NetStream Implementation

Components of a NetStream System

NetStream systems have three components: NetStream data exporter (NDE), NetStream collector (NSC), and NetStream data analyzer (NDA).

NDE
An NDE is a device configured with NetStream that performs the following:
- Analyzes and processes network flows.
- Extracts flows that meet statistical conditions.
- Exports the statistics to the NSC.
The NDE can also perform operations (such as aggregation) on the statistics before exporting them.
NSC

An NSC is a program running in Windows or Unix that parses packets from NDEs and saves the statistics to a database. It can collect, filter, and aggregate data exported from multiple NDEs.
NDA

An NDA is a traffic analysis tool that extracts and processes statistics from the NSC and generates a report. This report provides a basis for services such as traffic accounting, network planning, and attack monitoring. The NDA provides a graphical user interface (GUI) for users to easily check and analyze the collected data.

In practice, the NSC and NDA are integrated on a NetStream server.

NetStream Working Mechanism

NetStream systems work as follows:

An NDE periodically exports detailed data about flows to an NSC.
The NSC processes the data and sends it to an NDA.
The NDA analyzes the data for applications such as accounting and network planning.

In most cases, Huawei switches or routers function as NDEs in a NetStream system.

Figure 1 NetStream implementation

In Figure 1, the NDE is properly forwarding service traffic and periodically exports detailed data about flows to the NetStream server. The NetStream module on the NDE:

Samples packets (see NetStream Packet Sampling).
Creates a flow based on the collected data (see NetStream Flows)
Ages out the flow (see NetStream Flow Aging).
Exports the flow statistics (see NetStream Flow Statistics Exporting).