SonicWALL Scrutinizer

Enhance intelligent management of your network performance

Enhance troubleshooting and measuring network performance and network bandwidth usage, while increasing productivity for enterprises and service providers. SonicWALL™ Scrutinizer offers you a multi-vendor, flow-based application traffic analytics, visualization and reporting tool. You get deep network performance analysis of application traffic from IPFIX/NetFlow data exported by SonicWALL firewalls, plus support for a broad variety of firewalls, routers, switches, and data-flow reporting protocols. You can also deploy Scrutinizer as a virtual appliance for high-performance environments.



Conduct highly granular analysis

You can combine SonicWALL™ Scrutinizer with SonicWALL next-generation firewalls for uniquely detailed application flow analytics. This enables you to examine real-time IPFIX data by application or by user, look at data over different time periods, and much more.

Broaden insight with high compatibility

Perform network performance analysis insight into hundreds of compatible switches, routers, firewalls and other devices from multiple vendors, and the capacity to simultaneously monitor thousands of interfaces. Support all industry-standard data flow protocols, including IPFIX, J-Flow, sFlow, NetFlow v5, NetFlow v9 and Flexible NetFlow. Provide extensive support for Cisco® and Citrix® equipment with the optional advanced reporting module.

Map your data intuitively

View network bandwidth usage trends in bytes, bits, packets or percent of total bandwidth consumed on a periodic basis, to the second. Analyze and create reports based on applications, network traffic, VPN traffic, VoIP traffic, top hosts, protocols, ports, and conversations across all network realms and devices.

Easily customize for your needs

With an easy-to-use central console for measuring network performance, you can customize dashboards per login, and set permissions at the group or user level to access flows for specific switch, router and firewall interfaces.


Windows Appliance


ComponentMinimum Specifications
(for trial installations)
Recommended Specifications
(for production environments)
Disks50 GB IDE or SATA1+ TB 15k SCSI in a RAID 0 or 10
ProcessorDual Core 2GHz+Quad Core 2GHz+
Operating SystemWindows Vista/2008/7Windows 2008/2012 Server

Virtual Appliance


ComponentMinimum Specifications
(for trial installations)
Recommended Specifications
(for production environments)
– Dedicated resources)
Disks1 TB 15k SCSI in a RAID 0 or 10 configuration1+ TB 15k SCSI in a RAID 0 or 10
ProcessorQuad Core 2GHz+2 x Quad Core 2GHz+
VMwareESX(i) 4.x / 5.xESX(i) 4.x / 5.x


