configure QoS thresholds to proactively be alerted of RTSP latency and jitter before end users even reports a problem. Using saved Scrutinizer reports, the Flow Analytics Module can monitor and send out syslogs when traffic patterns violate specified thresholds.  Scrutinizer facilitates automatic remediation via support for SNMP traps and script execution.

Enhanced security awareness.

The enhanced security functionality alone makes Scrutinizer with Flow Analytics an invaluable tool in an administrator’s arsenal. It shows exactly what is happening on the network—where traffic originated, where it is going and what type of traffic it is. Is someone planning an attack by scanning the corporate network? Did one of the servers get infected with malware and launch a DDoS attack? Scrutinizer can automatically detect nefarious activities and alert administrators immediately.

Advanced troubleshooting.

Valuable troubleshooting tools allow Scrutinizer to easily identify the volume of flows per hosts and peer into Voice over IP (VoIP) traffic. IT administrators can analyze VoIP traffic and determine the amount of voice traffic into and out of the network over time; what users are involved with the most VoIP traffic; the caller ID of destination and source; QoS statistics such as Latency/Jitter and packet loss of each call; what audio codec is being utilized; and whether the router is modifying DSCP values.

Network topology maps.

Network topology maps come to life in Scrutinizer as links change in color and thickness with variations in network utilization. Clicking on a link in a network topology map brings up useful traffic statistics such as top talkers and top conversations within the last minute.

Google maps.

IT administrators can use Scrutinizer to plot network appliances such as firewalls, routers and switches on a Google® map embedded in the Scrutinizer application. Using this geographic map as a starting point into all network analysis provides traffic details collected and organized for easy visualization in Scrutinizer.

Dell SonicWALL Specific IPFIX Templates for Reporting.

Administrators can use Scrutinizer to obtain deep insights into application usage as detected by Dell SonicWALL Next-Generation Firewalls. The Dell SonicWALL firewall transmits IPFIX data in real-time to Scrutinizer and the administrator can examine application usage, VoIP usage, VPN usage, and much more by user and over different time periods. While some firewall vendors do provide NetFlow support or IPFIX support, only Dell SonicWALL offers this granular level of application traffic detail.

Service Provider Module.

The Dell SonicWALL Service Provider Module (only available as an add-on for Dell SonicWALL Scrutinizer with the Flow Analytics Module,) adds several features that are especially useful for Managed Service Providers (MSPs) and Internet Service Providers (ISPs). Benefits include:

Easy customization.

Administrators can easily customize permissions, modify style sheets and default landing pages with the Service Provider Module. Several default sheets are even included.

Customizable billing solutions.

The Dell SonicWALL Service Provider Module enables customizable invoicing and billing solutions based on actual network usage, and eases data export to Microsoft Excel in .CSV format.

Enablement of traffic and usage based billing.

The Scrutinizer Service Provider Module allows service providers to export flow data based on any flow (NetFlow, IPFIX, sFlow, etc.) field or combination of flow fields including rate per second, packets, total bits, IP addresses, ToS (DSCP) or BGP autonomous system (AS) number. This data can then be used to invoice end customers based on actual network usage rather than WAN connection speed.

Increased invoicing options.

The Service Provider Module routinely exports a custom .CSV file with all the required details.  For example, it allows billing based on a flat rate versus a burst rate as well as total amount transferred per month. More traditional billing is also possible, for example, where the end customer pays based on the 95% percentile technique.

Customized reporting options.

Using the intuitive configuration interface, any saved report in Scrutinizer can become the basis for an export. To ensure the highest accuracy, data is gathered from the raw flow data tables. The Service Provider Module also includes the following capabilities:

• Any NetFlow field or range within a field is saved as part of the filter within a report
• The entire contents of any report type can be emailed or exported in CSV format
• Exports occur on a periodic basis.
• Rolling the data into larger intervals is possible.
• Exports are emailed or saved in a directory with a custom name and time stamp.
• Scheduled routines:
  • Prepare the data for further processing
  • Write the data to another server

Mashups for easy accessibility.

Utilizing simple web technology, Scrutinizer allows anyone to easily assemble a URL into a mashup or third party application to directly import and display important information regarding the activity of a specific host or application on your network into the Scrutinizer dashboard.

Customer portal.

IT administrators can choose to provide end users are with secure login access to the flow data generated by their network devices. End users can also use the customer portal to troubleshoot bandwidth usage and identify/analyze odd traffic patterns. Additionally, automatic HTML reports can be scheduled for each end customer. Service providers can use the portal as a message board to communicate with their customers as well as integrate other applications into the MyView interface.

Cisco Advanced Reporting Module.

The Dell SonicWALL Scrutinizer Cisco Advanced Reporting Module is a value added performance monitoring and reporting solution for Cisco Smart Logging and Telemetry, Cisco TrustSec (CTS), Cisco Performance Routing (PfR) and Cisco Medianet. Scrutinizer delivers detailed reports on all traffic related to voice and video. IT staff can easily use this module to troubleshoot issues related to video or voice by using Scrutinizer to analyze the appropriate flow.

With the Scrutinizer Cisco Advanced Reporting Module, Scrutinizer can be configured to analyze and alert on excessive amounts of one or a combination of the following parameters:

• Round Trip Time (Latency)
• Jitter
• Packet Loss
• Bits, Bytes and Packets
• MAC Addresses, IP Addresses
• VLANs
• Domains
• Applications
• Interface

Citrix Advanced Reporting Module.

The Dell SonicWALL Scrutinizer Advanced Citrix Reporting Module brings enhanced support for Citrix equipment by adding granular drill-down capabilities for:

• URLs providing reporting insight into web servers and databases being accessed
• Applications providing reporting insight into applications being accelerated via NetScaler
• Latency providing reporting insight into the health and delay as seen by NetScaler

Note: Citrix NetScaler makes applications and cloud-based services run five times better by offloading application and database servers, accelerating application and service performance, and integrating security.

Cross Check Module.

The Dell SonicWALL Scrutinizer Cross Check Module provides integration with third party monitoring and flow analytic tools such as WhatsUp Gold, Orion, SNMPc, Uptime Devices and Nimsoft. This module includes the following capabilities:

• Cross Check takes inventory of all network devices managed by other analytic tools displaying several attributes including device name, IP address, and status.
• Flowalyzer Poller continually assesses the status of devices identified by Cross Check and provides updates to Scrutinizer via IPFIX messages.
• Cross Check references the status of devices as known by Scrutinizer with other third party management products to monitor if flow data is arriving properly and whether devices are being polled correctly
• Fault index measurements indicate device status across numerous management systems using configurable severity levels. Syslog notifications can be sent out if predefined threshold levels are met.
• Clickable inventory item listings provide users with direct links to integrated third party applications and easy access to devices that are managed via these other applications.
• Inventory groupings can be created allowing for easy monitoring of network segments regardless of whether the appliances are managed by Scrutinizer or a third party application.
• Cross Check was created in direct response to large MSP and enterprise customer demands for integration with third party monitoring applications.

Software

Software Upgrades

Software Support