Lancope's StealthWatch™ Flow Replicator™ dramatically improves enterprise network performance by aggregating NetFlow, sFlow, syslog and SNMP information in a single, high-speed appliance. This high-speed UDP packet replicator gathers essential network optimisation and security information from multiple locations into the StealthWatch Flow Replicator, and then forwards this information in a single data stream to one or more StealthWatch Network Behavior Analysis (NBA) and Response appliances. Strategic deployments of the StealthWatch Flow Replicator simplify the integration of NetFlow or sFlow information within a broader StealthWatch deployment.

The StealthWatch Flow Replicator receives and transmits UDP packets containing flow information from routers, switches and servers. NetFlow and sFlow routers and switches typically only allow a single destination for flow information. The StealthWatch Flow Replicator replicates the information sent to that single destination into multiple feeds connected to multiple destinations. Network and security administrators define the rules by which aggregated information is collected and distributed, based on source IP, destination IP and destination port.

Connectionless UDP applications that can make use of the StealthWatch Flow Replicator include:

• NetFlow records sent from multiple routers can be replicated to multiple NetFlow collectors, eliminating the need for multiple NetFlow destination specifications in the NetFlow exporter configuration.
• sFlow samples sent from sFlow routers and switches replicated to multiple sFlow collectors. As with the NetFlow example, this use removes the need for multiple sFlow destination specifications in the sFlow exporter configuration.
• Syslog messages can be automatically replicated to multiple syslog collectors
• SNMP traps from routers, switchs and other network devices can be automatically collected and distributed to multiple SNMP management stations.

The StealthWatch Flow Replicator uses a hardened Linux operating system running on a standard 1U rack mount chassis. An integrated HTTPS Web-UI, plus serial and KVM access to the CLI provide management access to the appliance. Each StealthWatch Flow Replicator can process sustained input up to 6000 UDP packets per second, and sustained output up to 20,000 UDP packets per second. Any connectionless UDP application, such as NetFlow, sFlow, syslog or SNMP, serves as an appropriate and supported data source.

The StealthWatch Flow Replicator Advantage:

• Simplifies network device configuration, since only one collector destination must be configured on the router or host. All devices across the enterprise can have a single, standardised collector destination, yet flow information can be received wherever it is needed
• Reduces network traffic, since routers and switches only need to send one stream of data to the StealthWatch Flow Replicator
• Reduces the load on routers and switches since a single collector destination reduces the amount of work required when sending UDP packets to the collector