The Ethical Hacker Network - Network flow analysis

g00d_4sh

Sr. Member

Offline

Posts: 394

Network flow analysis

« on: September 03, 2008, 04:19:09 PM »

I figure there have to be some more network cable monkeys out there in our group. I'm looking to set up a box to monitor netflow and other data. My question... what are your favorite tools and why. Things I am hoping to get out of the program:

1) Free... I'm hoping here, Tongue

.

2) Collect total bandwidth usage in graph form for time vs. bytes etc.

3) Be able to dig down to see individual IP in/out bound usage totals. In an ideal world, also support output of IP to IP connection monitoring. I'd like to see if any of my LAN is calling to China etc.

4) Anything else anyone knows of that sounds sexy in a monitoring tool.

Any tips and ideas on this subject would be most appreciated. I finally got my boss to submit to my claims of our needing network visibility, and that though I have had a fun time with nmap/wireshark and common sense... we could do with a full time monitoring system on our LAN here. Thanks guys!

Clay


	Logged

"Bad.. Good? I'm the guy with the gun"

Negrita

Sr. Member

Offline

Posts: 299

Re: Network flow analysis

« Reply #1 on: September 03, 2008, 05:03:16 PM »

This is exactly what my company does. Please see my PM to you.

P.S. Unfortunately we don't work for free. Roll Eyes


« Last Edit: September 03, 2008, 05:08:40 PM by Negrita »	Logged

CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.

ShawnB

Newbie

Offline

Posts: 8

Re: Network flow analysis

« Reply #2 on: September 04, 2008, 08:09:15 AM »

I am not sure if it meets all of your reqs, but Solar winds recenty released a free NetFlow Analyzer tool:

Quote from: Solar Winds Website

Download Our FREE Real-time NetFlow Analyzer to Get Deep Visibility into Network Traffic & Slowdowns!
SolarWinds Free TFTP Server Real-time NetFlow Analyzer

Our new free tool unlocks the power of NetFlow on your network: SolarWinds Real-time NetFlow Analyzer! This free desktop tool captures and analyzes NetFlow data in real time to show you exactly what types of traffic are on your network, where that traffic is coming from, and where it is going. With Real-time NetFlow Analyzer, you can take the guesswork out of diagnosing traffic spikes and troubleshooting bandwidth issues.

If you are new to NetFlow, you're going to love this powerful protocol. If you haven't already, it is easy to turn on flows on your existing Cisco routers. We even have a free tool – NetFlow Configurator – to help you remotely configure NetFlow v5 via SNMP on supported Cisco® devices. We've bundled this tool with the Real-time NetFlow Analyzer download, so that you can get started with monitoring network traffic immediately.

Put an end to complaints about the network being slow! With Real-time NetFlow Analyzer, you'll have the power to:

* Investigate, troubleshoot, and quickly remediate network slowdowns
* Easily identify which users, devices, and applications are consuming the most bandwidth
* Isolate inbound and outbound traffic by conversation, application, domain, endpoint, and protocol
* Personalize NetFlow data displays to view traffic by specified time periods and by traffic type
* Customize refresh rates and display units for NetFlow traffic

http://www.solarwinds.com/register/index.aspx?Program=852&c=70150000000DrSQ&CMP=ILC-HPPT_NA_DL


	Logged

dean

Guest

Re: Network flow analysis

« Reply #3 on: September 04, 2008, 12:19:02 PM »

use Argus

http://qosient.com/argus/

/dean


	Logged

diodime

Newbie

Offline

Posts: 4

Re: Network flow analysis

« Reply #4 on: September 13, 2008, 10:26:56 AM »

Hi,
I don't know very well ntop but I believe that some features of ntop respond to your questions.
A great (and open source) project for monitoring large-scale networks you can find at CMU :
http://tools.netsa.cert.org/

diodime


	Logged

Chan

Newbie

Offline

Posts: 32

Re: Network flow analysis

« Reply #5 on: September 16, 2008, 11:28:50 AM »

http://oss.oetiker.ch/mrtg/ MRTG will cover 1) & 2) quite nicely, maybe even 3) if you're willing to put the time configing (and horse power!*) in.

We had one box graphing about 500 nodes for in/out bandwidth use over 3 or four time periods and it seemed to do its job fine.

It does need a bit of time setting up, but there's masses of config help and tutes online. I do have one or two gripes about it, but it has helped me get to the root of a couple of issues.

Might not be quite what you want, but I thought I throw it out there anyway.

*not just the processing on the monitoring box but the overheads on the network hardware

--edit--

while I think about it I've had sucess with observer http://www.netinst.com/products/observer/index.html for tracking down issues too, but it's not free.


« Last Edit: September 16, 2008, 02:24:03 PM by Chan »	Logged

CCNA, 100m Swimming cert.

Pages: [1] Go Up

« previous next »