Review: Turn Network Traffic Data Into Business Intelligence

The Metron appliance can track in real time the bandwidth usage by person or department, even if users change computers or IP addresses. The appliance can also generate bandwidth usage reports sorted by user, department, date range and so on. The focus on bandwidth use can be narrowed further to track the Web surfing and chatting of individual users.

The information collected on bandwidth usage also helps maintain policy enforcement and can be used to optimize network efficiency. If budgeting demands call for it, bandwidth usage costs can be charged to individual departments.

There are many ways in which the Internet enables employees to waste time and resources. It starts with inappropriate or excessive Web surfing. Lots of chatting also takes place. Chatting during lunchtime might be acceptable, but chatting during work hours might not. The Metron reveals how employees are using a network and who is breaking the rules.

The appliance can alert an administrator when a remote desktop or other secure session is initiated, such as when an employee connects to a home computer on company time. A lawful intercept function automatically captures all traffic associated with a specific user to help organizations comply with the Communications Assistance for Law Enforcement Act (CALEA).

The Metron comes in two versions. The Metron 500 is a 1U rack-mount appliance powered by an AMD Athlon Dual Core X2 4200+ processor with 1 Gbyte of memory, 500 Gbytes of storage, integrated dual gigabit Ethernet ports and a 500-name license for $14,995. For larger networks, the Metron 2000 is a 2U appliance powered by an AMD Opteron Dual Core 265 processor with 2 Gbytes of memory, 1.8 Tbytes of storage, integrated dual gigabit Ethernet ports and a 2,000-name license for $24,995.

Additional 500-name licenses cost $2,495. Both versions of the appliance come with a 90-day warranty on the software and phone support with one year hardware support.

The Metron gets its user-to-IP-address mapping information from the bundled collection software that must be installed on the network's Active Directory server. If that's unacceptable, eTelemetry's 1U Locate appliance can map users by IP address, switch port and MAC address in real time without having to install anything on the Active Directory server. The Metron bundled with Locate and a 2,000-name license costs $34,995.

With its passive collection nodes, the Locate appliance analyzes network packets to identify network users by name in real time. It provides e-mail, instant-messaging and switch port information to identify unknown users and shut them down, if necessary, at the switch port level.

Locate stores all collected information over time to comply with Sarbanes-Oxley, HIPAA and other regulations requiring businesses to account for network use. The appliance also allows one-click connections to end-user computers for help-desk purposes, without needing an IP address.

The Locate appliance connects to a span port on the switch that hosts a network's authentication server, and a wizard will automatically integrate the appliance with Active Directory. Metron connects to a span port at the Internet Gateway.

Solution providers can configure the appliances with a remote VPN connection for troubleshooting, patch management and upgrades. An LDAP test connection utility verifies that the Locate appliance is properly connected to the network's point of authentication.

On the channel front, eTelemetry's partner program carries no up-front costs for joining, as well as no certification costs. Training and marketing support is provided free by the Annapolis, Md.-based company.

VARs receive significant discounts on demonstration equipment and can demo the products at no cost through a password-protected Web site. Generous margins, ranging from 15 pecent to 25 percent, make it worthwhile for VARs to sell eTelemetry products.