Good netflow analyzers

Discussion in 'Cisco' started by joe, Jun 16, 2004.

  1. joe

    joe Guest

    Hi,
    I am looking for some netflow analyzer that can do following ...
    for example I have hub and spoke topology. All routers are netflow enabled
    so all od them send netflow data to a collector on central location.
    Spoke routers are also sending netflow exports because I'm also interested
    in flows that are local to a spoke site.
    I want to be able to define src and dst network, and get a graph that shows
    what is traffic pattern vetween those 2 networks.
    For example I choose lan of one spoke router: 10.15.1.0/24 and as dst I
    choose "server lan" from central site 10.1.1.0/24.
    Now, graph would be displayed with traffic pattern that shows for example
    that 80% is http, 15% smtp etc. Since, both routers, spoke and hub are
    exporting flows, each traffic session would generate 2 netflow exports (one
    from hub, and one from spoke), anaylzer should be able to count that flow
    only once.
    Is CNS Cisco NEtflow able to do that ?
    How about eHealth, ArborPeak, or some other analyzer ?

    I am not interested in some tool taking all netflow exports and giving me
    some meaningless statistic for all traffic in global. I want to be able to
    generate reports based on input/output interface if a flow, based on src/dst
    network.

    Basically, I am interested in good quality netflow analyzers, so please give
    me some recommendations.
    thanks
    j
     
    joe, Jun 16, 2004
    #1
    1. Advertising

  2. joe

    Hansang Bae Guest

    In article <caqd22$3uj$>, says...
    [snip]
    > I am not interested in some tool taking all netflow exports and giving me
    > some meaningless statistic for all traffic in global. I want to be able to
    > generate reports based on input/output interface if a flow, based on src/dst
    > network.


    We're looking at NAM-II right now. It seems like it's easy enough to
    use. You can create different NDE sources so it will meet your
    criteria.


    --

    hsb

    "Somehow I imagined this experience would be more rewarding" Calvin
    *************** USE ROT13 TO SEE MY EMAIL ADDRESS ****************
    ********************************************************************
    Due to the volume of email that I receive, I may not not be able to
    reply to emails sent to my account. Please post a followup instead.
    ********************************************************************
     
    Hansang Bae, Jun 19, 2004
    #2
    1. Advertising

  3. joe

    Rob Guest

    What is NAM-II?



    On Sat, 19 Jun 2004 04:27:23 GMT, Hansang Bae <> wrote:

    >In article <caqd22$3uj$>, says...
    >[snip]
    >> I am not interested in some tool taking all netflow exports and giving me
    >> some meaningless statistic for all traffic in global. I want to be able to
    >> generate reports based on input/output interface if a flow, based on src/dst
    >> network.

    >
    >We're looking at NAM-II right now. It seems like it's easy enough to
    >use. You can create different NDE sources so it will meet your
    >criteria.
     
    Rob, Jun 21, 2004
    #3
  4. joe

    Hansang Bae Guest

    In article <>, bobh1234
    @hotmail.com says...
    > What is NAM-II?


    Network Analysis Module for the 6500 chassis.

    --

    hsb

    "Somehow I imagined this experience would be more rewarding" Calvin
    *************** USE ROT13 TO SEE MY EMAIL ADDRESS ****************
    ********************************************************************
    Due to the volume of email that I receive, I may not not be able to
    reply to emails sent to my account. Please post a followup instead.
    ********************************************************************
     
    Hansang Bae, Jun 22, 2004
    #4
  5. joe

    Milan Parekh Guest

    NAM II is a traffic monitoring network anlaysis module for the 6500 or
    the 7600 switch.

    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_data_sheet09186a00800a2c89.html

    Rob <> wrote in message news:<>...
    > What is NAM-II?
    >
    >
    >
    > On Sat, 19 Jun 2004 04:27:23 GMT, Hansang Bae <> wrote:
    >
    > >In article <caqd22$3uj$>, says...
    > >[snip]
    > >> I am not interested in some tool taking all netflow exports and giving me
    > >> some meaningless statistic for all traffic in global. I want to be able to
    > >> generate reports based on input/output interface if a flow, based on src/dst
    > >> network.

    > >
    > >We're looking at NAM-II right now. It seems like it's easy enough to
    > >use. You can create different NDE sources so it will meet your
    > >criteria.
     
    Milan Parekh, Jun 22, 2004
    #5
  6. joe

    Rob Guest

    Cool. Can this pull in all the Netflow information from other Cisco
    devices on my network, so that I don't need a third party application?



