January 2013

NetFlow Helps Manage Remote Locations

Plixer International Case Study: Armstrong Coal Company, Inc.

NetFlow Helps Coal Company Manage its Remote Locations

Formed in 2006 to acquire and develop coal reserves in the Illinois basin, Armstrong Energy, Inc., and its business unit Armstrong Coal Company, Inc. now own and operate five surface mines, two underground mines and three facilities for cleaning, blending and shipping the coal to its customers. In 2011, Armstrong Coal shipped 7.2 million tons of coal.


Most people’s impression of coal mines is stuck back in the black-and-white era of brawny, soot-covered men working away with pick axes. Nowadays, says Armstrong Energy Director of IT Tim Johnson, coal mining firms in the Illinois Valley are as high tech as those in Silicon Valley. Hardened wireless devices monitor the location of every worker, even when they are thousands of feet underground. Air quality sensors continuously monitor for poisonous or explosive gasses and alert supervisors when any are detected. A thousand Programmable Logic Controllers (PLCs) monitor the health of all the fixed and moving equipment, sending the data to headquarters for logging and evaluation, so preventive maintenance can be done to prevent unplanned downtime. All this, in addition to the usual IT equipment (servers, switches, routers, desktops, laptops, iPhones), and office functions including VoIP, SAP, CAD, email and documents.

“We have a very, very complicated network,” says Johnson.

Armstrong started out using a hub-and-spoke network architecture with all the traffic going through headquarters, but this resulted in bottlenecks. It then switched to a 14-location MPLS design with 1.5 Mbps connections leased from AT&T. AT&T also provides firewall, antispam, intrusion detection and other security functions. This architecture change allows the remote facilities to directly contact the internet and communicate to each other directly. What it also did, however, was hide the traffic from IT.

“We had no visibility into the network,” says Johnson. “When you have a network this diverse and with as many locations as we have, it is hard to keep your finger on everything. SNMP traps are good, but we didn’t have dashboarding or any tool that could take care of as many devices as we have.”


Johnson started looking for network management software that would provide the information he was missing. Armstrong Coal has Cisco firewalls, switches and security appliances, as well as Riverbed WAN optimization appliances. Since all these devices export NetFlow data, Johnson started looking for a Netflow gathering and reporting tool. Among the software considered was Solar Wind’s Orion NetFlow Traffic Analyzer and Plixer, Inc.’s Scrutinizer. Johnson said what really made the difference was the support Plixer provided.

“We are going 150 miles per hour here at our company and didn’t have the time or resources to dedicate to getting this set up and running,” he says. “They asked us what data we would like to see; did all the work remotely to get it set up, configured and running for us as a demo; and said if we liked it, we could keep it.”

Scrutinizer was configured to collect data from all the interfaces on the Cisco 1620 routers as well as some of the interfaces on the Cisco 3560 switches. Next year, Johnson plans to add NetFlow monitoring of the Cisco Advanced Security Appliances. In addition, he has set up interfaces into Scrutinizer from some of his other web-based monitoring tools. “With everything being web-based these days, I can just pop a link in as a gadget and I have a profile set on my main screen with the external applications,” says Johnson. “That way, I can just go into Scrutinizer and manage the whole network instead of having to go to 50 different websites.”


Johnson says that he and all technicians keep the Scrutinizer dashboard up on their screens at all times and use it daily to monitor network health and debug issues when they arise.

“Scrutinizer gives us great visibility into what is going on with the bandwidth, what traffic is going across the network, the protocols being used and the front end visibility as well,” he says. “NetFlow is not just a great troubleshooting tool, but allows me to drill down into what is going on and take a proactive instead of a reactive approach.” Johnson and his staff (including the Network Security team), use NetFlow to watch for any traffic on the network that is using an unauthorized port or protocol. Sometimes it is a threat such as a denial of service attack but other times the traffic is benign but nevertheless harmful.

“We only have a limited amount of bandwidth going out to the mines and it is all needed for the enterprise applications,” he says. “But sometimes people get on there and start doing stupid things.”

The company has a Bring Your Own Device policy and, for example, one user was saturating the link listening to Pandora. Scrutinizer quickly caught this and Pandora was blocked on his device. But the resourceful employee found an alternative way to access Pandora and so IT once again had to go in and find what was saturating the link and block that route as well. Without NetFlow monitoring, IT would have only been able to see that the link was overloaded, but not identify the traffic, device or user.

Being able to track flow data also helps with the long term planning and budgeting. For example when a pipe to one of the mines was being overloaded, Johnson was able to show executives that not only was the connection “being crushed 100% of the time” but that it was valid business-related traffic that was causing the overload. “With NetFlow, I can also make a better decision such as whether I need to place a server in this location so they can work off sys files locally, or do local patch management, instead of it all coming across the pipe from headquarters,” Johnson says.

About Plixer International, Inc. 

Plixer International, Inc. develops and markets network traffic monitoring and analysis tools to the global market. All of the solutions are built from the ground up with valuable feature sets and ease of use in mind. Plixer solutions have been used to analyze and troubleshoot irregular traffic patterns by IT professionals at some of the largest networks in the world, such as CNN, The Coca-Cola Company, Lockheed Martin, IBM, Regal Cinemas, Raytheon, and Eddie Bauer.

For product and sales information, contact Plixer International, Inc. at 207.324.8805, or visit http://www.plixer.com.

Plixer, the Plixer logo, Scrutinizer NetFlow & sFlow Analyzer, and the Scrutinizer logo are trademarks or registered trademarks of Plixer International, Inc. All other company and product names herein are recognized to be the property of their respective companies.© 2010 Plixer International, Inc. all rights reserved.