Distributed Architecture

Distributed Architecture can be used for load balancing of the processing by utilizing more devices. The processing nodes work separately and use only the flows on the given node. It is necessary to have the whole context for a given network segment on a single node to provide maximal precision. Distributed architecture allows central management and configuration. Each node has the same configuration. The node is a separate hardware or virtual Flowmon instance with the Flowmon ADS application. The encrypted communication between nodes uses the SSH protocol. Each of the processing nodes has to use the same Flowmon ADS license.

Node types

Master

This node manages the whole architecture. It provides the user interface, collects and stores the events from all Slave nodes, and allows you to configure all nodes. The Master node generates and sends PDF reports, reports the events through email/SNMP/Syslog, and triggers the custom scripts and traffic captures. There is no direct data processing. The Master node must have network access to the IP addresses of all Slave nodes or to the IP address of the Proxy node if present. There can be only one Master node in the architecture.

Proxy

This node transmits the information between the Slave and Master nodes. The Proxy node does not provide the web user interface and does not process the data. The Proxy node must have network access to the IP addresses of the Master node and all the Slave nodes. There can be more Proxy nodes in the architecture, but this type of node is not required.

Slave

This node processes the data. This node does not have a web user interface. The Slave node must have network access to the IP address of the Proxy node (or to the Master node if there is no Proxy node in the architecture).

Proxyslave

This is a Slave node that is concurrently used as a Proxy node.

Deployment modes

The ADS distributed architecture can operate without the Flowmon distributed architecture. With the Flowmon distributed architecture enabled, the Flow Distribution Model in the architecture must be set as the Flow Source Related model to keep the whole context for the given network segment on a single node. Only one Master node is supported. The Top Priority Master Unit (TPM) should be used as a Master node for the ADS distributed architecture if there are more Master nodes available.

Master Slave Mode

This is the simplest configuration available. It requires one Master and one or more Slave nodes.

Master Proxy Slave Mode

If the Master node can communicate with the Slave units directly, the ADS distributed architecture can be enabled on the Master and Slave nodes only. It is not necessary to use a Proxy in this case.