Network flow analysis



User avatar

Sr. Member
Sr. Member

Posts: 394

Joined: Tue Sep 18, 2007 1:50 pm

Location: Guayaquil, Ecuador

Post Wed Sep 03, 2008 4:19 pm

Network flow analysis

I figure there have to be some more network cable monkeys out there in our group.  I'm looking to set up a box to monitor netflow and other data.  My question... what are your favorite tools and why.  Things I am hoping to get out of the program:

1)  Free... I'm hoping here, :P.

2)  Collect total bandwidth usage in graph form for time vs. bytes etc.

3)  Be able to dig down to see individual IP in/out bound usage totals.  In an ideal world, also support output of IP to IP connection monitoring.  I'd like to see if any of my LAN is calling to China etc. 

4)  Anything else anyone knows of that sounds sexy in a monitoring tool. 

Any tips and ideas on this subject would be most appreciated.  I finally got my boss to submit to my claims of our needing network visibility, and that though I have had a fun time with nmap/wireshark and common sense... we could do with a full time monitoring system on our LAN here.  Thanks guys!

"Bad.. Good?  I'm the guy with the gun"


User avatar

Sr. Member
Sr. Member

Posts: 299

Joined: Sat Sep 10, 2005 5:45 pm

Location: /dev/null

Post Wed Sep 03, 2008 5:03 pm

Re: Network flow analysis

This is exactly what my company does. Please see my PM to you.

P.S. Unfortunately we don't work for free.  ::)
Last edited by Negrita on Wed Sep 03, 2008 5:08 pm, edited 1 time in total.

There are 10 kinds of people, those that understand binary, and those that don't.



Posts: 8

Joined: Mon Dec 18, 2006 8:00 am

Post Thu Sep 04, 2008 8:09 am

Re: Network flow analysis

I am not sure if it meets all of your reqs, but Solar winds recenty released a free NetFlow Analyzer tool:

Solar Winds Website wrote:Download Our FREE Real-time NetFlow Analyzer to Get Deep Visibility into Network Traffic & Slowdowns!
SolarWinds Free TFTP Server Real-time NetFlow Analyzer

Our new free tool unlocks the power of NetFlow on your network: SolarWinds Real-time NetFlow Analyzer! This free desktop tool captures and analyzes NetFlow data in real time to show you exactly what types of traffic are on your network, where that traffic is coming from, and where it is going. With Real-time NetFlow Analyzer, you can take the guesswork out of diagnosing traffic spikes and troubleshooting bandwidth issues.

If you are new to NetFlow, you're going to love this powerful protocol. If you haven't already, it is easy to turn on flows on your existing Cisco routers. We even have a free tool – NetFlow Configurator – to help you remotely configure NetFlow v5 via SNMP on supported Cisco® devices. We've bundled this tool with the Real-time NetFlow Analyzer download, so that you can get started with monitoring network traffic immediately.

Put an end to complaints about the network being slow! With Real-time NetFlow Analyzer, you'll have the power to:

    * Investigate, troubleshoot, and quickly remediate network slowdowns
    * Easily identify which users, devices, and applications are consuming the most bandwidth
    * Isolate inbound and outbound traffic by conversation, application, domain, endpoint, and protocol
    * Personalize NetFlow data displays to view traffic by specified time periods and by traffic type
    * Customize refresh rates and display units for NetFlow traffic ... HPPT_NA_DL


Post Thu Sep 04, 2008 12:19 pm

Re: Network flow analysis




Posts: 4

Joined: Sat Sep 13, 2008 9:51 am

Post Sat Sep 13, 2008 10:26 am

Re: Network flow analysis

I don't know very well ntop but I believe  that some features of ntop respond to your questions.
A great (and open source) project for monitoring large-scale networks you can find at CMU :




Posts: 32

Joined: Thu Jun 05, 2008 4:38 am

Post Tue Sep 16, 2008 11:28 am

Re: Network flow analysis MRTG will cover 1) & 2) quite nicely, maybe even 3) if you're willing to put the time configing (and horse power!*) in.

We had one box graphing about 500 nodes for in/out bandwidth use over 3 or four time periods and it seemed to do its job fine.

It does need a bit of time setting up, but there's masses of config help and tutes online. I do have one or two gripes about it, but it has helped me get to the root of a couple of issues.

Might not be quite what you want, but I thought I throw it out there anyway.

*not just the processing on the monitoring box but the overheads on the network hardware


while I think about it I've had sucess with observer for tracking down issues too, but it's not free.
Last edited by Chan on Tue Sep 16, 2008 2:24 pm, edited 1 time in total.
CCNA, 100m Swimming cert.

Return to Tools

Who is online

Users browsing this forum: No registered users and 3 guests

Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software