Q: Which software for accounting with netflow ?

Discussion in 'Cisco' started by Martin Raab, Jan 21, 2005.

  1. Martin Raab

    Martin Raab Guest

    Hi comp.dcom.sys.cisco,

    which software do you recommend for collecting and accounting of
    netflow data.

    All routers are Cisco routers from diffrent sizes.

    We want to use netflow version 5. not sampled, since we have sometimes
    more than one customer behind one interface. so it should be ip adress
    related accounting.

    Software could be open-source or commercial.

    Looking forward to hear from you.

    Thank you.

    Best Regards,
    Martin

    PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
    this group. Thx.

    --
    Martin Raab
    eMail:
    ------------ - - - --- -- ----
     
    Martin Raab, Jan 21, 2005
    #1
    1. Advertising

  2. Martin Raab

    Hansang Bae Guest

    Martin Raab wrote:

    > Hi comp.dcom.sys.cisco,
    >
    > which software do you recommend for collecting and accounting of
    > netflow data.
    >
    > All routers are Cisco routers from different sizes.
    >
    > We want to use netflow version 5. not sampled, since we have sometimes
    > more than one customer behind one interface. so it should be ip

    address
    > related accounting.
    >
    > Software could be open-source or commercial.
    >
    > Looking forward to hear from you.


    We just bought the Cisco Netflow Collector. But we also rolled out
    some home grown utility to quickly query the database (top talker, top
    protocol etc.) But we are looking at integrating this with InfoVista.
    We'll see how that goes.

    --

    hsb


    "Somehow I imagined this experience would be more rewarding" Calvin
    **************************ROT13 MY ADDRESS*************************
    Due to the volume of email that I receive, I may not not be able to
    reply to emails sent to my account. Please post a followup instead.
    ********************************************************************
     
    Hansang Bae, Jan 21, 2005
    #2
    1. Advertising

  3. Martin Raab

    Ivan Ostreš Guest

    In article <aTfId.61864$>,
    says...
    > We just bought the Cisco Netflow Collector. But we also rolled out
    > some home grown utility to quickly query the database (top talker, top
    > protocol etc.) But we are looking at integrating this with InfoVista.
    > We'll see how that goes.
    >


    I always tought that you guys use something on much higher evolution
    level than Infovista, like Concord (more) or HPOV (less)...

    --
    -Ivan.

    *** Use Rot13 to see my eMail address ***
     
    Ivan Ostreš, Jan 22, 2005
    #3
  4. Martin Raab

    Hansang Bae Guest

    Ivan Ostre wrote:
    > I always tought that you guys use something on much higher evolution
    > level than Infovista, like Concord (more) or HPOV (less)...



    We looked at all the major players. Some required extensive pro
    services to have the product do what we want. Some were too
    cumbersome. Some didn't scale to the level we needed. In the end, we
    decided to pilot with InfoVista. We spent nearly four months looking
    and playing with all the products. We are doing a near-full scale
    pilot to see if it will do as well "in the wild."

    We'll see.

    --

    hsb


    "Somehow I imagined this experience would be more rewarding" Calvin
    **************************ROT13 MY ADDRESS*************************
    Due to the volume of email that I receive, I may not not be able to
    reply to emails sent to my account. Please post a followup instead.
    ********************************************************************
     
    Hansang Bae, Jan 22, 2005
    #4
  5. Martin Raab

    papi Guest

    Crannog's Netflow tracker was by far the best commercial one I have
    evaluated - thus - eventually - purchased.

    Luca Deri's open source ntop was a nice one, but what I have - in fact -
    used from Luca's creations was the commercial (negligible price, compared
    to Crannog's software) nProbe, which allowed me to create flows from
    non-netflow/non-Cisco equipment (e.g. Nortel routers, other switches at
    the trunk level, etc.), and send them to the same collector where my
    6500s, 38xx, etc also export - so now I have Netflow tracker giving me a
    complete picture of all the flows traversing my LANs and WAN.

    HTH,
    Papi

    On Fri, 21 Jan 2005 12:10:18 +0100, Martin Raab wrote:

    > Hi comp.dcom.sys.cisco,
    >
    > which software do you recommend for collecting and accounting of
    > netflow data.
    >
    > All routers are Cisco routers from diffrent sizes.
    >
    > We want to use netflow version 5. not sampled, since we have sometimes
    > more than one customer behind one interface. so it should be ip adress
    > related accounting.
    >
    > Software could be open-source or commercial.
    >
    > Looking forward to hear from you.
    >
    > Thank you.
    >
    > Best Regards,
    > Martin
    >
    > PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
    > this group. Thx.
     
    papi, Jan 22, 2005
    #5
  6. Martin Raab

    Bob Guest

    I thought about trying nTop, nProbe and some nBox's for my company.
    How do you like it compared to the commercial offerings?

    We had a visit from Concord and while their product seems to be top of
    the line, it costs that.

    -Bob



    On Sat, 22 Jan 2005 11:43:17 -0600, papi <> wrote:

    >Crannog's Netflow tracker was by far the best commercial one I have
    >evaluated - thus - eventually - purchased.
    >
    >Luca Deri's open source ntop was a nice one, but what I have - in fact -
    >used from Luca's creations was the commercial (negligible price, compared
    >to Crannog's software) nProbe, which allowed me to create flows from
    >non-netflow/non-Cisco equipment (e.g. Nortel routers, other switches at
    >the trunk level, etc.), and send them to the same collector where my
    >6500s, 38xx, etc also export - so now I have Netflow tracker giving me a
    >complete picture of all the flows traversing my LANs and WAN.
    >
    >HTH,
    >Papi
    >
    >On Fri, 21 Jan 2005 12:10:18 +0100, Martin Raab wrote:
    >
    >> Hi comp.dcom.sys.cisco,
    >>
    >> which software do you recommend for collecting and accounting of
    >> netflow data.
    >>
    >> All routers are Cisco routers from diffrent sizes.
    >>
    >> We want to use netflow version 5. not sampled, since we have sometimes
    >> more than one customer behind one interface. so it should be ip adress
    >> related accounting.
    >>
    >> Software could be open-source or commercial.
    >>
    >> Looking forward to hear from you.
    >>
    >> Thank you.
    >>
    >> Best Regards,
    >> Martin
    >>
    >> PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
    >> this group. Thx.
     