    On 21 Jun 2004 22:23:51 -0700, (Milan
    Parekh) wrote:

    >NAM II is a traffic monitoring network anlaysis module for the 6500 or
    >the 7600 switch.
    >
    >http://www.cisco.com/en/US/products/hw/modules/ps2706/products_data_sheet09186a00800a2c89.html
    >
    >Rob <> wrote in message news:<>...
    >> What is NAM-II?
    >>
    >>
    >>
    >> On Sat, 19 Jun 2004 04:27:23 GMT, Hansang Bae <> wrote:
    >>
    >> >In article <caqd22$3uj$>, says...
    >> >[snip]
    >> >> I am not interested in some tool taking all netflow exports and giving me
    >> >> some meaningless statistic for all traffic in global. I want to be able to
    >> >> generate reports based on input/output interface if a flow, based on src/dst
    >> >> network.
    >> >
    >> >We're looking at NAM-II right now. It seems like it's easy enough to
    >> >use. You can create different NDE sources so it will meet your
    >> >criteria.
     
    Rob, Jun 22, 2004
    #6
  7. joe

    Hansang Bae Guest

    In article <>, bobh1234
    @hotmail.com says...
    > Cool. Can this pull in all the Netflow information from other Cisco
    > devices on my network, so that I don't need a third party application?


    That's correct. You give the module an IP and have the other
    routers/switches report to the NAM.


    --

    hsb

    "Somehow I imagined this experience would be more rewarding" Calvin
    *************** USE ROT13 TO SEE MY EMAIL ADDRESS ****************
    ********************************************************************
    Due to the volume of email that I receive, I may not not be able to
    reply to emails sent to my account. Please post a followup instead.
    ********************************************************************
     
    Hansang Bae, Jun 24, 2004
    #7
  8. You might want to take a look at NetFlow Analyzer from AdventNet.

    http://manageengine.adventnet.com/products/netflow/download.html

    It generates reports based on IN/OUT traffic from individual
    interfaces, and allows you to specify various IP ranges also.
    Low-priced, and simple to use.


    joe wrote:
    > Hi,
    > I am looking for some netflow analyzer that can do following ...
    > for example I have hub and spoke topology. All routers are netflow

    enabled
    > so all od them send netflow data to a collector on central location.
    > Spoke routers are also sending netflow exports because I'm also

    interested
    > in flows that are local to a spoke site.
    > I want to be able to define src and dst network, and get a graph that

    shows
    > what is traffic pattern vetween those 2 networks.
    > For example I choose lan of one spoke router: 10.15.1.0/24 and as dst

    I
    > choose "server lan" from central site 10.1.1.0/24.
    > Now, graph would be displayed with traffic pattern that shows for

    example
    > that 80% is http, 15% smtp etc. Since, both routers, spoke and hub

    are
    > exporting flows, each traffic session would generate 2 netflow

    exports (one
    > from hub, and one from spoke), anaylzer should be able to count that

    flow
    > only once.
    > Is CNS Cisco NEtflow able to do that ?
    > How about eHealth, ArborPeak, or some other analyzer ?
    >
    > I am not interested in some tool taking all netflow exports and

    giving me
    > some meaningless statistic for all traffic in global. I want to be

    able to
    > generate reports based on input/output interface if a flow, based on

    src/dst
    > network.
    >
    > Basically, I am interested in good quality netflow analyzers, so

    please give
    > me some recommendations.
    > thanks
    > j
     
    e n c h a n t, Feb 23, 2005
    #8
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. X.25
    Replies:
    1
    Views:
    2,386
    M.C. van den Bovenkamp
    Jul 8, 2003
  2. love0503hk

    netflow tools

    love0503hk, Jul 22, 2003, in forum: Cisco
    Replies:
    0
    Views:
    519
    love0503hk
    Jul 22, 2003
  3. Slava Astashonok

    NetFlow & ICMP type/subtype

    Slava Astashonok, Dec 9, 2003, in forum: Cisco
    Replies:
    1
    Views:
    1,908
    Simon Leinen
    Dec 9, 2003
  4. Sven Juergensen

    netflow analyzers

    Sven Juergensen, Mar 30, 2005, in forum: Cisco
    Replies:
    2
    Views:
    4,619
    Prabhdeep
    Jul 2, 2010
  5. Replies:
    0
    Views:
    946
Loading...

Share This Page