Legend: S — Standard,  O — Optional,  N — Not available

Capacity and visualizationTrial scrutinizerFlow analytics moduleFlow analytics and
add-on modules
Archived dataUp to 24 hoursUnrestrictedUnrestricted
When combined with report archiving provides a platform for trend analysisUp to 24 hoursSS
List the top interfaces across all routers, switches and firewallsLimited to 5 interfacesSS
Compatible with numerous vendorsSSS
Capable of handling up to 20,000 flows per second in v8.XSSS
Does not require expensive Microsoft® databaseSSS
support for over 1,000 exporters and over 1,000 interfacesSSS
Flow View to see all fields in the raw flowsSSS
Integration with Google™ MapsSSS
Matrix View functionSSS
Flexible reportingTrial scrutinizerFlow analytics moduleFlow analytics and
add-on modules
Schedule reports to be emailedNSS
100 percent support for Flexible NetFlow by breaking out details per templateSSS
Ability to include and exclude data using filtersSSS
Ability to rename templates for future referenceSSS
Definable default landing page per customer loginsSSS
Define Application Groups using ranges of ports and IP addressesSSS
Display data in bits, bytes, packets or percentSSS
Granularity down to the second it was received using FlowViewSSS
Include or exclude filtersSSS
Create reports based upon IP groupingsSSS
Report per interface on top hosts, protocols, applications, conversations and moreSSS
Save filters on custom reportsSSS
Support for at least nine languagesSSS
Trend in, out or both at the same time, in all reportsSSS
Ability to add multiple interfaces across multiple routers, switches or firewalls to single reportSSS
Filter on any field exported (e.g. MAC Address, VLAN, Latency, etc.) in the templatesSSS
Reports on the amount of traffic being dropped by collector, thus providing greater accuracy than competitorsSSS
Adds several additional traffic analysis report types (e.g. Flows, Flow Volume, NBAR Support, etc.)NSS
Easily identify top applications on the network across numerous network devicesNSS
MPLS reporting by subnetsNSS
Report and trend on Microsoft® Exchange logsNSS
Saves all the records, all the flows, all the time for as long as necessary including indefinitelyNSS
Create reports based upon top countries, domains or subnetsNSS
Reports exportable to .CSV formatNNS
Dell SonicWALL specific reporting templates (application usage, VPN usage, VoIP usage, web activity, etc.)NSS
Customizable billing solutions for over usage and invoicingNNAdvanced reporting module
AlertingTrial scrutinizerFlow analytics moduleFlow analytics and
add-on modules
Alarm for unfinished flows and nefarious activitiesNSS
Alarm on saved filters (e.g. total traffic or per row)NSS
Alarming for high interface utilizationNSS
Any saved report in Scrutinizer can be configured with a threshold to trigger an alarmNSS
Unique index per alarm (tells how many other alarms the host has violated)NSS
Offers administrators the ability to proactively monitor QoS and become automatically alerted of degraded voice/video trafficNSS
Facilitation of Automatic Remediation (SNMP traps and script execution)NSS
Trouble shootingTrial scrutinizerFlow analytics moduleFlow analytics and
add-on modules
Ability to click on the links in the map to bring up the top conversationsSSS
Excellent troubleshooting tool for helping administrators identify "slowness" on the networkSSS
Latency/Jitter Analysis on nProbe onlySSS
Mapping of network with links that change color based on utilizationSSS
Search for specific hosts or portsSSS
Identifies what devices do not have the Active Timeout configured correctlySSS
Capacity planning tool for system admins to determine usage during peak hoursNSS
Host Flows (volume of flows per host)NSS
Host Volume (volume of unique hosts per second)NSS
Pair Volume (Volume of unique to/from address pairs)NSS
Leverages IPFIX statistics to provide greater insight into VoIP metrics (codec, caller ID, duration, originator, destination, etc.)NSS
SecurityTrial scrutinizerFlow analytics moduleFlow analytics and
add-on modules
Configurable time frame for DNS cachingSSS
Filter for “host to host” and “subnet to subnet”SSS
Ability to filter traffic based upon TCP FlagSSS
Keeps track of the Flow Sequence Number, trends results and indicates problemsSSS
Run reports to find rogue DNS, DHCP, mail, etc., servers on the networkSSS
Alert and detection of banned applications (e.g. BitTorrent P2P, FTP, YouTube, Facebook, Skype, etc.)NSS
Alert and detection of malicious traffic (e.g. worms, viruses), known compromised internet hosts, illegal IP addresses, excessive multicast traffic, HTTP hijacking, DNS Cache poisoning, Rouge DHCP servers, DDoS attacks, etc.NSS
Alert and detection of scanning: SYN, NULL, FIN, XMAS etc.NSS
Specify allowed subnets and alarm for rogue IP addressesNSS
AdministrationTrial scrutinizerFlow analytics moduleFlow analytics and
add-on modules
Customizable MyView dashboards per loginSSS
Group-based user permissionsSSS
Configure permissions per login account for access to flows for specific router, switch, firewall interfacesNNMulti-tenancy mode
Style sheets easily modified with several defaults to change the colors, fonts and logos to match the service providers' marketing effortsNNMulti-tenancy mode
Supported protocols & other technical specificationsTrial scrutinizerFlow analytics moduleFlow analytics and
service provider modules
First of its kind IPFIX implementation into a firewall applianceSSS
Ability to view individual flow templates (NetFlow v9 and Flexible NetFlow)SSS
Allows integration of 3rd-party applications and URLs into mashupsSSS
Customize interface names and overwrite default SNMP ifAlias nameSSS
Customize interface speed, both in and out, with different valuesSSS
Exclude transport protocols from being saved per interface, router or globally (very important feature when VPNs and tunnels are involved)SSS
Identify interface names using NetFlow or SNMPSSS
Integration with any 3rd-party NMS solutionsSSS
LDAP supportSSS
Listen for flows on unlimited UDP portsSSS
Support for IPv6SSS
Support for NetFlow v1, v5, v6, v7, v9, jFlow, sFlow (v2, v4, v5), SNMP(v1, v2, v3) and IPFIXSSS
Filter for NexthopNSS
Support for FnF NBAR and IPFIX performing deep packet inspection to identify Layer 7 application trafficNSS
DNS resolution becomes automated and a constant processNSS

Legend: S — Standard,  O — Optional,  N — Not available

  1. * This feature list is valid after the initial 30 day of the trial. For the first 30 days of the trial it includes all features available in the Flow Analytics Module as well.




SonicWALL Scrutinizer

Take a tour of key functionality in SonicWALL Scrutinizer interface to experience its capabilities and ease of use.

Take a Screenshot Tour

Scrutinizer Dashboard

Scrutinizer Dashboard

Customizable dashboard example: network map, device status, threats, latency, domains, protocols.

SonicWALL-specific Reports

SonicWALL-specific Reports

Reports specific to Dell SonicWALL: applications, intrusions, viruses, websites, users, VPN, VoIP.

Scrutinizer VoIP

Scrutinizer VoIP

Critical VoIP quality report including telephone numbers, date/timestamps, jitter, packet loss, and latency.