    Bob, Jan 25, 2005
    #6
  7. Martin Raab

    Albada Guest

    I use flow-tools to collect flow data on FreeBSD 4.9.10. Flowscan tool
    also analyzes and reports flows data. Flow-tools produce ~300 MB in
    every day. For detailed analysis you can enable flow both inbound also
    outbound of interface at router. I am glad to use these tools. I try
    cflowd but it is not useful as flow-tools. Ntop is in grow phase. Ntop
    consumes quite machine resources. I can say Ntop has beautiful
    interface.

    http://www.caida.org/
    http://www.splintered.net/sw/flow-tools/
    Router Cisco 7200
    Internet output ~20Mb
    Pc PIII-800 and 256 MB ram
     
    Albada, Jan 26, 2005
    #7
  8. Martin Raab

    roahboah Guest

    We use Crannog Netflow Monitor, and it's perfect for what we need
    (basic trending, topNs, etc.)
    have a good day!
     
    roahboah, Jan 26, 2005
    #8
  9. Martin Raab

    papi Guest

    The ntop is fine, for some type of information. I am running it (just
    upgraded to 3.1 recently) right now, but not for flows (I deployed it in a
    couple of places where I have trunked or mirrored/spanned ports, for some
    baselining). The extraordinary advantage of Crannog's software is the
    broadness of search/query methodologies, graphing, etc., which is missing
    from ntop. As far as nProbe goes - of course it is great, as there are old
    legacy devices unable to export netflows.

    I think you should take the same path I took: do not take anyone's word
    for it: just go ahead and install ntop, export flows from Cisco, and see
    if and/or when you reach the limitations. If you like absolutely
    everything you see, just leave it at that. If not - do not spend any money
    yet - try this:

    http://netflow.cesnet.cz/

    I had it running for a while, and I liked parts of it, missing from ntop.

    Once you exhaust the above two options, try the caida tools, or take a
    look here, for other free options:

    http://www.switch.ch/tf-tant/floma/software.html

    Having gone through all the steps, myself, I ended up - eventually buying
    Crannog's stuff. But even before making a purchasing decision, contact
    those guys - they are willing to let you demo their product for at least
    30 days ...

    Good luck,
    Papi



    On Tue, 25 Jan 2005 17:52:51 -0500, Bob wrote:

    > I thought about trying nTop, nProbe and some nBox's for my company.
    > How do you like it compared to the commercial offerings?
    >
    > We had a visit from Concord and while their product seems to be top of
    > the line, it costs that.
    >
    > -Bob
    >
    >
    >
    > On Sat, 22 Jan 2005 11:43:17 -0600, papi <> wrote:
    >
    >>Crannog's Netflow tracker was by far the best commercial one I have
    >>evaluated - thus - eventually - purchased.
    >>
    >>Luca Deri's open source ntop was a nice one, but what I have - in fact -
    >>used from Luca's creations was the commercial (negligible price, compared
    >>to Crannog's software) nProbe, which allowed me to create flows from
    >>non-netflow/non-Cisco equipment (e.g. Nortel routers, other switches at
    >>the trunk level, etc.), and send them to the same collector where my
    >>6500s, 38xx, etc also export - so now I have Netflow tracker giving me a
    >>complete picture of all the flows traversing my LANs and WAN.
    >>
    >>HTH,
    >>Papi
    >>
    >>On Fri, 21 Jan 2005 12:10:18 +0100, Martin Raab wrote:
    >>
    >>> Hi comp.dcom.sys.cisco,
    >>>
    >>> which software do you recommend for collecting and accounting of
    >>> netflow data.
    >>>
    >>> All routers are Cisco routers from diffrent sizes.
    >>>
    >>> We want to use netflow version 5. not sampled, since we have sometimes
    >>> more than one customer behind one interface. so it should be ip adress
    >>> related accounting.
    >>>
    >>> Software could be open-source or commercial.
    >>>
    >>> Looking forward to hear from you.
    >>>
    >>> Thank you.
    >>>
    >>> Best Regards,
    >>> Martin
    >>>
    >>> PS: Please DO NOT pm, email adress not check often. Reply/Follow up in
    >>> this group. Thx.
     
    papi, Jan 27, 2005
    #9
  10. Martin Raab

    Guest

    , Feb 23, 2005
    #10
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Steve Wright

    Netflow, IP Accounting and Linux

    Steve Wright, Jan 3, 2005, in forum: Cisco
    Replies:
    1
    Views:
    831
    Garry Glendown
    Jan 3, 2005
  2. Bancal
    Replies:
    2
    Views:
    3,311
    donthomas
    Oct 29, 2009
  3. Bancal
    Replies:
    0
    Views:
    475
    Bancal
    Feb 18, 2005
  4. Giuen
    Replies:
    0
    Views:
    1,068
    Giuen
    Sep 12, 2008
  5. pfisterfarm

    IP accounting vs. NetFlow

    pfisterfarm, Dec 17, 2009, in forum: Cisco
    Replies:
    1
    Views:
    1,471
    pfisterfarm
    Dec 17, 2009
Loading...

Share This Page