Requirements

This document describes the installation steps and configuration of the Progress Kemp Flowmon Anomaly Detection System (ADS) module.

• The ADS module detects suspicious network traffic patterns and anomalies using flow statistics. You can generate flow statistics from various sources including:

  • Routers
  • Switches
  • Firewalls
  • Flowmon Probes

  The module supports NetFlow v5/v9, IPFIX, and other compatible flow data formats. We do not recommend using sFlow because the insufficient quality of source data might affect the effectiveness of some detection methods.

• Flowmon ADS can be deployed on:

  • Flowmon Collector – stores and analyzes flow statistics in all major industrial formats (NetFlow v5/v9, IPFIX, sFlow, and other NetFlow-compatible technologies) from thousands of sources.

  • Flowmon Probe – includes a built-in collector that enables you to deploy Flowmon ADS. The built-in collector processes flow statistics from the probe itself only and cannot receive data from other flow exporters.