«

Hi comp.dcom.sys.cisco,

which software do you recommend for collecting and accounting of
netflow data.

All routers are Cisco routers from diffrent sizes.

We want to use netflow version 5. not sampled, since we have sometimes
more than one customer behind one interface. so it should be ip adress
related accounting.

Software could be open-source or commercial.

Looking forward to hear from you.

Thank you.

Best Regards,
Martin

PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
this group. Thx.

--
Martin Raab
eMail:
------------ - - - --- -- ----

Martin Raab wrote:

> Hi comp.dcom.sys.cisco,
>
> which software do you recommend for collecting and accounting of
> netflow data.
>
> All routers are Cisco routers from different sizes.
>
> We want to use netflow version 5. not sampled, since we have sometimes
> more than one customer behind one interface. so it should be ip
address
> related accounting.
>
> Software could be open-source or commercial.
>
> Looking forward to hear from you.

We just bought the Cisco Netflow Collector. But we also rolled out
some home grown utility to quickly query the database (top talker, top
protocol etc.) But we are looking at integrating this with InfoVista.
We'll see how that goes.

--

hsb


"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
************************************************** ******************

In article <aTfId.61864$>,
says...
> We just bought the Cisco Netflow Collector. But we also rolled out
> some home grown utility to quickly query the database (top talker, top
> protocol etc.) But we are looking at integrating this with InfoVista.
> We'll see how that goes.
>

I always tought that you guys use something on much higher evolution
level than Infovista, like Concord (more) or HPOV (less)...

--
-Ivan.

*** Use Rot13 to see my eMail address ***

Ivan Ostre wrote:
> I always tought that you guys use something on much higher evolution
> level than Infovista, like Concord (more) or HPOV (less)...


We looked at all the major players. Some required extensive pro
services to have the product do what we want. Some were too
cumbersome. Some didn't scale to the level we needed. In the end, we
decided to pilot with InfoVista. We spent nearly four months looking
and playing with all the products. We are doing a near-full scale
pilot to see if it will do as well "in the wild."

We'll see.

--

hsb


"Somehow I imagined this experience would be more rewarding" Calvin
**************************ROT13 MY ADDRESS*************************
Due to the volume of email that I receive, I may not not be able to
reply to emails sent to my account. Please post a followup instead.
************************************************** ******************

Crannog's Netflow tracker was by far the best commercial one I have
evaluated - thus - eventually - purchased.

Luca Deri's open source ntop was a nice one, but what I have - in fact -
used from Luca's creations was the commercial (negligible price, compared
to Crannog's software) nProbe, which allowed me to create flows from
non-netflow/non-Cisco equipment (e.g. Nortel routers, other switches at
the trunk level, etc.), and send them to the same collector where my
6500s, 38xx, etc also export - so now I have Netflow tracker giving me a
complete picture of all the flows traversing my LANs and WAN.

HTH,
Papi

On Fri, 21 Jan 2005 12:10:18 +0100, Martin Raab wrote:

> Hi comp.dcom.sys.cisco,
>
> which software do you recommend for collecting and accounting of
> netflow data.
>
> All routers are Cisco routers from diffrent sizes.
>
> We want to use netflow version 5. not sampled, since we have sometimes
> more than one customer behind one interface. so it should be ip adress
> related accounting.
>
> Software could be open-source or commercial.
>
> Looking forward to hear from you.
>
> Thank you.
>
> Best Regards,
> Martin
>
> PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
> this group. Thx.

I thought about trying nTop, nProbe and some nBox's for my company.
How do you like it compared to the commercial offerings?

We had a visit from Concord and while their product seems to be top of
the line, it costs that.

-Bob



On Sat, 22 Jan 2005 11:43:17 -0600, papi <> wrote:

>Crannog's Netflow tracker was by far the best commercial one I have
>evaluated - thus - eventually - purchased.
>
>Luca Deri's open source ntop was a nice one, but what I have - in fact -
>used from Luca's creations was the commercial (negligible price, compared
>to Crannog's software) nProbe, which allowed me to create flows from
>non-netflow/non-Cisco equipment (e.g. Nortel routers, other switches at
>the trunk level, etc.), and send them to the same collector where my
>6500s, 38xx, etc also export - so now I have Netflow tracker giving me a
>complete picture of all the flows traversing my LANs and WAN.
>
>HTH,
>Papi
>
>On Fri, 21 Jan 2005 12:10:18 +0100, Martin Raab wrote:
>
>> Hi comp.dcom.sys.cisco,
>>
>> which software do you recommend for collecting and accounting of
>> netflow data.
>>
>> All routers are Cisco routers from diffrent sizes.
>>
>> We want to use netflow version 5. not sampled, since we have sometimes
>> more than one customer behind one interface. so it should be ip adress
>> related accounting.
>>
>> Software could be open-source or commercial.
>>
>> Looking forward to hear from you.
>>
>> Thank you.
>>
>> Best Regards,
>> Martin
>>
>> PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
>> this group. Thx.

