Webinar: Top Tips for Effective Cyber Threat Hunting Watch Now
FlowTraq > Company News > InterMapper Flows 1.2

InterMapper Flows 1.2

By | November 18, 2009


This last week, we released to Dartware the final build for InterMapper Flows 1.2, the main commercial version of our NetSAW engine. Let’s take a quick look at what’s been updated with this release.

Under the hood, we’ve taught the Flows collector a few tricks: there have been lots of minor improvements to keep things humming along, and it now speaks NetFlow v7.

Those of you using JFlow or cFlow can also export to InterMapper Flows, by the way, though it will appear in the software as NetFlow 5 (being impossible on our end to tell them apart!) If you’d like to learn a bit more about these different formats, we’ve got a white paper on that, and we offer a great free software NetFlow exporter.

In the client you’ll see a number of helpful changes. The first thing that will stand out is a column of country flags in the host table: based on data provided by the IANA, we show the registered country of origin for each IP address whose traffic crosses your network. I mean, wouldn’t you like to know that the top host attempting to connect to your server on port 22 is from North Korea? Yeah, we thought so too. And if you want more information about who that IP address is, right-click it and run a whois request on it. Note that we use the IP addresses in all cases here, so that you actually get the one you’re looking for. Otherwise you get into the situation where you reverse-resolve an address to a domain name, then that domain name resolves to a different address. Usually not an issue, but in those cases where it is, it really is.

We’ve spent some time tweaking the user interface in response to user suggestions, too: we added calendar widgets to pick dates that way (very helpful for when you want to look at traffic for two Mondays ago but can’t remember whether that was the fourth or the fifth off the top of your head), and redid the auto-refresh timer with more options and a count-down display.

That, plus a handful of bug fixes — some stuff that you our users reported, some stuff we discovered ourselves.

All in all, we’re pretty happy with InterMapper Flows 1.2, and we think that you will be too. Go give it a try!