Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [netflow]

51 questions
20
votes
4 answers

How to generate netflow data in linux

We have a number of Linux servers for which I would like to capture netflow data to be processed by a netflow analyzer. I've been spoiled by the ease in which Mikrotik routers allow netflow data generation, but I haven't managed to find an…
Richard Keller
  • 2,270
  • 2
  • 18
  • 31
16
votes
6 answers

Solution to route/proxy SNMP Traps (or Netflow, generic UDP, etc) for network monitoring?

I'm implementing a network monitoring solution for a very large network (approximately 5000 network devices). We'd like to have all devices on our network send SNMP traps to a single box (technically this will probably be an HA pair of boxes) and…
Christopher Cashell
  • 8,999
  • 2
  • 31
  • 43
6
votes
5 answers

Monitoring Bandwidth Usage (Per Internal IP) - Cisco ASA 5505

I manage a small network with a Cisco ASA 5505 and a shared DSL connection. I would like to be able monitor the bandwidth usage of the various users/devices on my network (by IP address). Can I do that using the ASA? Has anyone got this working? …
Joseph Sturtevant
  • 1,234
  • 3
  • 15
  • 17
4
votes
4 answers

Netflow Collector for Windows Free

Is there a free netflow collector that I can throw on a windows box?
jimconstable
  • 865
  • 1
  • 10
  • 10
4
votes
3 answers

Can I use Cisco ASA's "NetFlow Security Event Logging" (NetFlow 9) for bandwidth monitoring

Cisco has introduced NetFlow 9 export in the latest software version for ASA firewalls. But it seems to be meant for event logging of security events only (as a replacement for syslog messages). But can it still be used for bandwidth monitoring,…
networker1
  • 61
  • 1
  • 1
  • 7
4
votes
0 answers

How to support VRF in Netflow Collector?

I am somehow able to analyze netflow packet using my own netflow collector (build in python). It works for certain ip and CIDR(Classless Inter Domain routing), definitely not overlapping. What is the best way to support VRF(Virtual Routing and…
Zangetsu
3
votes
6 answers

Generating and capturing Netflow on a Linux router

We currently have a dual-NIC Ubuntu server at our data centre acting as the gateway router between our public networks and our ISP. We have a /30 cross connect network on the ISP-facing NIC, and one IP from each of the three networks attached to our…
mlambie
  • 1,201
  • 2
  • 16
  • 22
2
votes
3 answers

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there are any specific information-elements meant for…
Ani
  • 32
  • 12
2
votes
1 answer

What is the difference between flow-cat and flow-merge?

I am trying to create some monitoring based on flow-tools: I have flow-capture running to log things into directories. Now I need to merge files together for my analysation interval. I have looked at the manpage for flow-cat and flow-merge. They…
Elrond
  • 556
  • 2
  • 5
  • 16
2
votes
1 answer

ntop to analyse bandwidth usage on multiple ASA 5505

I have set up a netflow server at our data centre, which is connected via VPN to ~40 remote offices using Cisco ASA 5505. The aim is to analyse usage data and find out exactly how the remote connections are being used. I followed through…
dunxd
  • 9,482
  • 21
  • 80
  • 117
2
votes
2 answers

iptables+iptables_netflow: iptables blocking netflow export?

I am running an iptables firewall on OpenSuSE 11.3 --recently I became interested in traffic monitoring and accounting, and to this end installed iptables_netflow module on the firewall and WANGuard Platform on another server. The iptables_netflow…
Kendall
  • 1,043
  • 12
  • 24
2
votes
2 answers

How useful is the sysUptime value in a Netflow packet?

The value is in theory precise down to the millisecond, but I am skeptical. Does that number tell when the packet was transmitted, or when the connection began or ended? Note: Subsequently I noticed that there are flow-start time & flow-end time…
Spresso
  • 21
  • 4
2
votes
4 answers

Can someone explain what NETFLOW. and IPFLOW are?

I hear these terms used a lot but haven't found a decent explanation of what they are, how they are used, and what the data looks like (e.g. can you view this data in wireshark?)?
5k1zk17
  • 23
  • 3
2
votes
1 answer

NTOP vs NFSEN, which one?

I want to monitor Cisco's newflows. Which one of these tools do you recommend?
Andre
  • 1,333
  • 4
  • 18
  • 31
2
votes
2 answers

Problems with getting both ingress and egress Netflow data

I have a Cisco 6500 switch that I want to capture all vlan8 traffic incoming and outgoing. I talked with my networking group and they set me up with the following commands. (May not be exact commands but this was an example I gave them) conf t ip…
user22492
1
2 3 4