I use flow-tools to collect flow data on FreeBSD 4.9.10. Flowscan tool
also analyzes and reports flows data. Flow-tools produce ~300 MB in
every day. For detailed analysis you can enable flow both inbound also
outbound of interface at router. I am glad to use these tools. I try
cflowd but it is not useful as flow-tools. Ntop is in grow phase. Ntop
consumes quite machine resources. I can say Ntop has beautiful
interface.

http://www.caida.org/
http://www.splintered.net/sw/flow-tools/
Router Cisco 7200
Internet output ~20Mb
Pc PIII-800 and 256 MB ram

We use Crannog Netflow Monitor, and it's perfect for what we need
(basic trending, topNs, etc.)
have a good day!

The ntop is fine, for some type of information. I am running it (just
upgraded to 3.1 recently) right now, but not for flows (I deployed it in a
couple of places where I have trunked or mirrored/spanned ports, for some
baselining). The extraordinary advantage of Crannog's software is the
broadness of search/query methodologies, graphing, etc., which is missing
from ntop. As far as nProbe goes - of course it is great, as there are old
legacy devices unable to export netflows.

I think you should take the same path I took: do not take anyone's word
for it: just go ahead and install ntop, export flows from Cisco, and see
if and/or when you reach the limitations. If you like absolutely
everything you see, just leave it at that. If not - do not spend any money
yet - try this:

http://netflow.cesnet.cz/

I had it running for a while, and I liked parts of it, missing from ntop.

Once you exhaust the above two options, try the caida tools, or take a
look here, for other free options:

http://www.switch.ch/tf-tant/floma/software.html

Having gone through all the steps, myself, I ended up - eventually buying
Crannog's stuff. But even before making a purchasing decision, contact
those guys - they are willing to let you demo their product for at least
30 days ...

Good luck,
Papi



On Tue, 25 Jan 2005 17:52:51 -0500, Bob wrote:

> I thought about trying nTop, nProbe and some nBox's for my company.
> How do you like it compared to the commercial offerings?
>
> We had a visit from Concord and while their product seems to be top of
> the line, it costs that.
>
> -Bob
>
>
>
> On Sat, 22 Jan 2005 11:43:17 -0600, papi <> wrote:
>
>>Crannog's Netflow tracker was by far the best commercial one I have
>>evaluated - thus - eventually - purchased.
>>
>>Luca Deri's open source ntop was a nice one, but what I have - in fact -
>>used from Luca's creations was the commercial (negligible price, compared
>>to Crannog's software) nProbe, which allowed me to create flows from
>>non-netflow/non-Cisco equipment (e.g. Nortel routers, other switches at
>>the trunk level, etc.), and send them to the same collector where my
>>6500s, 38xx, etc also export - so now I have Netflow tracker giving me a
>>complete picture of all the flows traversing my LANs and WAN.
>>
>>HTH,
>>Papi
>>
>>On Fri, 21 Jan 2005 12:10:18 +0100, Martin Raab wrote:
>>
>>> Hi comp.dcom.sys.cisco,
>>>
>>> which software do you recommend for collecting and accounting of
>>> netflow data.
>>>
>>> All routers are Cisco routers from diffrent sizes.
>>>
>>> We want to use netflow version 5. not sampled, since we have sometimes
>>> more than one customer behind one interface. so it should be ip adress
>>> related accounting.
>>>
>>> Software could be open-source or commercial.
>>>
>>> Looking forward to hear from you.
>>>
>>> Thank you.
>>>
>>> Best Regards,
>>> Martin
>>>
>>> PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
>>> this group. Thx.

Give NetFlow Analyzer a try. It's a lot cheaper, and does pretty much
everything you'd expect from a NetFlow system - top talkers,
conversations, applications, and custom reports. Support is pretty good
too.

http://manageengine.adventnet.com/pr.../download.html